CyberMatics SM FAQs General Questions What is CyberMatics? Like telematics for auto insurance, CyberMatics is a technology-driven process to help clients understand their current cyber risk as seen by AIG. CyberMatics connects to existing vendor technology within an insured s environment to regularly pull verified answers to the questions answered when filling out AIG s cyber insurance application. This process helps provide our clients continual feedback on their cyber risk posture and greater confidence in underwriting information, which may ultimately allow for better tailored terms and conditions in their AIG cyber insurance policies. AIG s Cyber Risk Consultants can help clients act on CyberMatics risk scoring and prioritized practices and evaluate data for system vulnerabilities and negative risk trends. How does CyberMatics work? AIG connects to the existing vendor technology within the client s environment, via API, on a weekly basis for an updated pull of answers to the cyber application questions. The connection only occurs when the weekly update is required and no client data beyond a yes/no answer to the question is seen by AIG. Once the updated data pull is complete, AIG s cyber underwriting model evaluates the client s cyber security maturity against 10 common attack patterns across 11 commonly used technology devices. The model incorporates critical security data, such as current threat intelligence from multiple sources; effectiveness of an organization s cyber controls; the potential impact of a cyber breach on the organization; and insights gained from the thousands of cyber claims handled by AIG. The client can then view their cyber security maturity scores, prioritized practices, and other information via the CyberMatics client portal. What is the benefit of CyberMatics for clients? Companies have been asking for a way to benchmark their cyber maturity against known cyber risks to quantify what they are up against and where they stand relative to their peers. CyberMatics can help do that. All AIG cyber insurance applicants are assigned risk scores based upon their application question responses. Clients using CyberMatics will receive more accurate scores, as their answers are verified through CyberMatics technology. Likewise, risks can be better underwritten and priced accordingly. Using the cyber maturity scores provided, CISOs can better understand their organization s threat profile and resilience, by both attack type and asset class, and further use AIG s cyber underwriting model output to map how different controls affect each risk scenario to adjust their organization s overall security maturity. 1
CyberMatics will provide prioritized recommendations to improve scores and our Cyber Risk Consultants can help clients act on these recommendations and evaluate the data for system vulnerabilities and negative trends. Clients can see the impact of changes made to their environment through modifications in risk scoring throughout the policy period and do not have to wait until policy renewal time. Clients can also use the forecasting feature to determine the effect on their risk score of making various planned changes that were recommended without having to implement them first. Doing so will provide a mock adjusted risk score and may help CISOs justify security project expenses. As the threat environment changes and as the client implements changes, recommendations will reorder, new ones will be added, and others will drop in priority thus reflecting the ever changing cyber environment. Why is there a subscription fee charged for CyberMatics? AIG s standard underwriting and application processes provides clients with a powerful set of reports that allow the client to determine what AIG thought about their cyber risk at the time of binding. CyberMatics takes this a step further. With CyberMatics, companies will now get weekly updates to their risk scoring and recommendations which are over and above the normal underwriting process. In addition, CyberMatics clients get the benefit of working with Cyber Risk Consultants throughout the policy period to provide advice, recommendations, and help clients evaluate alternatives. Fees charged for CyberMatics allow for the costs of providing these added benefits and services beyond the underwritten coverage. Can information provided through CyberMatics be discoverable if I suffer a cyber incident? CyberMatics is only updating answers to questions in AIG s cyber underwriting application to regularly assess your cyber risk and exposure. No additional information or data is collected or used. CyberMatics is patent-pending. What does that mean? AIG submitted a provisional patent for the CyberMatics concept and process in late 2017. The final patent submission should take place in late 2018 after the first release of CyberMatics to our clients. AIG felt CyberMatics was a unique concept and intellectual property that had value and deserved to receive protection. AIG has made a considerable investment in time, money, and priority to develop this concept for the market and for our clients. Where is the CyberMatics client portal available today? CyberMatics is available globally, however, the CyberMatics client portal is only available in the U.S. for the initial release. We intend to provide multi-regional support of the CyberMatics client portal in future releases. Can CyberMatics information be accessed from a mobile device? There is no unique mobile app for CyberMatics. However, a CyberMatics client can access its dashboard and risk model output from Safari or other mobile browsers. 2
