AXA XL and Deloitte expand cyber risk prevention services worldwide

AXA XL is no longer treating cyber as a policy alone. Its new partnership with Deloitte folds cybersecurity and operational technology services into the AXA Digital Commercial Platform, pushing the carrier deeper into prevention, advisory work and day-to-day operational support.

The package gives clients access to critical asset identification, vulnerability assessments, cyber crisis simulations and continuous threat monitoring worldwide. AXA XL said the services sit alongside its existing cyber insurance and risk consulting capabilities, which is the important part of this story: the company is building a service stack around the policy, not just selling transfer of risk after the fact.

The timing matters. AXA XL created a dedicated prevention-focused business unit on May 13, 2026 and called it its fifth business unit. Libby Benet, then AXA XL’s Global Chief Underwriting Officer, was named to lead it, and the company said the unit would combine advanced data, analytics and technology with risk engineering and advisory expertise. That is a clear signal that prevention is becoming a line of business, not a side service.

The scale behind that shift is already real. AXA XL says its risk consulting organization includes about 400 consultants across 26 countries and 24 languages. That footprint gives the insurer a platform for more than claims response, especially as cyber buyers want help identifying their critical assets, testing their response plans and spotting threats before they become losses.

The economics are driving the push. Rébiah Bardot-Girard, AXA XL’s head of cyber risk consulting services, pointed to a global cybercrime cost estimate of $10.5 trillion in 2025. That figure traces back to Cybersecurity Ventures’ forecast, which projected cybercrime costs would rise 15% a year from $3 trillion in 2015 to $10.5 trillion annually by 2025. In that environment, insurers cannot make prevention meaningful unless assessment tools, insured-facing services, underwriting data and continuous monitoring are tightly connected.

Deloitte Cyber managing partner Imade Elbaraka said prevention, early detection and swift remediation are becoming increasingly important to resilience, alongside cyber insurance coverage. AXA XL has been saying much the same thing in its own messaging, describing cyber risk as a C-suite concern and arguing that cyber insurance should go beyond the policy to help build enterprise resilience. A separate AXA XL and Thales report in 2026 made the same point, saying cyber resilience requires governance, strategic foresight and proactive risk management.

For commercial P&C, that is the bigger story. Cyber prevention is starting to look like a software layer embedded in insurance distribution and service delivery, with underwriting, consulting and monitoring converging into one workflow. AXA XL’s latest move suggests carriers may need that integration if they want prevention to matter economically, not just rhetorically.