Sponsored: Aspen Insurance

The Path of Least Resistance Is Leading Clients in the Wrong Direction

The relaxed underwriting characteristic of a soft market, paired with an evolving risk like cyber, can spell trouble for brokers and clients.
By: | July 12, 2017 • 6 min read

The cyber insurance market today bears little resemblance to the cyber market of just three years ago.

As cyber risk evolved and expanded —and more organizations grasped their exposures — the demand for coverage rose sharply. Now a dynamic typical of a traditional insurance marketplace is playing out: more carriers and more capital have ushered in a soft market cycle.

This influx of capacity has led to increased competition among carriers, and the overarching theme seems to be more about gaining short-term market share than establishing sustainable portfolios by virtue of thoughtful risk selection. With the threat landscape continuing to deteriorate at a rapid pace, and malicious actors becoming increasingly sophisticated, Jeff Bores, Vice President, Cyber Liability, at Aspen Insurance, has noticed a potentially alarming trend. “There is tremendous pressure on both underwriters and brokers to produce at a high level,” Bores remarked. “The underwriting community is feeling it from their brokering partners, who are in turn feeling it from their clients. The dramatic increase in competition has really led to a relaxation in underwriting scrutiny.”

“We have a duty as underwriters to evaluate each risk on its merits and raise questions about deficiencies we recognize in an applicant’s security posture,” Bores said. “Ultimately, our responsibility is to the risk bearing entities we represent to select the strongest risks. Our ability as underwriters to push back on our brokering partners has a potential trickle-down effect to the client level, where it can apply pressure to applicants to devote additional attention and resources to their security posture. If we fail to bring the deficiencies we recognize to light or just gloss over them, our silence sends a message of positive reinforcement to insureds that their approach to security is sound; that is often not the case, especially in the small and mid-market space.”

Brokers Beware: Choose Your Markets (and Underwriters) Carefully

Jeff Bores, Vice President, Cyber Liability

With multiple Cyber markets from which to choose, brokers and their clients are at a crossroads. They can take the path of least resistance by placing coverage with a less sophisticated market that offers broad coverage without pressing for details on the client’s security posture. Doing so makes a broker’s job easier in the short term, and gets coverage in force more quickly for the client.

But this route bears significant intermediate and long-term risks for both clients and brokers.

“Ultimately, as the threat landscape continues to worsen and client security programs fail to evolve, the gap between the client and malicious actors will likely widen,” Bores remarked. “This will lead to a material increase in losses, which generally translates to increased volatility on the carrier side.”

The best way for an organization to prevent a breach is to have a holistic view of their exposure and employ a thoughtful defense-in-depth based approach to security. One way to evaluate those defenses is by having them reviewed by outside, technical third parties, including the underwriting community.

Underwriters who are able to evaluate the details of a client’s security posture and identify areas for improvement are extremely valuable.

By seeking out underwriters with a deeper knowledge of sound privacy and network security practices, brokers bring greater value to their clients beyond just purchasing an appropriate policy.

The Benefits of Strong Underwriting

Strong underwriting can help to keep security standards high and costs more consistent over time. Asking follow-up questions and selecting quality risks are signs of an underwriter that has technical expertise and longevity in the cyber market.

“Even if the insured has network protections in place like a firewall and an intrusion detection system, the underwriter should be probing for more details,” Bores said. “And they should absolutely be looking into any boxes on the application in which the applicant checked ‘no,’ signaling a lack of security in that area, as the absence of those controls could be detrimental to the client dependent on their operations and exposure basis.”

Failing to follow up or push back on poor controls can foster a sense of complacency for clients, which can be damaging to the individual insureds and financially perilous to the insurance industry in aggregate.

“When underwriters fail to press clients on substandard security measures, it could lead insureds to assume they have sound controls in place. As a result, their behavior remains static while the hackers and cyber criminals remain on the attack and continue to evolve,” Bores said.

Five years (or even one year) down the road, that under-preparedness will likely come back to haunt those insureds and the carriers who cover them. A spate of material losses could then spur a shakeup of the marketplace and trigger a carrier exodus, driving up prices across the market and ultimately leaving companies looking for new, and likely more expensive coverage.

The implications extend beyond the insurance market. Lack of strong and up-to-date system security could have dangerous effects for the financial markets, critical infrastructure, and for national security.

What a Knowledgeable Cyber Underwriter Looks Like

Information security expertise enables underwriters to communicate effectively with clients, including with Chief Information Security Officers or IT Security Directors, who regularly and actively participate in underwriting meetings.

Both Bores and Josh Ladeau, Senior Vice President, Head of U.S. Cyber Risk for Aspen, are Certified Information Systems Security Professionals (CISSP). That industry knowledge allows them to ask the right questions to understand clients’ full breadth of cyber risk, and to know whether a given response is suitable; that can give them an edge over other markets.