How often should a client log in to CyberMatics? A client s dynamic dashboard will be updated at least weekly with the vendor technology connection and monthly based on any changes by AIG to the cyber model threat data. Clients may wish to log in at least monthly to view any changes to their maturity score and see any recommendations by AIG for improving that score. Vendor Technologies and Data Pull What vendors does AIG currently connect to for CyberMatics? AIG currently works with CrowdStrike and Darktrace and is considering additional security technology vendors. If there are specific technology companies you would like us to consider please share with us at cyberriskconsulting@aig.com. What CrowdStrike products work best with CyberMatics? At a minimum, a client wishing to participate in CyberMatics should consider the Falcon Discover product deployed on a high percentage of end points within the client network. Additional products such as Falcon Prevent, Falcon Insight, Falcon Overwatch, and Falcon Intelligence increase the number of inputs CrowdStrike can update within the AIG cyber model. What DarkTrace products work best with CyberMatics? At a minimum, a client wishing to participate in CyberMatics should consider the Enterprise Immune System installed with probes providing coverage for all network segments. Having additionally activated the DarkTrace analysis service and Antigena products increases the number of inputs DarkTrace can update within the AIG cyber model. How often does AIG connect to a client s network? AIG s API connects to the vendor security technology in a client s environment once per week. The connection is not persistent and only connects when it is time to pull the most recent risk model data. The Data Last Updated field in the upper right of the dynamic dashboard reflects the last successful connection to the vendor technology. Exactly what data does AIG collect on a weekly basis? AIG does not collect any client systems data, system logs, IP addresses, or any other client-specific data as part of the CyberMatics connection. AIG simply inquires with the vendor technology what the current answers are to the questions in the cyber application that the vendor technology is able to answer. For example, if the technology detects that anti-virus is installed on all endpoints it will return a yes to that control question in the application. Will my CyberMatics vendor technology connection keep all questions in the AIG cyber application updated? Unfortunately, no. Each vendor technology is only able to answer a certain percentage of the control questions within the application and will keep those updated. This is also further restricted by what types of vendor technology are implemented and coverage of that technology within the client s environment. AIG will continue to establish further relationships with multiple vendor technologies over time to allow for multiple connections. The more connections a client is able to utilize with CyberMatics, the more questions will be answered. 3
What if I answered yes on the application but the technology connection returns an answer of no? AIG will only change an answer from no to yes based on the weekly connection update to a client s environment. If an answer comes back no, to a question previously answered yes, it will be noted and an AIG Cyber Risk Consultant may reach out to determine accuracy. Can I add other vendor technology connections for CyberMatics at any time during our policy period? The short answer is yes. Anytime during the policy period, if AIG adds other security vendors, or if a client installs additional technologies that AIG already has agreements with, and it wishes to add those additional connections to its CyberMatics subscriptions, the client can contact AIG Cyber Risk Consulting to process the three-way Non-Disclosure Agreement (NDA) for the new vendor technology. An AIG Cyber Risk Consultant will work with the client to process the NDA, ensure the connection is made and verify the new data connection is working properly. Dynamic Dashboard Features What is the dynamic dashboard? The information provided in the dynamic dashboard represents the same data provided to a client in the Summary Assessment Report (SAR) and Executive Summary Report (ESR) during the underwriting process. The reports, however, represent a snapshot in time based on the completed cyber application. Alternatively, the dynamic dashboard is updated weekly throughout the policy period with updates to the client s cyber maturity score, recommendations and other data, and displays the trending cyber model output. How can I request support from AIG Cyber Risk Consulting? For any CyberMatics support needs, questions about the dynamic dashboard, or just general consulting help based on the data ouput in the dynamic dashboard, clients can click on the Contact Risk Consultant link on the right side of the dashboard toolbar. Please complete the request form with appropriate contact information and details around the support needed and an AIG Cyber Risk Consultant will respond. Can I download previous versions of my SAR and ESR? Yes. A client can click on the download link on the right side of the dynamic dashboard toolbar and select the desired report to download. How does AIG define my peer universe? AIG considers factors such as the primary industry, annual revenue, and region for a client. Those clients that participate in CyberMatics with a like categorization become part of the peer universe and feed the peer comparisons in the cyber maturity scoring. If there are less than ten clients in any peer universe, AIG will not display the peer data within the dynamic dashboard. 4
