Sponsored: Aspen Insurance

The Path of Least Resistance Is Leading Clients in the Wrong Direction

The relaxed underwriting characteristic of a soft market, paired with an evolving risk like cyber, can spell trouble for brokers and clients.
By: | July 12, 2017 • 6 min read

The cyber insurance market today bears little resemblance to the cyber market of just three years ago.

As cyber risk evolved and expanded —and more organizations grasped their exposures — the demand for coverage rose sharply. Now a dynamic typical of a traditional insurance marketplace is playing out: more carriers and more capital have ushered in a soft market cycle.

This influx of capacity has led to increased competition among carriers, and the overarching theme seems to be more about gaining short-term market share than establishing sustainable portfolios by virtue of thoughtful risk selection. With the threat landscape continuing to deteriorate at a rapid pace, and malicious actors becoming increasingly sophisticated, Jeff Bores, Vice President, Cyber Liability, at Aspen Insurance, has noticed a potentially alarming trend. “There is tremendous pressure on both underwriters and brokers to produce at a high level,” Bores remarked. “The underwriting community is feeling it from their brokering partners, who are in turn feeling it from their clients. The dramatic increase in competition has really led to a relaxation in underwriting scrutiny.”

“We have a duty as underwriters to evaluate each risk on its merits and raise questions about deficiencies we recognize in an applicant’s security posture,” Bores said. “Ultimately, our responsibility is to the risk bearing entities we represent to select the strongest risks. Our ability as underwriters to push back on our brokering partners has a potential trickle-down effect to the client level, where it can apply pressure to applicants to devote additional attention and resources to their security posture. If we fail to bring the deficiencies we recognize to light or just gloss over them, our silence sends a message of positive reinforcement to insureds that their approach to security is sound; that is often not the case, especially in the small and mid-market space.”

Brokers Beware: Choose Your Markets (and Underwriters) Carefully

Jeff Bores, Vice President, Cyber Liability

With multiple Cyber markets from which to choose, brokers and their clients are at a crossroads. They can take the path of least resistance by placing coverage with a less sophisticated market that offers broad coverage without pressing for details on the client’s security posture. Doing so makes a broker’s job easier in the short term, and gets coverage in force more quickly for the client.

But this route bears significant intermediate and long-term risks for both clients and brokers.

“Ultimately, as the threat landscape continues to worsen and client security programs fail to evolve, the gap between the client and malicious actors will likely widen,” Bores remarked. “This will lead to a material increase in losses, which generally translates to increased volatility on the carrier side.”

The best way for an organization to prevent a breach is to have a holistic view of their exposure and employ a thoughtful defense-in-depth based approach to security. One way to evaluate those defenses is by having them reviewed by outside, technical third parties, including the underwriting community.

Underwriters who are able to evaluate the details of a client’s security posture and identify areas for improvement are extremely valuable.

By seeking out underwriters with a deeper knowledge of sound privacy and network security practices, brokers bring greater value to their clients beyond just purchasing an appropriate policy.

The Benefits of Strong Underwriting

Strong underwriting can help to keep security standards high and costs more consistent over time. Asking follow-up questions and selecting quality risks are signs of an underwriter that has technical expertise and longevity in the cyber market.

“Even if the insured has network protections in place like a firewall and an intrusion detection system, the underwriter should be probing for more details,” Bores said. “And they should absolutely be looking into any boxes on the application in which the applicant checked ‘no,’ signaling a lack of security in that area, as the absence of those controls could be detrimental to the client dependent on their operations and exposure basis.”

Failing to follow up or push back on poor controls can foster a sense of complacency for clients, which can be damaging to the individual insureds and financially perilous to the insurance industry in aggregate.

“When underwriters fail to press clients on substandard security measures, it could lead insureds to assume they have sound controls in place. As a result, their behavior remains static while the hackers and cyber criminals remain on the attack and continue to evolve,” Bores said.

Five years (or even one year) down the road, that under-preparedness will likely come back to haunt those insureds and the carriers who cover them. A spate of material losses could then spur a shakeup of the marketplace and trigger a carrier exodus, driving up prices across the market and ultimately leaving companies looking for new, and likely more expensive coverage.

The implications extend beyond the insurance market. Lack of strong and up-to-date system security could have dangerous effects for the financial markets, critical infrastructure, and for national security.

What a Knowledgeable Cyber Underwriter Looks Like

Information security expertise enables underwriters to communicate effectively with clients, including with Chief Information Security Officers or IT Security Directors, who regularly and actively participate in underwriting meetings.

Both Bores and Josh Ladeau, Senior Vice President, Head of U.S. Cyber Risk for Aspen, are Certified Information Systems Security Professionals (CISSP). That industry knowledge allows them to ask the right questions to understand clients’ full breadth of cyber risk, and to know whether a given response is suitable; that can give them an edge over other markets.

“I frequently go to underwriting meetings where there are nine or ten different markets represented, and it’s the same two to three people who are asking specific questions about the risk,” Bores said. “Establishing a dialogue with a client’s privacy and network security professionals is important; not only does it help to establish the security posture of a client, but it also lets those professionals know that we have the capacity to appreciate the security investments made by their organization.”

“I think it’s important, particularly to well-secured clients, that they are partnered with an insurance carrier that understands the nuances of their security policies and controls,” said Bores.

It’s just as important to work with brokers who are equally concerned with the technical aspects of a client’s cyber risk exposure. “We’ve found that when brokers are willing to engage the client along with us, the client is much more likely to pay attention. In that way, we’re able to interact on a deeper level and demonstrate the heightened value we offer.”