“I frequently go to underwriting meetings where there are nine or ten different markets represented, and it’s the same two to three people who are asking specific questions about the risk,” Bores said. “Establishing a dialogue with a client’s privacy and network security professionals is important; not only does it help to establish the security posture of a client, but it also lets those professionals know that we have the capacity to appreciate the security investments made by their organization.”

“I think it’s important, particularly to well-secured clients, that they are partnered with an insurance carrier that understands the nuances of their security policies and controls,” said Bores.

It’s just as important to work with brokers who are equally concerned with the technical aspects of a client’s cyber risk exposure. “We’ve found that when brokers are willing to engage the client along with us, the client is much more likely to pay attention. In that way, we’re able to interact on a deeper level and demonstrate the heightened value we offer.”

As a testament to its dedication to clients who work hard at strengthening their security, Aspen will routinely provide any element of cyber coverage its insureds need, without applying sub-limits.

For U.S.-based clients, Aspen also differentiates itself from the market by offering a concise, plain-English form that brokers can more easily explain to clients. At eight pages in length, it’s half the size of the 15 to 20 pages that has become the industry standard. There are no sub-limits inherent to the base policy form, and some aspects are even offered on an uncapped basis.

“We may not always charge the lowest premiums, but we pride ourselves on the expertise and full support we provide for our clients, in addition to an insurance product of the highest quality. That’s where our value lies,” Bores said.

To learn more about Aspen’s cyber liability products and services, visit https://www.aspen.co/Insurance/Insurance-lines/Financial-and-Professional-Lines/cyber-risk/.

This article is provided for informational purposes only, does not necessarily represent Aspen’s views, and reflects the opinion of the authors in light of market, regulatory and other conditions which may change over time. Aspen does not undertake a duty to update the article.


This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Aspen Insurance. The editorial staff of Risk & Insurance had no role in its preparation.

Aspen Insurance is a business segment of Aspen Insurance Holdings Limited.

2017 Risk All Stars

Immeasurable Value

The 2017 Risk All Stars strengthened their organizations by taking ownership of improved risk management processes and not quitting until they were in place.
By: | September 12, 2017 • 3 min read

Being the only person to hold a particular opinion or point of view within an organization cannot be easy. Do the following sound like familiar stories? Can you picture yourself or one of your risk management colleagues as the hero or heroine? Or better yet, as a Risk & Insurance® Risk All Star?


One risk manager took a job with a company that was being spun off, and the risk management program, which was built for a much larger company, was not a good fit for the spun-off company.
Rather than sink into inertia, this risk manager took the bull by the horns and began an aggressive company intranet campaign to instill better safety and other risk management practices throughout the organization.

The risk manager, 2017 Risk All Star Michelle Bennett of Cable One, also changed some long-standing brokerage relationships that weren’t a good fit for the risk management and insurance program. In her first year on the job she produced premium savings and in her second year is in the process of introducing ERM company-wide.

Or perhaps this one rings a bell. The news is trickling out that a company is poised to dramatically expand, increasing the workforce three- or four-fold. Having this knowledge with certainty would be a great benefit to a risk manager, who could begin girding safety, workers’ comp and related programs accordingly. But things sometimes don’t work that way, do they? Sometimes the risk manager is one of the last people to know.

The Risk All Star Award recognizes at its core, creativity, perseverance and passion. The 13 winners of this year’s award all displayed those traits in abundance.

In the case of 2017 Risk All Star winner Steve Richards of the Coca-Cola Bottling Company, the news of an expansion spurred him to action. He completely overhauled the company’s workers’ compensation program and streamlined its claim management system. The results, even with a much higher headcount, were reduced legal costs, better return-to-work experiences for injured workers and a host of other improvements and savings.

The Risk All Star Award recognizes at its core, creativity, perseverance and passion. The 13 winners of this year’s award all displayed those traits in abundance. Sometimes it took years for a particular risk solution, as promoted by a risk manager, to find acceptance.

In other cases a risk manager got so excited about a solution, they never even considered getting turned down. They just kept pushing until they carried the day.


Butler University’s Zach Finn became obsessive about what he felt was a lackluster effort on the part of the insurance industry to bring in new talent. The former risk manager for the J.M. Smucker Co. settled on the creation of a student-run captive to give his risk management students the experience they would need to get hired right out of college.

The result was a better risk management program for the university’s College of Liberal Arts and Sciences, and immediate traction in the job market for Finn’s students.

A few of our Risk All Stars told us that the results they are achieving were decades in the making. Only by year-in, year-out dedication to gaining transparency about her co-op’s risks and learning more and more about her various insurance carriers, did Growmark Inc.’s Faith Cring create a stalwart risk management and insurance program that is the envy of the agricultural sector. Now she’s been with some of her insurance carriers more than 20 years — some more than 30 years.

Having the right idea and not having a home for it can be a lonely, frustrating experience. Having the creativity, the passion and perhaps, most importantly, the perseverance to see it through and get great results makes you a Risk All Star. &


Risk All Stars stand out from their peers by overcoming challenges through exceptional problem solving, creativity, perseverance and passion.

See the complete list of 2017 Risk All Stars.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]