{
 "slug": "marsh-vs-aon-top-insurance-brokers-evaluate-emerging",
 "topic_id": "TOPIC-067",
 "cluster": "Cyber Insurance & Risk Transfer",
 "tier": "Tier B",
 "title": "What brokers can actually negotiate on impersonation risk",
 "summary": "A broker's leverage comes from what they can show an underwriter. On deepfake-enabled fraud there is little to show, which is why sub-limits have not moved.",
 "lede": "The coverage gap for executive impersonation is well understood on both sides of the table. What is missing is the thing a broker needs to argue with: a demonstrable difference between this client and the next one.",
 "date": "2024-09-06",
 "category": "Comparison",
 "author_id": "constance-ibe-whitmore",
 "tags": [
  "insurance brokers",
  "negotiation",
  "sub-limits",
  "deepfake",
  "coverage",
  "cyber market"
 ],
 "image_title": "Broker Leverage Impersonation Risk",
 "schema": "Article",
 "key_takeaways": [
  "Broker leverage requires a differentiator the underwriter can price. On impersonation risk, most clients look identical.",
  "Standard social engineering wordings turn on whether the insured was induced to transfer voluntarily, which impersonation claims usually are.",
  "A control that produces evidence per transaction is the first thing in this category that can be shown rather than described."
 ],
 "body": [
  {
   "type": "h2",
   "text": "How a broker creates leverage"
  },
  {
   "type": "diagram",
   "kind": "compare",
   "alt": "Every other risk area has a differentiator; this one does not",
   "caption": "The empty right column is why the sub-limit is sticky.",
   "nodes": [],
   "left": {
    "title": "Ransomware, breach, BI",
    "items": [
     "Backup testing evidence",
     "EDR coverage figures",
     "Tested failover",
     "Measured recovery time"
    ]
   },
   "right": {
    "title": "Executive impersonation",
    "items": [
     "Training completion rate",
     "A policy document",
     "—",
     "—"
    ]
   }
  },
  {
   "type": "p",
   "html": "Through differentiation. A broker's argument is that this client's risk is better than the class, evidenced by something the underwriter can price."
  },
  {
   "type": "table",
   "head": [
    "Risk area",
    "Available differentiator"
   ],
   "rows": [
    [
     "Ransomware",
     "Backup testing evidence, EDR coverage, segmentation, recovery time"
    ],
    [
     "Data breach",
     "Encryption coverage, data minimisation, breach response retainer"
    ],
    [
     "Business interruption",
     "Redundancy architecture, tested failover, dependency mapping"
    ],
    [
     "Executive impersonation",
     "<strong style=\"font-weight:600\">Training completion rates and a policy document</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The last row is why sub-limits in this category are sticky. There is nothing to bring to the negotiation that the next client does not also have."
  },
  {
   "type": "h2",
   "text": "Why the wording is unhelpful"
  },
  {
   "type": "p",
   "html": "Social engineering fraud coverage typically responds where an insured was induced by a fraudulent communication to transfer funds voluntarily."
  },
  {
   "type": "p",
   "html": "That is precisely what an impersonation attack produces. The employee was induced, they did transfer voluntarily, and the transfer was authorised through normal channels. The claim falls into the sub-limited bucket rather than the main computer fraud cover."
  },
  {
   "type": "p",
   "html": "This is not an insurer being difficult. It is the wording working as drafted, for a loss type that behaves exactly as the sub-limit anticipated."
  },
  {
   "type": "h2",
   "text": "What would move an underwriter"
  },
  {
   "type": "p",
   "html": "Underwriters price what they can verify at claim time. Three things they can verify, in increasing order of value."
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Scope.</strong> Which payments are subject to the control, defined by threshold and by trigger event rather than by policy language.",
    "<strong style=\"font-weight:600\">Coverage rate.</strong> What proportion of in-scope payments actually carried the control over the last twelve months.",
    "<strong style=\"font-weight:600\">Exception shape.</strong> Where the control was not applied, and what the exception path looks like."
