Our approach to mapping cyber risk to the business by understanding the financial impact

1. LINKING THE
CISO to the CFO

2. what is your
RISK
TOLERANCE?

3. cyber as a
PERIL
cyber event
SCENARIOS
uses
REAL WORLD
Understanding the terms of
art
Tools to translate between
silos
Key categories of cyber
risk
Information theft
Property damage
Environmental damage
Computer systems damage
Understanding motivations
Risk transfer challenges
and optimization
Effective controls to
minimize the risk

4. how to measure
ANYTHING and
DO SOMETHING
about it

6. RISK
Sustain Capability
Invest in TransferInvest in Capability
CYBERSECURITY CAPABILITY
1. Early
capability
improvements
have high payoff
in risk reduction
2. Payoff flattens
as capability
increases
3. Insurance
transfers impact and
results in a quantum
risk reduction
4. Insurers want
insureds to be on
the flatter part of
the capability
curve
5. Invest accordingly
Risk Reduction Curve

12. CYBER RISK to
FINANCIAL IMPACTS
mapping

13. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages
LOSSES
due to
CYBER EVENTS

14. SPECTRUM
cyber loss

15. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages
RESPONSE COSTS
LEGAL EXPENSES
REVENUE LOSS
RESTORING LOST DATA
CYBER EXTORTION
STOLEN INTELLECTUAL
PROPERTY

16. 3rd Party Damages
(to others)
1st Party Damages
(to your organization)
Financial
Damages
Tangible
(Physical)
Damages
REVENUE LOSS
RESTORATION EXPENSE
LEGAL EXPENSES
CREDIT MONITORING
COSTS

17. Financial
Damages
Tangible (Physical)
Damages
1st Party Damages
(to your organization)
3rd Party Damages
(to others)
MECHANICAL BREAKDOWN
PROPERTY DAMAGE
ENVIRONMENTAL CLEANUP
REVENUE LOSS
BODILY INJURY

18. Financial
Damages
Tangible (Physical)
Damages
1st Party Damages
(to your organization)
3rd Party Damages
(to others)
MECHANICAL BREAKDOWN
PROPERTY DAMAGE
ENVIRONMENTAL CLEANUP
BODILY INJURY

19. EMERGES
a new metric

20. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages
$
$
$

21. RISK RESPONSE

22. ACCEPT 1
TRANSFER
4
MITIGATE
3
TOLERATE
2

23. 1990 2000 2010
EVENTS
COVERAGES
Ingram Micro
v. American
Guarantee & Liability
CA SB 1386 Breach
Notification
45 Other
Notification
Laws
STUXNET NotPetya
More robust electronic
data exclusions
P&C carriers strengthen
exclusions, e.g. CL380
P&C carriers rethinking
coverage due
to NotPetya
Cyber coverages
begin to appear.
Network Business Interruption
Information Asset Protection
Privacy Breach
Liability Coverage
Breach Regulatory
Event Expense
• Introduction of Cyber DIC and P&C Options
• Broadening of traditional cyber policies
• Introduction of cyber cover into property
policies

24. FRAMEWORK
cyber impact

25. CYBER INSURANCE
POLICIES
1st Party Damages 3rd Party Damages
Financial
Damages
Non-Physical
Cyber
Forensics, Data
Restoration, PR,
Extortion, & Legal
Expenses
Excludes Property
Damage & Bodily
Injury
Critical for
Protecting Data &
Exposure

26. Non-Physical
Cyber
Critical for
Protecting Data &
Exposure
PROPERTY
POLICIES?
CASUALTY
POLICIES?
Tangible
(Physical)
Damages
CYBER INSURANCE
POLICIES
1st Party Damages 3rd Party Damages
Financial
Damages
Emerging Issue in
Established
Market
Market in Flux –
Exclusions Being
Added to
Traditional Covers

27. Emerging Issue in
Established
Market
Market in Flux –
Exclusions Being
Added to
Traditional Covers
PROPERTY
POLICIES?
CASUALTY
POLICIES?
Tangible
(Physical)
Damages
CYBER INSURANCE
POLICIES
1st Party Damages 3rd Party Damages
Financial
Damages

