A cyber incident response panel is supposed to work the same way no matter which insurer a client buys from. That assumption gets harder to hold once one of the vendors on those panels belongs to a single carrier.
AXA XL announced that it has agreed to acquire the remaining shares of S-RM, a corporate intelligence and cyber security consultancy in which it already holds a stake of approximately 49%.
AXA XL and S-RM have worked together for more than 15 years, first as client and vendor and more recently as investor and investee firm.
S-RM was founded in 2005 and now serves clients in 140 countries. Its work spans cyber risk assessment, managed detection and incident response, specialist investigations, geopolitical intelligence, and integrity and reputational due diligence, services that brokers and their clients have historically been able to call on regardless of which insurer sits on the policy.
Cyber incident response panels exist so that policyholders get vetted, consistent investigators regardless of which carrier they buy from.
In practice, that consistency depends on vendors serving multiple insurers simultaneously. Palo Alto Networks, for instance, describes its own incident response arm, Unit 42, as a preferred provider on more than 70 insurance panels.
AXA XL's move raises a question neither source addresses directly. Whether S-RM keeps that kind of cross-carrier role once it sits fully inside one insurer, or whether rival carriers start treating a competitor-owned vendor differently on their own panels, is left open by today's announcement, and it's a change a broker would want to track before recommending S-RM as part of a multi-carrier program.
Heyrick Bond Gunning, CEO of S-RM, said his firm "has worked closely with AXA XL for over 15 years, both as a client and as an investor."
He said the deal would let S-RM continue to invest in its prevention services for existing clients, and it would also grow the reach of those capabilities.
Once the transaction closes, S-RM will operate as part of AXA XL Risk Advisory, a business unit AXA XL set up recently for prevention, an area of the market that brokers and independent consultancies have traditionally staffed themselves.
That unit traces back to May 2026, when AXA XL created it as the company's fifth business unit, alongside Americas, APAC & Europe, UK & Lloyd's, and Reinsurance.
The launch drew on AXA's 2025 Future Risks Report, in which 86% of experts surveyed said the most concerning risks facing businesses could be at least partly avoided through preventive measures rather than addressed only after losses occur. The unit combines data, analytics, and technology with AXA XL's existing risk engineering and advisory work, the same category of service brokers often bill on their own as risk consulting.
Read more: AXA XL launches dedicated prevention unit
One of the appointments behind that buildout came in June 2026, when Libby Benet stepped into the newly created role of CEO of AXA XL Risk Advisory, after serving as the company's global chief underwriting officer since 2022, with Jeanmarie Giordano succeeding her in that prior role.
Benet's move brought risk consulting, loss prevention, and advisory capabilities together under one structure, ahead of S-RM's addition to the same unit. Benet said the combination of that unit's own risk consulting teams, S-RM's geopolitical intelligence and crisis response work, and the AXA Digital Commercial Platform's technology tools would let the company "help clients build deeper resilience across a wider spectrum of risks."
One of the clearest past attempts at owning a corporate investigations firm outright came from a broker, not a carrier, and it did not last.
Marsh & McLennan bought Kroll in 2004 for close to $1.9 billion and combined it with its own risk consulting practice under a unit called Marsh Kroll. Marsh sold Kroll six years later, in 2010, for $1.13 billion, saying at the time that it wanted to focus on its core insurance brokerage business rather than run an investigations firm.
AXA XL's deal for S-RM runs a similar play from the other side of the table, a carrier buying the kind of specialist firm a broker once owned and gave up.
Scott Gunter, CEO of AXA XL, said the purchase represents "an important step in the buildout of AXA XL Risk Advisory."
He said the company continues "efforts to go beyond traditional insurance coverage," and clients want data-driven insights and expert guidance so they can anticipate threats, reduce risk, and respond when incidents occur.
A joint report AXA XL published with Thales in April 2026 described cyber incidents as increasingly systemic, with disruption spreading across interconnected systems and supply chains rather than staying contained to a single victim.
The report put the global average cost of a data breach at $4.44 million in 2025, tied to faster attack cycles and greater third-party exposure, the kind of trend that gives a carrier commercial reason to own investigative capacity rather than rent it.
Data published in May 2026 puts a sharper number on that trend inside the US market specifically. The average cost of a US data breach reached $10.22 million in 2025, up 9% from the year before and more than double the global figure, according to IBM Security data cited in that coverage.
Ransomware was present in 44% of confirmed breaches overall, and it affected 88% of small and midsize business breaches, the segment where brokers place the bulk of standalone cyber policies.
The transaction still needs to clear customary closing conditions, including regulatory approvals, and both companies expect it to close by the end of September 2026.
It sits inside a wider wave of consolidation moving through the cyber insurance market this year. Zurich Insurance Group's £8.1 billion ($11 billion) agreement to acquire cyber specialist Beazley cleared European Commission review in July 2026, and an analyst at RSM UK described that merger as among the most significant consolidations in specialty insurance in more than a decade, one that could push other carriers toward similar deals even though it combines two underwriters rather than a carrier and an investigations firm.