   ]
  },
  {
   "type": "p",
   "html": "The third is counter-intuitively the most persuasive. A broker presenting a measured exception rate with a documented reason is presenting a client that understands its own operations — which is rarer than a client presenting a clean yes."
  },
  {
   "type": "h2",
   "text": "The negotiation, in order"
  },
  {
   "type": "table",
   "head": [
    "Ask",
    "Realistic?"
   ],
   "rows": [
    [
     "Raise the social engineering sub-limit",
     "Possible with evidence, on a specific defined scope"
    ],
    [
     "Reduce the deductible on impersonation losses",
     "Sometimes easier than moving the sub-limit"
    ],
    [
     "Remove the sub-limit entirely",
     "Unlikely in the current market"
    ],
    [
     "Affirmative wording for synthetic media impersonation",
     "Increasingly available; worth asking"
    ],
    [
     "Premium credit for the control",
     "Possible, usually small; the coverage terms matter more"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Brokers generally report that deductible and scope movement comes before sub-limit movement. That is a useful sequencing insight for a client deciding what to ask for."
  },
  {
   "type": "h2",
   "text": "The honest state of play"
  },
  {
   "type": "p",
   "html": "There is no established actuarial basis yet for pricing this differently. Insurers do not have loss experience separating organisations with per-transaction evidence from those without, because very few organisations have it."
  },
  {
   "type": "p",
   "html": "So the argument today is structural rather than statistical: this control removes the mechanism by which the loss occurs, and that should be worth something. Some underwriters find that persuasive; others reasonably want data first."
  },
  {
   "type": "p",
   "html": "A broker should present it as what it is. Overstating the market's readiness damages credibility on a claim that is otherwise sound."
  },
  {
   "type": "h2",
   "text": "What a client should prepare"
  },
  {
   "type": "ol",
   "items": [
    "A written definition of which payments are in scope for the control, by threshold and trigger.",
    "Twelve months of measured coverage, with exceptions categorised.",
    "A sample receipt, with an explanation of what a claims adjuster could verify from it.",
    "A statement of what the organisation will commit to maintaining, since that is what a warranty would be drafted against."
   ]
  },
  {
   "type": "p",
   "html": "Item four matters. If a term is granted, it will come with a condition, and the client should have decided in advance what they can actually sustain."
  },
  {
   "type": "h2",
   "text": "What would actually move an underwriter"
  },
  {
   "type": "table",
   "caption": "Three things an underwriter can verify at claim time",
   "head": [
    "Evidence",
    "Why it prices"
   ],
   "rows": [
    [
     "Scope",
     "Which payments carry the control, by threshold and trigger — not by policy language"
    ],
    [
     "Coverage rate",
     "What proportion of in-scope payments actually carried it over twelve months"
    ],
    [
     "<strong style=\"font-weight:600\">Exception shape</strong>",
     "<strong style=\"font-weight:600\">Where it was not applied, and why</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The third is counter-intuitively the most persuasive. A measured exception rate with documented reasons presents a client that understands its own operations, which is rarer than a client presenting a clean yes."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The wording is being unfair.”</strong> It is not. Social engineering cover responds where the insured was induced to transfer voluntarily, which is exactly what an impersonation attack produces. The claim falls into the sub-limited bucket because it behaves as the sub-limit anticipated."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“This control is actuarially proven.”</strong> It is not, and saying so damages credibility. Insurers have no loss experience separating organisations with per-transaction evidence from those without, because very few have it. The argument today is structural, and should be presented that way."
  },
  {
   "type": "p",
   "html": "Brokers generally report that deductible and scope movement comes before sub-limit movement, and that affirmative wording for synthetic media impersonation is increasingly available. That is a useful sequencing insight for a client deciding what to ask for."
  }
 ],
 "faq": [
  {
   "q": "Why are social engineering sub-limits so sticky?",
   "a": "Because clients cannot differentiate themselves. Training completion rates and a policy document are what everyone brings, so there is nothing to price."