What are the top risk scenarios? AIG s cyber underwriting model assesses a client against a current set of common cyber threat scenarios. Based on risk model output and cyber control effectiveness, AIG is able to determine what cyber threat scenarios are more likely to impact an organization. The top risk scenarios presented provide a priority list of the most likely threat impact scenarios a client should be concerned about. Implementation of prioritized practices can help reduce the risk likelihood of these scenarios. Forecasting What is the forecasting feature within the CyberMatics portal? The forecasting feature allows clients to see how their risk and cyber maturity scores would change based on changes in control effectiveness. In other words, it provides the ability to ask, How would implementing a prioritized practice change my score? Clients using this feature can better determine which controls would provide the most return in cyber maturity resulting in a better score and better premium. How do I start a forecast? Click on the New Forecast button in the upper right area of the dynamic dashboard. You will be asked whether you wish to forecast a single prioritized practice or all of the top five prioritized practices. Selecting the single option offers more flexibility in which practices are forecasted. Once the question is selected and the controls selected, a new dashboard will be displayed with the resulting scores. How do I view the original dynamic dashboard after selecting a forecast? Simply click on the dynamic dashboard link in the upper left screen area. Each new forecast will be displayed as a tab in the upper left that will allow a user to toggle back and forth between different views. Can I save a forecast? Yes. Once a forecast is done in a way that you wish to preserve it, simply click the save button in the upper right. If the forecast is not desired to retain, simply click the delete button. Can I perform nested forecasts? Yes. For example, if you forecasted one control change and would like to see the effects of a second control implementation based on the first, you simply click the new forecast button and follow the same steps. The resulting second forecast will display changes based on the forecasted improvements to the scores showing in the first forecast. You can nest up to three iterations from the original dynamic dashboard. Can I download a forecast? Click the PDF button in the upper right to download a formatted report of the current forecast for printing or saving. 5
How do I access a previously saved forecast? Click the drop down menu in the upper right area of your dynamic dashboard and select the saved name of the previous forecast from the list. The previously saved forecast will then open as a new tab in the dashboard. Prioritized Practices What are prioritized practices? One of the benefits of AIG s cyber underwriting model is the ability to compare implicit cyber risk to a client s current cyber security program or existing cyber controls. The model output allows for AIG to identify controls that could further mitigate existing risk and improve a client s cyber maturity score. The prioritized practices table lists, in recommended order, those controls that can most improve a client s cyber maturity score. These controls are listed and tied back to the relevant questions in the AIG cyber application for the client s benefit. A client can see more than the top 5 listed by clicking the in the upper right corner of the prioritized practices frame. Can I receive consulting help with the prioritized practices? Yes! Simply click the Contact Risk Consultant link in the upper right corner on the dynamic dashboard toolboard and complete the help request form asking for consultation assistance with the priorized practices. How long does it take for an implemented control to be reflected in my dashboard? If the control a client implements can be detected and updated by the existing vendor technology connection, the changes should be reflected in the next weekly data pull after the implementation is complete. Not all controls can be updated via the CyberMatics connection and may require AIG Cyber Risk Consultant s assistance to verify and update manually on behalf of the client. User Administration How many users can access the CyberMatics portal? Each client subscription is provided with one administration user ID and four general user IDs, for a total of five. How does AIG grant user access? AIG Cyber Risk Consulting will facilitate the creation of the client administration user ID for the designated client contact during the CyberMatics onboarding process. Once the administration ID is created, the client will be able to create and grant access to four general user IDs for others in their organization. 6
Can the client Admin ID delete or reassign previously created general user IDs? Yes. If the client wishes to change general access from one person to another, they can simply access the administration section of the portal for removing old access and granting new access. Old access will have to be removed first if the client has already used their maximum number of IDs. What if we want more then four general user IDs? Currently AIG provides a maximum of five user IDs to access the CyberMatics portal: one admin and four general access. Additional fees may be required to provision additional user IDs for a client CyberMatics subscription. Cyber Maturity and other Risk Model Scores How did AIG identify the top risk scenarios and vulnerable points of access used to score in the model? AIG has been providing cyber risk insurance for nearly two decades and over this period has developed deep expertise and data on managing cyber risk, which when properly structured can provide valuable insights to our clients including peer benchmarking and guidance on the most effective risk reducing controls. During this time, we, along with the industry, have identified common vulnerabiliites in corporate IT environments and common threat scenarios that account for most corporate security breaches. Common threat scenarios range from web application attacks, point of sale intrusion, insider and privilege misuse, to physical theft and loss, crimeware and cyber espionage. We developed our underwriting model based on established historical insights and patterns of how companies experience cyber breaches the points of entry and the types of attacks and vulnerabilities seen in the vast majority of cyber breach scenarios. How is my cyber maturity score determined? AIG s cyber underwriting model evaluates a client s cyber security program against a set of current general cyber threats and vulnerabilities that account for nearly 90 percent of all known corporate security breaches and against potential impact of those threat scenarios to a client s organization. This generates the implicit risk score. AIG then evaluates a client s existing security controls and how those minimize the implicit risk. This generates the control effectiveness score and residual risk scores. A client s implicit risk score and residual risk scores are then compared to produce the overall cyber maturity score. The lower the score reflected the better the client is doing in protecting their organization against the current threat environment. 7