As a testament to its dedication to clients who work hard at strengthening their security, Aspen will routinely provide any element of cyber coverage its insureds need, without applying sub-limits.

For U.S.-based clients, Aspen also differentiates itself from the market by offering a concise, plain-English form that brokers can more easily explain to clients. At eight pages in length, it’s half the size of the 15 to 20 pages that has become the industry standard. There are no sub-limits inherent to the base policy form, and some aspects are even offered on an uncapped basis.

“We may not always charge the lowest premiums, but we pride ourselves on the expertise and full support we provide for our clients, in addition to an insurance product of the highest quality. That’s where our value lies,” Bores said.

To learn more about Aspen’s cyber liability products and services, visit https://www.aspen.co/Insurance/Insurance-lines/Financial-and-Professional-Lines/cyber-risk/.

This article is provided for informational purposes only, does not necessarily represent Aspen’s views, and reflects the opinion of the authors in light of market, regulatory and other conditions which may change over time. Aspen does not undertake a duty to update the article.


This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Aspen Insurance. The editorial staff of Risk & Insurance had no role in its preparation.

Aspen Insurance is a business segment of Aspen Insurance Holdings Limited.

Risk Management

The Profession: Curt Gross

This director of risk management sees cyber, IP and reputation risks as evolving threats, but more formal education may make emerging risk professionals better prepared.
By: | June 1, 2018 • 4 min read

R&I: What was your first job?

My first non-professional job was working at Burger King in high school. I learned some valuable life lessons there.

R&I: How did you come to work in risk management?

After taking some accounting classes in high school, I originally thought I wanted to be an accountant. After working on a few Widgets Inc. projects in college, I figured out that wasn’t what I really wanted to do. Risk management found me. The rest is history. Looking back, I am pleased with how things worked out.

R&I: What is the risk management community doing right?


I think we do a nice job on post graduate education. I think the ARM and CPCU designations give credibility to the profession. Plus, formal college risk management degrees are becoming more popular these days. I know The University of Akron just launched a new risk management bachelor’s program in the fall of 2017 within the business school.

R&I: What could the risk management community be doing a better job of?

I think we could do a better job with streamlining certificates of insurance or, better yet, evaluating if they are even necessary. It just seems to me that there is a significant amount of time and expense around generating certificates. There has to be a more efficient way.

R&I: What was the best location and year for the RIMS conference and why?

Selfishly, I prefer a destination with a direct flight when possible. RIMS does a nice job of selecting various locations throughout the country. It is a big job to successfully pull off a conference of that size.

Curt Gross, Director of Risk Management, Parker Hannifin Corp.

R&I: What’s been the biggest change in the risk management and insurance industry since you’ve been in it?

Definitely the change in nontraditional property & casualty exposures such as intellectual property and reputational risk. Those exposures existed way back when but in different ways. As computer networks become more and more connected and news travels at a more rapid pace, it just amplifies these types of exposures. Sometimes we have to think like the perpetrator, which can be difficult to do.

R&I: What emerging commercial risk most concerns you?

I hate to sound cliché — it’s quite the buzz these days — but I would have to say cyber. It’s such a complex risk involving nontraditional players and motives. Definitely a challenging exposure to get your arms around. Unfortunately, I don’t think we’ll really know the true exposure until there is more claim development.

R&I: What insurance carrier do you have the highest opinion of?


Our captive insurance company. I’ve been fortunate to work for several companies with a captive, each one with a different operating objective. I view a captive as an essential tool for a successful risk management program.

R&I: Who is your mentor and why?

I can’t point to just one. I have and continue to be lucky to work for really good managers throughout my career. Each one has taken the time and interest to develop me as a professional. I certainly haven’t arrived yet and welcome feedback to continue to try to be the best I can be every day.

R&I: What have you accomplished that you are proudest of?

I would like to think I have and continue to bring meaningful value to my company. However, I would have to say my family is my proudest accomplishment.

R&I: What is your favorite book or movie?

Favorite movie is definitely “Good Will Hunting.”

R&I: What’s the best restaurant you’ve ever eaten at?

Tough question to narrow down. If my wife ran a restaurant, it would be hers. We try to have dinner as a family as much as possible. If I had to pick one restaurant though, I would say Fire Food & Drink in Cleveland, Ohio. Chef Katz is a culinary genius.

R&I: What is the most unusual/interesting place you have ever visited?

The Grand Canyon. It is just so vast. A close second is Stonehenge.

R&I: What is the riskiest activity you ever engaged in?


A few, actually. Up until a few years ago, I owned a sport bike (motorcycle). Of course, I wore the proper gear, took a safety course and read a motorcycle safety book. Also, I have taken a few laps in a NASCAR [race car] around Daytona International Speedway at 180 mph. Most recently, trying to ride my daughter’s skateboard.

R&I: If the world has a modern hero, who is it and why?

The Dalai Lama. A world full of compassion, tolerance and patience and free of discrimination, racism and violence, while perhaps idealistic, sounds like a wonderful place to me.

R&I: What about this work do you find the most fulfilling or rewarding?

I really enjoy the company I work for and my role, because I get the opportunity to work with various functions. For example, while mostly finance, I get to interact with legal, human resources, employee health and safety, to name a few.

R&I: What do your friends and family think you do?

I asked my son. He said, “Risk management and insurance.” (He’s had the benefit of bring-your-kid-to-work day.)

Katie Dwyer is an associate editor at Risk & Insurance®. She can be reached at [email protected]