  },
  {
   "q": "Why does the wording put impersonation in the sub-limit?",
   "a": "Cover typically responds where the insured was induced to transfer voluntarily, which is exactly what an impersonation attack produces."
  },
  {
   "q": "What moves first in a negotiation?",
   "a": "Brokers generally report deductible and scope movement before sub-limit movement. Affirmative synthetic media wording is increasingly available."
  },
  {
   "q": "Is there actuarial support for pricing this control?",
   "a": "Not yet. Insurers lack loss experience separating organisations with per-transaction evidence from those without. The argument today is structural."
  },
  {
   "q": "Is there actuarial support for this control?",
   "a": "Not yet. Insurers lack loss experience separating evidenced from attested controls. The argument is structural, and overstating it damages the case."
  }
 ],
 "sources": [
  {
   "t": "NAIC — cyber insurance market report",
   "u": "https://content.naic.org/cipr-topics/cyber-risk"
  },
  {
   "t": "Published broker market commentary on cyber coverage terms."
  },
  {
   "t": "FBI IC3 2025 Internet Crime Report",
   "u": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
  },
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  }
 ],
 "related": [
  {
   "slug": "social-engineering-sub-limit-trap-10m-cyber",
   "title": "The social engineering sub-limit",
   "category": "Vertical"
  },
  {
   "slug": "cyber-insurance-actuarial-crisis-deepfake-warranties",
   "title": "Underwriting on questionnaire answers",
   "category": "Definitional"
  },
  {
   "slug": "funds-transfer-fraud-ftf-endorsement-prove-compliance",
   "title": "Proving out-of-band verification",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Broker%20Leverage%20Impersonation%20Risk/1200_630/blog.jpg",
 "wordcount": 925,
 "url": "/blog/marsh-vs-aon-top-insurance-brokers-evaluate-emerging.html",
 "reading_time": "4 min read",
 "hub": {
  "slug": "topics/cyber-insurance",
  "title": "Cyber insurance and risk transfer"
 },
 "answer": "Very little today, because there is nothing to show. Brokers such as Marsh and Aon create leverage through differentiators an underwriter can price. On impersonation risk every client brings the same two things — training completion rates and a policy document — which is why sub-limits have not moved.",
 "answer_q": "What can a broker actually negotiate on deepfake impersonation risk?",
 "entities": [
  {
   "name": "Marsh",
   "type": "Organization",
   "url": "https://www.marsh.com/",
   "primary": true
  },
  {
   "name": "Aon",
   "type": "Organization",
   "url": "https://www.aon.com/"
  }
 ],
 "glossary": [
  {
   "term": "Sub-limit",
   "def": "A cap applying to one coverage inside a policy, frequently far below the headline limit. Social engineering is typically among the lowest."
  },
  {
   "term": "Affirmative wording",
   "def": "Language explicitly confirming a peril is covered, as opposed to relying on silence."
  },
  {
   "term": "Condition precedent",
   "def": "A requirement that must be satisfied for cover to respond. Failing to demonstrate it can defeat a claim independent of the loss."
  }
 ],
 "checklist": {
  "title": "What a client should bring to renewal",
  "id": "renewal",
  "desc": "Four items, and the fourth is the one clients forget.",
  "steps": [
   {
    "name": "A written scope definition.",
    "text": "Which payments are in scope, by threshold and trigger."
   },
   {
    "name": "Twelve months of measured coverage.",
    "text": "With exceptions categorised by reason."
   },
   {
    "name": "A sample receipt and what an adjuster could verify from it.",
    "text": "Make it concrete."
   },
   {
    "name": "What you will commit to maintaining.",
    "text": "If a term is granted it comes with a condition. Decide in advance what you can sustain."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav produces the artefact a broker currently lacks: a per-transaction receipt an adjuster can verify without contacting the insured, and a measurable coverage rate across a defined scope.",
  "href": "../docs.html",
  "label": "See the evidence a claim needs"
 }
}