What is the implicit risk score? The implicit risk score is the combination of the current threat environment and impact of those threats to the insured organization without considering the benefit of any existing cybersecurity controls. To develop a client s threat risk score, AIG s cyber model evaluates a client s cyber security system profile against the general cyber threat environment globally, common vulnerabilities in corporate IT environments, and common threat scenarios that account for nearly 90 percent of all known corporate security breaches. Common threat scenarios range from web application attacks, point of sale intrusion, insider and privilege misuse, to physical theft and loss, crimeware and cyber espionage. You can see the underlying threat and business impact scores that make up implicit risk by clicking the in the upper right corner of the implicit risk frame. What is the control effectiveness score? The control effectiveness score measures the client s current risk mitigating capabilities based on the control questions answered in AIG s cyber application and updated with the CyberMatics vendor connection. Certain risk reduction capabilities may not be aligned with the company s current risk profile, resulting in lower cyber maturity. What is the residual risk score? The residual risk score provides the same measure as the implicit risk score but with the benefit of control effectiveness added to the calculation. The difference in the implicit and residual risk scores are then used to determine the cyber maturity score. What is the recommended range in my cyber maturity score trend graph? The recommended range shows the current range of the peer universe. A client is able to see where they reside within that range and determine visually if they are at the low or high end of the range with their cyber maturity score when compared to their peers. What causes more scores to change? Scores within the AIG cyber model are affected by either changes to control questions when the weekly vendor technology connection occurs or by monthly changes in the cyber threat environment. Control question changes are affected by changes within the client s environment. Cyber threat environment changes are affected through consistent review of ongoing claims and security intelligence sources that result in updates to the threat data in the cyber model. Will I be penalized if my cyber maturity score gets worse? Scores may go up or down over the policy period. Answers to underwriting questions are one driver of the score; the changing threat environment is another driver. Scores during the policy period are intended to be informative. During the renewal of the policy the underwriter will take risk scoring into account just as they would from the actual underwriting application. 8
Notifications What are CyberMatics notifications? The CyberMatics portal provides notification to different events that a client may want to review within the dynamic dashboard, such as a change to the peer universe or threat model data. Notifications can be viewed by clicking the bell icon in the upper right corner. A complete listing of all notifications provided can be viewed by clicking the at the bottom of the list. Can I customize which notifications I receive and how? Yes. By clicking the bell icon in the upper right corner of the dynamic dashboard and then clicking the at the bottom of the list, the client will be directed to the notifications view of the portal. By then clicking on the settings tab, the client can select which notifications are received in the portal only, by email, or by text notification. Priority of certain notifications can also be changed. For any other questions, please email us at cyberriskconsulting@aig.com. AIG may modify (by adding, removing or replacing a tool or service) or discontinue the Services at any time. AIG may partner with third party vendors to provide any or all Services. In some instances, AIG may have a referral fee structure in place, or an ownership interest, with certain third party vendors. American International Group, Inc. (AIG) is a leading global insurance organization. Founded in 1919, today AIG member companies provide a wide range of property casualty insurance, life insurance, retirement products, and other financial services to customers in more than 80 countries and jurisdictions. These diverse offerings include products and services that help businesses and individuals protect their assets, manage risks and provide for retirement security. AIG common stock is listed on the New York Stock Exchange and the Tokyo Stock Exchange. Additional information about AIG can be found at www.aig.com YouTube: www.youtube.com/aig Twitter: @AIGinsurance www.twitter.com/aiginsurance LinkedIn: www. linkedin.com/company/aig. These references with additional information about AIG have been provided as a convenience, and the information contained on such websites is not incorporated by reference into this material. AIG is the marketing name for the worldwide property-casualty, life and retirement, and general insurance operations of American International Group, Inc. For additional information, please visit our website at www.aig.com. All products and services are written or provided by subsidiaries or affiliates of American International Group, Inc. Products or services may not be available in all countries and jurisdictions, and coverage is subject to actual policy language. Non-insurance products and services may be provided by independent third parties. Certain property-casualty coverages may be provided by a surplus lines insurer. Surplus lines insurers do not generally participate in state guaranty funds, and insureds are therefore not protected by such funds. American International Group, Inc. All rights reserved. 0618 9