AIG vs Marsh: How Do They Compare for Cyber Insurance?

AIG markets three distinct cyber forms: CyberEdge, CyberEdge Plus and CyberEdge PC. AIG says coverage may be bought as a standalone CyberEdge policy or endorsed onto selected Financial Lines, Property and Casualty policies; the forms are not interchangeable descriptions of one coverage grant. ³Company-reported. AIG’s U.S. CyberEdge page; endorsement availability is stated only for selected policies. AIG’s legal footer says policies are written by subsidiaries or affiliates and coverage depends on underwriting and policy language.

Marsh's cyber risk practice places and advises on cyber insurance brokerage; it does not underwrite the policies it places. ⁸Company-reported. Marsh corporate cyber insurance product page.

Marsh McLennan Agency (MMA), Marsh's middle-market subsidiary, places cyber coverage and acts as a carrier liaison, combining placement with claims advocacy. ¹¹Company-reported. MMA cyber solutions page.

Confirm in your quote.

The reviewed pages do not name a specific cyber insurer for a standard placement. Marsh's Cyber ECHO excess facility lets clients choose underwriting from Lloyd's of London syndicates, company markets or Bermuda-based insurers, so the carrier varies by placement. ⁹Not publicly disclosed. Cyber ECHO facility page, which covers excess layers rather than every primary policy Marsh places.

AIG describes cyber coverage and risk services for organizations and clients. The reviewed product page does not publish a complete eligible-industry, revenue or security-control appetite; a particular applicant’s eligibility remains subject to underwriting. ³Company-reported. Audience stated by AIG on its U.S. CyberEdge marketing page; no application eligibility schedule was reviewed.

MMA says any company can benefit from cyber coverage, but prioritizes organizations that store significant customer data, run large customer databases or hold valuable digital assets. ¹¹Company-reported. MMA cyber solutions FAQ; MMA describes its own client base as middle-market organizations generally.

AIG describes CyberEdge as addressing breach-related financial costs such as response, data restoration, network interruption and cyber extortion. CyberEdge Plus is described for physical-world losses caused by a cyber event, including business interruption, property damage and physical injury; CyberEdge PC is described as excess of traditional property and casualty policies on a difference-in-conditions/difference-in-limits basis. The page says actual coverage depends on the facts and policy terms, conditions and exclusions. ³Company-reported. Product summaries on AIG’s U.S. page, preserving differences among the three forms. Examples are not a promise that any loss or expense is covered under an issued policy.

MMA lists incident investigation and response costs, network interruption/extra expense, extortion and ransomware payments, data restoration, and security and privacy liability as core cyber coverages, with media liability, privacy regulatory defense and reputation-based income loss available as additional coverages. ¹¹Company-reported. MMA cyber solutions page; actual policy wording and insurer vary by placement.

The reviewed page does not state standard cyber limits, retentions or sublimits. Confirm each amount and applicable form in the quote and issued policy. ³Not publicly disclosed. AIG’s U.S. CyberEdge marketing page reviewed 2026-09-30; no buyer-specific quote, application outcome or policy wording was reviewed.

Marsh says its Cyber ECHO excess facility can provide over $200 million of cyber capacity per client, with a free first reinstatement and a paid second reinstatement for separate cyber events within a policy year. ⁹Company-reported. Cyber ECHO facility page; describes excess capacity Marsh can arrange, not a standard primary limit.

AIG describes cyber risk assessment, threat intelligence, alerts about known vulnerabilities, and a Cyber Resiliency Program. The page says these services help clients assess and improve cyber resilience; it does not promise that they prevent a breach or are available on identical terms with every form. ³Company-reported. Company-described cyber risk services on AIG’s U.S. CyberEdge page; product and account applicability should be confirmed in the quote.

Confirm in your quote.

AIG links a U.S. Cyber underwriting application and invites brokers to contact its national product and distribution teams. The page does not say that submitting an application results in a quote, acceptance or binding. ³Company-reported. Application and broker contact links on AIG’s U.S. CyberEdge page; no completed application or binding workflow was reviewed.

You engage a named Marsh or MMA cyber specialist to design a placement; the reviewed pages describe advisor-led placement and risk analytics rather than an online self-serve quote. ^8,11Company-reported. Marsh and MMA cyber pages, which list dedicated cyber brokerage and placement leaders.

AIG says its cyber insureds can use a 24/7 claims hotline and that its claims team works with specialized legal and forensic firms on incident response. AIG’s example also describes assistance with regulatory disclosures and notifications. These service statements do not guarantee claim acceptance, payment or a particular response time. ³Company-reported. Company-reported services and example on AIG’s CyberEdge page; policy terms and the circumstances of a loss control any claim.

Marsh's global claims and incident-management specialists review cyber claims, support litigation management and work with forensic accountants to prepare proof of loss, advocating with insurers on the client's behalf. ¹⁰Company-reported. Claims Advocacy expertise page; recovery outcomes described as company-reported and not independently verified.