The head of SME cyber insurance at AXA XL discusses how the pandemic changed everything for small businesses, why education remains the biggest challenge, and what the future holds for cyber coverage.
Michelle Aliperti has spent nearly three decades in underwriting, but her latest role might be her most challenging yet. As AXA XL’s recently-appointed head of SME (small-to-medium-sized enterprises) cyber insurance, she’s tasked with expanding coverage to a market that is at once the most vulnerable to cyber threats and the least prepared to handle them.
During a panel discussion titled “Cyber Shield: Navigating the Future of Cyber Insurance” at the InsureTech Insights conference, Aliperti joined industry leaders Steven Schwartz from Safe Security, James Tuplin from Mosaic Insurance, and Adam Gladsden from Marsh to discuss the evolving cyber insurance landscape.
We caught up with Aliperti after her session to dive deeper into her views on where the SME cyber insurance market stands today and where it’s headed.
The Insurance Lead: The pandemic served as a major wake-up call for SMEs regarding cyber risk. What specifically changed during that period?
Michelle Aliperti: Before the pandemic, SME’s. especially those with smaller risks, didn’t think they had exposure. They thought, “That’s going to happen to a big company—nobody’s interested in my data.” The pandemic made them realize that anybody can be a target.
When it happens to small companies, it often doesn’t make the news because they don’t have the big name. Sometimes, they may not even report incidents to their insurer, or they don’t have coverage in the first place. What we saw was that it wasn’t concentrated in any one industry — it wasn’t like the Change Healthcare incident. It was just small risks that did not have great controls, and suddenly had someone in their system.
There’s a lot more social engineering and business email compromise claims that impact those smaller risks, much more than larger risks.
You mentioned that SMEs are recognizing they need coverage post-pandemic. How has their approach to buying cyber insurance evolved?
Michelle Aliperti: We’re seeing much more interest in buying coverage and stronger controls in that space. There’s just much more awareness, and that’s going to continue.
But how people want to buy cyber continues to evolve. It’s going beyond the traditional broker model. Is it through big tech? Is it through some other vendor? I think that will continue to change.
From AXA XL’s standpoint, we have not historically been in small accounts. They brought me in specifically to grow that space because they recognize there’s less volatility than there is in the large account space.
What are the primary questions clients have about cyber risk right now, and what’s the level of realization about their exposure?
Michelle Aliperti: There is greater realization, but I still think there needs to be more education in that space. Brokers need to be educated as well—they don’t really understand what their clients’ exposure could be.
A client may not have business interruption exposure, but they may be holding private data that they have to protect. I don’t think small businesses think about regulation as much as a large-risk businesses do. I think it’s just being aware that anyone who’s using a network and has remote employees — it can be as simple as somebody losing a laptop on a train — that can open them up to a claim.
You’ve emphasized the need for industry-wide education. How is that being addressed?
Michelle Aliperti: It’s largely at the individual level at this point. We talked on the panel about the lack of standardization across the industry for cyber, and I think that applies to education as well. Carriers are more aware now than they were in the past that they need to provide these value-added services to their customers and their brokers. So it’s gotten better, but as an industry, we still need to do some work there.
How has the insurtech sector influenced traditional carriers like AXA XL?
Michelle Aliperti: From a service standpoint, they really brought technology to the forefront. Having been at AXA XL now and CNA previously, traditional insurance carriers were not focused on “How do we make the buying process easier? How do we do scans into networks to figure out how to help these clients?”
Insurtechs have done a great job of bringing those controls to the forefront and enabling carriers to help their policyholders improve those controls.
It’s hard to say whether they’ll all still be here in a few years. Some have gotten to a point where they’re too big to fail.
But any market that does not have a very big cyber book and is putting out large limits has the potential to fail. You could have one big event with a couple of limited losses, and whether they’re an insurtech or a traditional carrier, that could put them out of the market.
Looking ahead three to five years, what do you see as the biggest changes coming to cyber insurance?
Michelle Aliperti: It will continue to evolve in terms of what the threat vectors are. The awareness will improve, the controls will improve, but it seems like every six months there’s a new cyber exposure that we’re trying to figure out how to cover. That’s not going to go away. That’s just the nature of providing cyber coverage.
As carriers, we can continue to educate when we see these new evolving exposures, so our clients are aware of them.
How do you see AI impacting the cyber insurance space, particularly for SMEs?
Michelle Aliperti: AI has a lot of positive implications that will help carriers. It’s not going to take away underwriters’ jobs. That’s always the concern. It’s a relationship business. We still need underwriters. But it’ll make underwriters more efficient.
We have submissions that we can’t even get to because we don’t have enough bandwidth. How can AI help us scrub those submissions for data and decide which is a good risk and which is a bad risk? I think we will continue to see that develop, and I think it’s going to happen quickly over the next few years.
You’ve talked about the importance of building relationships before claims occur. Can you elaborate on that approach?
Michelle Aliperti: If there is a claim, you don’t want that to be your first interaction with your carrier. There’s a much better relationship if you’ve been engaging with them over the years, whether it’s just talking about controls or improving controls. It makes the claim process much less traumatic for a policyholder. You don’t want your first interaction to be on the worst day of their business life.
Coming out of COVID, we saw that a lot of small and middle market risks couldn’t even get coverage because they didn’t have the controls, and that forced them to take a strong look internally and figure out what they needed to do to improve or close those gaps. Carriers need to continue to provide that feedback to their brokers and applicants. They can’t just say, “I’m declining this risk because I don’t like your controls.”
We need to explain what we don’t like about the current controls, what they can do better, and how we, as a carrier, can help them. Most carriers are offering risk mitigation services where they will help to plug those gaps.
Do you see cyber insurance policies becoming more modular in the future?
Michelle Aliperti: The way policies are structured, it can be done. It’s not being done now—everybody buys the full suite of coverages. But I think there are definitely benefits, especially from a pricing standpoint. Why are you paying for business interruption if you don’t really have a business interruption exposure?
As buying patterns for cyber change, how they purchase will also change. There’ll be more of a “let me check off what I want from the grocery list or the menu” approach. Instead of checking everything, clients will just buy what they think they need and what they feel like their main exposures are.
What keeps you up at night when thinking about the SME cyber insurance market?
Michelle Aliperti: The challenge is that we can’t expect companies of all sizes to be able to keep pace with rapidly evolving threats. Small businesses struggle to keep their security postures where they are right now, let alone improve them as new threats emerge.
As risk advisors and carriers, we need to do a really good job of embedding ourselves closer to the businesses to help advise them optimally in that continuously evolving environment. That’s something we all need to come to grips with very quickly, especially as AI accelerates both defensive capabilities and offensive threats.