28. Expanding
policies into
tangible
damages
Newer Property
PoliciesTangible
(Physical)
Damages
1st Party Damages 3rd Party Damages
Financial
Damages
Property policies are
increasingly providing coverage
for data, even when there is no
real property damage
Some cyber insurers – who may
not even write commercial
Property or Casualty insurance –
are extending their cover to
tangible damage

29. BALANCE SHEET
re-evaluate your

30. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages $
$
$

31. CYBER INSURANCE
examining

32. MYTH
REALITY
VS
Cyber insurance policies
contain stringent
requirements relating to
security posture.
Cyber insurance policies
don’t cover
ransomware.
Cyber insurance policies
don’t cover employee
actions or errors.
If yours has such
requirements, you
may have purchased
the wrong policy.
There are multiple
types of policies
available to cover
ransomware losses and
payments.
Employee sabotage
and insider events
are readily insurable.
Cyber insurance policies
only cover notification
costs and credit
monitoring.
Cyber Insurance policies
don’t pay.
Buying insurance is an
admission of failure.
…what have we covered
today?
Stories about claim
denials may have been
misrepresentations or
sensationalized.
Would you rather have
to beg your CFO for
incident response
money?

33. WE’VE COVERED
applying what

35. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages
RESPONSE COSTS
LEGAL EXPENSES
RESTORING LOST
DATA
REVENUE LOSS
REVENUE LOSS
MECHANICAL
BREAKDOWN
PROPERTY
DAMAGE

37. 1st Party Damages
(to your organization)
3rd Party Damages
(to others)
Financial
Damages
Tangible
(Physical)
Damages
RESPONSE COSTS
LEGAL EXPENSES
RESTORING LOST
DATA
REVENUE LOSS
RESTORATION
EXPENSE
LEGAL
EXPENSES
CREDIT
MONITORING
COSTS

38. UNLOCKED!

39. DISCLAIMER
Axio is a registered trademark of Axio Global, Inc.
NO WARRANTY: THIS AXIO GLOBAL MATERIAL IS FURNISHED ON
AN “AS-IS” BASIS. AXIO GLOBAL MAKES NO WARRANTIES OF ANY
KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER
INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS
OBTAINED FROM USE OF THE MATERIAL. AXIO GLOBAL DOES NOT
MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM
FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
Internal use: Permission to reproduce this material and to
prepare derivative works from this material for use inside your
organization is granted, provided the copyright and “No
Warranty” statements are included with all reproductions and
derivative works.
External use: This material may be reproduced in its entirety,
without modification, and freely distributed in written or
electronic form without requesting formal permission.
Permission is required for any other external and/or commercial
use. Requests for such permission should be directed
to info@axio.com.
© Axio Global, Inc. All rights reserved.
American International Group, Inc. (AIG) is a leading international insurance organization serving
customers in more than 130 countries and jurisdictions. AIG companies serve commercial, institutional,
and individual customers through one of the most extensive worldwide property-casualty networks of
any insurer. In addition, AIG companies are leading providers of life insurance and retirement services
in the United States. AIG common stock is listed on the New York Stock Exchange and the Tokyo Stock
Exchange.
Additional information about AIG can be found at www.aig.com | YouTube: www.youtube.com/aig |
Twitter: @AIGInsurance | LinkedIn: http://www.linkedin.com/company/aig
AIG is the marketing name for the worldwide property-casualty, life and retirement, and general
insurance operations of American International Group, Inc. For additional information, please visit our
website at www.aig.com. All products and services are written or provided by subsidiaries or affiliates
of American International Group, Inc. Products or services may not be available in all countries, and
coverage is subject to actual policy language. Non-insurance products and services may be provided by
independent third parties. Certain property-casualty coverages may be provided by a surplus lines
insurer. Surplus lines insurers do not generally participate in state guaranty funds, and insureds are
therefore not protected by such funds.
The data contained in this presentation are for general informational purposes only. The advice of a
professional insurance broker and counsel should always be obtained before purchasing any insurance
product or service. The information contained herein has been compiled from sources believed to be
reliable. No warranty, guarantee, or representation, either expressed or implied, is made as to the
correctness or sufficiency of any representation contained herein.
© American International Group, Inc. All rights reserved.

40. THANK YOU