{"id":8412,"date":"2018-04-30T12:03:58","date_gmt":"2018-04-30T16:03:58","guid":{"rendered":"https:\/\/digital.hbs.edu\/platform-digit\/submission\/aig-learning-to-insure-a-digital-world\/"},"modified":"2018-04-30T15:49:33","modified_gmt":"2018-04-30T19:49:33","slug":"aig-cyber-insurance-learning-to-insure-a-digital-world","status":"publish","type":"hck-submission","link":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/","title":{"rendered":"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World"},"content":{"rendered":"

With 6% market share, AIG is the largest commercial insurance provider in the United States. The giant insurer, who was one of the most infamous participants in the 2008 financial crisis, has a market cap of $50B and offers policies that cover 90 million clients across 100 countries. AIG\u2019s reputation and performance in underwriting has been volatile through the years, but they have built a massive business by aggregating data, amassing capital, and quantifying risk.<\/p>\n

The challenge for AIG in 2018 is understanding how to quantify and evaluate risk in an increasingly digital world. The digital age has delivered a plethora of data and resources to better understand risk and to make more precise decisions. However, it has also introduced entirely new areas of risk. Data, computers, and the machines they power are swiftly becoming the most important and the most vulnerable assets in the economy.<\/p>\n

Cyber Insurance<\/strong><\/h3>\n

Until recently, most of the focus has been on protecting those digital assets through cyber security. Data breaches are incredibly damaging to any organization, not just because data or other vital information was stolen, but also because the 2nd<\/sup> and 3rd<\/sup> order consequences of a breach (notifications, theft, PR, forensic services) are incredibly costly. As major breaches (Equifax, Sony, Anthem) increase in frequency, we are learning that security measures are not enough. Due to the dynamic nature of cyber threats and the inability to protect against internal human error, 100% effective cyber security is not plausible.<\/p>\n

Therefore, organizations are finally starting to see data security as not just an IT problem but also a risk management problem. Consequently, cyber insurance has emerged as a market need and a crucial opportunity for AIG.<\/em><\/strong><\/p>\n

\"\"<\/a><\/p>\n

Standalone cyber insurance (outside of a general policy) is a recent phenomenon, and the underwriting of cyber insurance is limited by immature inputs and limited expertise. Potential buyers of cyber insurance are likewise confused by inconsistent product offerings and lack of standardization in cyber policies. The problem for underwriters like AIG is they have no precedent and very little historical data for evaluating a firm\u2019s cyber risk. Cyber insurance is not like providing flood insurance, where one can look at decades of historical data and then analyze a one-dimensional risk. An organization\u2019s IT environment is constantly evolving, with various endpoints and countless vulnerabilities. Furthermore, the threats or the bad actors are often unknown, originating from any number of sources (internal, external, foreign, etc.) Simply put, an organization like AIG would have no institutional muscle for underwriting cyber risk, building an \u201cactuarial\u201d table, or gathering the requisite threat intelligence data to inform their evaluation. In addition, risk management firms and cyber security firms that may have the requisite cyber expertise do not have the underwriting capability, the financing, or the breadth of data needed to offer effective policies.<\/p>\n

To successfully serve this nascent market, firms need to leverage capabilities from disparate entities and coordinate them into a coherent offering.<\/strong><\/em><\/p>\n

What is AIG doing now? <\/strong><\/h3>\n

AIG knows that cyber insurance is going to be critical to their business and they are investing as such. The insurer has launched multiple standalone cyber insurance policies, including the first P&C (property and casualty) cyber policy. AIG\u2019s main cyber product is called CyberEdge, which is a liability insurance that covers financial costs associated with the breach, as well as the first-party costs of breach remediation and network restoration. CyberEdge also includes the option to insure physical world losses and business interruption (increasingly more important as IoT explodes).<\/p>\n

AIG is trying to approach digital asset risk in a holistic way, building a solution that starts with risk consultation and preventative measures and flows to insurance coverage and breach resolution services. Although at this time, it is unclear how much of their offering is marketing and how much they can effectively deliver on.<\/p>\n

AIG’s E2E Cyber Insurance Offering<\/strong>
\n\"\"<\/a><\/p>\n

AIG is buttressing these offerings through multiple partnerships with firms that have cyber security and risk management expertise. For example, AIG recently launched CyberMatics, a cyber underwriting application model to provide more clarity around how they are evaluating cyber risk. The insights and data that power Cybermatics are coming from CrowdStrike and Darktrace, two of the market leaders in Endpoint security and threat intelligence, respectively. AIG is also partnering with firms like Bitsight (which offers cyber risk scores), RSA (vulnerability assessments), IBM (security services), RiskAnalytics (risk management), and K2 Intelligence (dark web intelligence).<\/p>\n

