Estimated reading time: 6 minutes
AXA XL announced Thursday it will acquire the remaining shares of S-RM. The specialty insurer already held roughly 49% of the London-based consultancy. AXA XL did not disclose financial terms. The deal needs regulatory approvals and should close by the end of September 2026.
S-RM opened its doors in 2005 and now serves clients in more than 140 countries. It operates nine international offices across six continents. Its work spans cyber risk assessment, managed detection and incident response, specialist investigations, geopolitical intelligence, and reputational due diligence. The firm has worked alongside AXA XL for more than 15 years, first as a client and later as an investee.
S-RM investigates cyber incidents. AXA XL underwrites them. Both now sit inside one company.
CINI Glossary: DFIR stands for digital forensics and incident response. It is the work of finding out how attackers got in, what they touched, what they took, and how to get the business running again. DFIR teams are the people who show up after the alarm goes off. Their findings shape the claim, the regulatory filing, and often the litigation that follows.
Why A Carrier Buys A Response Firm Now
The commercial logic is not complicated. Cyber rates have softened. Capacity is plentiful. Competing on price alone is a losing game, and carriers know it.
That leaves two levers. Sell services the competition cannot match. Underwrite off data the competition does not have.
S-RM offers both. Its consultants sit inside real breaches at real companies, week after week. The intelligence that it produces does not come from a survey panel. It comes from live engagements with logs, ransom negotiations, and recovery timelines attached.
Scott Gunter, CEO of AXA XL, framed it in client terms.
“The acquisition of S-RM marks an important step in the buildout of AXA XL Risk Advisory and in our continued efforts to go beyond traditional insurance coverage,” Gunter said. “Clients are looking for data-driven insights and expert guidance to help them anticipate emerging threats, mitigate risk, and respond quickly when events occur. S-RM’s specialist expertise will help us accelerate that support.”
Data-driven insights. That phrase is doing real work, and it points at the part of the deal that matters most to underwriters.
The Prevention Unit Now Has A Name
CINI reported in May 2026 that AXA XL had created a fifth business unit dedicated to prevention. Libby Benet, then Global Chief Underwriting Officer, was named to lead it.
Thursday’s release gives that unit a name, AXA XL Risk Advisory. It also gives Benet a CEO title. Neither change was announced separately.
“S-RM brings highly complementary expertise that will strengthen our advisory capabilities and broaden our offering,” said Benet, CEO of AXA XL Risk Advisory. “By bringing together our risk consulting teams, S-RM’s geopolitical intelligence and crisis response expertise, and the technology-enabled solutions of the AXA Digital Commercial Platform, we will be able to help clients build deeper resilience across a wider spectrum of risks.”
S-RM will continue serving its global client base from inside that unit.
What The Data Looks Like
S-RM publishes an annual view of its own casework. The 2026 Cyber Incident Insights Report draws on more than 800 incidents its teams handled during 2025.
The firm responded to attacks involving 67 distinct ransomware groups, up from 58 the previous year. More than 60% of those incidents involved US-based companies. Single-factor remote access remained the leading entry vector, a finding that has stayed stubbornly consistent across the industry for years.
Set that beside AXA XL’s own claims research. The carrier’s 2025 large claims study found that 88% of global cyber losses came from claims above one million dollars. Ransomware drove more than 60% of those large losses.
One dataset describes how attacks happen. The other describes what they cost. Owning both is worth more than owning either.
Fifteen Years, Then A Purchase
Heyrick Bond Gunning, CEO of S-RM, pointed to the length of the relationship.
“S-RM has worked closely with AXA XL for over 15 years, both as a client and as an investor,” Bond Gunning said. “This transaction will allow us to continue investing in our prevention services for existing clients, while expanding the reach of those capabilities.”
S-RM has built partnerships beyond AXA XL. It entered a collaboration agreement with Andersen Consulting in December 2025. It holds arrangements with RingStone, Ethixbase360 and TrendAI.
Seen Our Podcast?
The IRS lost in Texas. Micro-captives got easier to use. But AI exclusions are widening the coverage gap faster than any financing tool can close it. Dustin Carlson makes his case on the podcast.
The Market Keeps Moving This Way
Carriers absorbing security capability is now the defining structural trend in cyber.
Coalition acquired Wirespeed to fold managed detection and response into its policy. Allianz Commercial handed Coalition its standalone commercial cyber book under a 10-year agreement. LevelBlue bought Cybereason after acquiring Stroz Friedberg and Trustwave.
AXA XL had been building the same shape through partnerships. It worked with Fenix24 on cybersecurity assessments for North American policyholders. It teamed with KnowBe4 on human risk training, and it built a dark web intelligence capability to flag exposed credentials. Lastly, it also launched communications training for CISOs and boards facing an incident.
Every one of those was rented. S-RM is owned.
That difference matters for anyone modeling where this market goes. Partnerships scale cheaply and unwind easily. Ownership costs more, locks in capability, and puts the service margin on your own books.
What This Cybersecurity Acquisition Means For Brokers And Buyers
Cyber is heading toward the same place as property and liability. Nearly every business will carry it, because nearly every business now runs on digital infrastructure it does not fully control.
Carriers that can price that exposure accurately will take share. Carriers that can also reduce it will keep the accounts they win. AXA XL has decided it wants both functions in-house.
For brokers, the pitch at renewal is no longer only limits and retention. It is what your client gets before the incident and who shows up during it. For risk managers, it is worth knowing which of your carrier’s services are owned and which are contracted, because the two behave differently under pressure.
FAQ: AXA XL And S-RM Acquisition
AXA XL agreed to acquire the remaining shares of S-RM. It already held approximately 49%. The announcement came on August 6, 2026.
Completion is subject to customary closing conditions, including regulatory approvals. AXA XL expects it by the end of September 2026.
AXA XL did not disclose financial terms.
S-RM provides corporate intelligence and cyber security services. Its work includes cyber risk assessment, managed detection and incident response, specialist investigations, geopolitical intelligence, and reputational due diligence. It was founded in 2005 and operates nine offices across six continents.
S-RM will continue serving its global client base as part of AXA XL Risk Advisory. Libby Benet leads that unit as CEO.
It is AXA XL’s business unit dedicated to prevention. CINI reported its creation in May 2026, when it was described as the carrier’s fifth business unit alongside Americas, APAC and Europe, UK and Lloyd’s, and Reinsurance.
Two reasons. Prevention services differentiate a policy in a softening market. And incident response work generates loss data that improves underwriting and pricing.
Related Cyber insurance Posts
- Hackers Silenced The Water Alarms. Insurers Are Being Asked To Fix It.
- AI Agents Went Outside Permissions Again. This Time The Targets Were Real People.
- Tackling AI-Driven Cybercrime Threats: AXA XL’s New Insurance Coverage Explained(Opens in a new browser tab)
- Axa XL Steps up to Cyber Insurance Challenge with New Cyber Insurance Endorsement(Opens in a new browser tab)