What must AIG do going forward?<\/strong><\/h3>\n

Partnerships & Capabilities<\/em> \u2013 <\/strong><\/p>\n

To effectively capitalize on this market opportunity and deliver operative policies for their customers, AIG needs to continue its aggressive coordination of partnerships where they have expertise gaps. In parallel, AIG also needs to start building in house capabilities for assessing risk in their customers digital assets. AIG should be strategic about which capabilities it builds, focusing on the most foundational capabilities first. For example, a data management system that can organize all of AIG\u2019s clients proprietary data in the context of cyber vulnerabilities. This will give AIG more efficiency in assessing risk and also the ability to create a larger network of threat data that can be shared across customers (network effect).<\/p>\n

Capability development will require strategic focus and targeted hiring, and it can also be done through investments and acquisitions. It will be very difficult for a venture-backed startup to raise enough capital to underwrite policies, so as clever technological solutions emerge, AIG is well positioned to invest and\/or partner.<\/p>\n

Organization & Leadership<\/em> \u2013 <\/strong><\/p>\n

9 years after the financial crisis in 2008, the U.S. Financial Stability Oversight Council removed AIG from the list of Systemically risky institutions (too big to fail). The collateralized debt obligations (CDOs) that AIG\u2019s financial products division were insuring through credit default swaps cost the company $25 billion dollars, but the U.S. government saved the insurer because it was systemically important to our economy. Since then, AIG has changed several things about the way they operate. Improving the firm\u2019s digital posture and capacity to utilize data continues to be a challenge, but it is essential for their survival.<\/p>\n

Setting aside the need for cyber insurance policies, AIG has struggled to future fit their business (both operationally and customer facing) to the norms of the digital age. Until now, their sheer size and underwriting capacity (and their status as \u201ctoo big to fail\u201d) has given them a moat around disruption. However, as 2008 showed us, this is not just a business that needs to more efficiently leverage its data and resources to offer new products. AIG is a business that needs to disrupt its processes, re-purpose its people, and shift its strategic focus to deliver big-data-driven insurance. This starts at the top, with a more precise focus on using their data to carefully analyze risk.<\/p>\n

In the past, AIG focused on growing assets as a means of continuing to deliver value to shareholders. For the first time in a while, AIG has less than $500B of assets on their balance sheet, and they seem to be focusing on efficiency and quality. As they continue their efforts to modernize the company, AIG will encounter significant internal and external pressure. Legacy stakeholders and employees will push back on the changes, and some will be left behind. Shareholders may bemoan investments. But AIG leadership needs to be steadfast in their sponsorship of cyber insurance and digital innovation.<\/p>\n

Within cyber insurance specifically, it will be a challenge to upright an entire new division of policy underwriting. Through partnerships, recruiting, and asset acquisition, AIG needs to give the necessary resources and management sponsorship to make cyber insurance a pillar of their commercial insurance business. Most of the legacy decision makers in commercial insurance will not understand why AIG is doing this, and many will object. Inserting cyber expertise into an old insurance organization will be like mixing oil with water at first, but they must follow through. Leadership can look at the business from 10,000 feet, and thus should steadfastly maintain the importance of building out this part of the business. If the mandate is left to middle-management, it will lose prioritization quickly.<\/p>\n

Conclusion<\/strong><\/h3>\n

Most in the cyber security community believe that market forecasts and analyses grossly underestimate the magnitude of cyber risk and thus the requisite investment that will be required to secure our data. We are approaching an age where all data is stored in the cloud and all machines are managed from handheld devices. As these things happen, the potential for disruption and damage done through cyber-attacks is limitless. AIG is well positioned to help companies manage these risks.<\/p>\n

 <\/p>\n

 <\/p>\n

Sources:<\/p>\n

    \n
  1. AIG<\/li>\n
  2. AoN Hewitt Global Report<\/li>\n
  3. https:\/\/www.insurancejournal.com\/news\/national\/2017\/12\/12\/473847.htm<\/li>\n
  4. PwC<\/li>\n
  5. Allied Market Research<\/li>\n
  6. Techcrunch<\/li>\n
  7. cisomag.com<\/li>\n
  8. Goldman Sachs – Cyber Security in a Digital and Connected World https:\/\/www.gsam.com\/content\/dam\/gsam\/pdfs\/us\/en\/advisor-resources\/business-practices\/BP-Cybersecurity-Presentation-ind.pdf?sa=n&rd=n<\/li>\n
  9. https:\/\/www.cio.com\/article\/3065655\/cyber-attacks-espionage\/what-is-cyber-insurance-and-why-you-need-it.html<\/li>\n
  10. https:\/\/www.reuters.com\/article\/us-aig-cyber\/aig-to-include-cyber-coverage-to-commercial-casualty-insurance-idUSKBN1CV2XE<\/li>\n
  11. http:\/\/fortune.com\/2017\/04\/08\/cyber-security-insurance-cybersecurity-aig-2017-tools-news\/<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    One of the World's largest insurers is investing heavily into the most important insurance category of the future: Cyber Insurance.<\/p>\n","protected":false},"author":1967,"featured_media":8417,"comment_status":"open","ping_status":"closed","template":"","categories":[29,235,894],"class_list":["post-8412","hck-submission","type-hck-submission","status-publish","has-post-thumbnail","hentry","category-big-data","category-cyber-security","category-insurance","hck-taxonomy-organization-aig","hck-taxonomy-industry-insurance","hck-taxonomy-country-united-states"],"connected_submission_link":"https:\/\/d3.harvard.edu\/platform-digit\/assignment\/driving-digital-transformation\/","yoast_head":"\nAIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation\" \/>\n<meta property=\"og:description\" content=\"One of the World's largest insurers is investing heavily into the most important insurance category of the future: Cyber Insurance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital Innovation and Transformation\" \/>\n<meta property=\"article:modified_time\" content=\"2018-04-30T19:49:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/d3.harvard.edu\/platform-digit\/wp-content\/uploads\/sites\/2\/2018\/04\/Cyber-insurance-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"399\" \/>\n\t<meta property=\"og:image:height\" content=\"221\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/\",\"name\":\"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2018\\\/04\\\/Cyber-insurance-1.png\",\"datePublished\":\"2018-04-30T16:03:58+00:00\",\"dateModified\":\"2018-04-30T19:49:33+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/#primaryimage\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2018\\\/04\\\/Cyber-insurance-1.png\",\"contentUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2018\\\/04\\\/Cyber-insurance-1.png\",\"width\":399,\"height\":221},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/aig-cyber-insurance-learning-to-insure-a-digital-world\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Submissions\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/submission\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/#website\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/\",\"name\":\"Digital Innovation and Transformation\",\"description\":\"MBA Student Perspectives\",\"potentialAction\":[{\"@type\":\"性视界Action\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-digit\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/","og_locale":"en_US","og_type":"article","og_title":"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation","og_description":"One of the World's largest insurers is investing heavily into the most important insurance category of the future: Cyber Insurance.","og_url":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/","og_site_name":"Digital Innovation and Transformation","article_modified_time":"2018-04-30T19:49:33+00:00","og_image":[{"width":399,"height":221,"url":"https:\/\/d3.harvard.edu\/platform-digit\/wp-content\/uploads\/sites\/2\/2018\/04\/Cyber-insurance-1.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/","url":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/","name":"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World - Digital Innovation and Transformation","isPartOf":{"@id":"https:\/\/d3.harvard.edu\/platform-digit\/#website"},"primaryImageOfPage":{"@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/#primaryimage"},"image":{"@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/#primaryimage"},"thumbnailUrl":"https:\/\/d3.harvard.edu\/platform-digit\/wp-content\/uploads\/sites\/2\/2018\/04\/Cyber-insurance-1.png","datePublished":"2018-04-30T16:03:58+00:00","dateModified":"2018-04-30T19:49:33+00:00","breadcrumb":{"@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/#primaryimage","url":"https:\/\/d3.harvard.edu\/platform-digit\/wp-content\/uploads\/sites\/2\/2018\/04\/Cyber-insurance-1.png","contentUrl":"https:\/\/d3.harvard.edu\/platform-digit\/wp-content\/uploads\/sites\/2\/2018\/04\/Cyber-insurance-1.png","width":399,"height":221},{"@type":"BreadcrumbList","@id":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/aig-cyber-insurance-learning-to-insure-a-digital-world\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/d3.harvard.edu\/platform-digit\/"},{"@type":"ListItem","position":2,"name":"Submissions","item":"https:\/\/d3.harvard.edu\/platform-digit\/submission\/"},{"@type":"ListItem","position":3,"name":"AIG & Cyber Insurance \u2013 Learning to Insure a Digital World"}]},{"@type":"WebSite","@id":"https:\/\/d3.harvard.edu\/platform-digit\/#website","url":"https:\/\/d3.harvard.edu\/platform-digit\/","name":"Digital Innovation and Transformation","description":"MBA Student Perspectives","potentialAction":[{"@type":"性视界Action","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/d3.harvard.edu\/platform-digit\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/hck-submission\/8412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/hck-submission"}],"about":[{"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/types\/hck-submission"}],"author":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/users\/1967"}],"replies":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/comments?post=8412"}],"version-history":[{"count":0,"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/hck-submission\/8412\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/media\/8417"}],"wp:attachment":[{"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/media?parent=8412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-digit\/wp-json\/wp\/v2\/categories?post=8412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}