Navigating Cyber Risk, Regulation and the Reality of Fines

On Aon — Episode 116

Title: Navigating Cyber Risk, Regulation and the Reality of Fines

In this Risk Capital Insight episode of the On Aon podcast, Pablo Constenla, head of coverage and claims for cyber and financial lines in EMEA for Aon, is joined by Charlie Weston-Simons, partner at A&O Shearman, to examine how leaders can stay ahead as cyber risk, regulation and financial exposure converge.

As artificial intelligence accelerates the scale and sophistication of attacks and regulators expand enforcement, the discussion focuses on what it takes to translate uncertainty into action — from quantifying cyber-related fines to understanding where insurance comes into play. Drawing on Aon’s Cyber Fines Report and frontline experience across incidents and investigations, the episode highlights how organizations can align legal, risk and insurance strategies to make more confident decisions and strengthen resilience at pace.

Key Takeaways:

1. AI is reshaping threat dynamics, requiring leaders to move beyond awareness and invest in quantification, scenario planning and faster response to stay ahead of evolving risks.
2. Anticipate regulatory impact and act before enforcement does. Globally regulators are increasing scrutiny and doubling down on fines and potential leadership accountability, elevating the need for cross-border risk strategies.
3. Cyber insurance plays an important role but is only one part of a broader resilience strategy, as organizations must prioritize preparation, response and a strong cyber risk culture to navigate increasingly complex exposures.

Experts in this episode: 

• Pablo Constenla, Head of Coverage and Claims for Cyber and Financial Lines, EMEA, Aon
• Charlie Weston-Simons, Partner, A&O Shearman

Key Resources:

The Insurability of Cyber Fines

Key Moments:

(01:40) How AI is reshaping cyber risk, from enhanced social engineering to the emergence of automated attacks and new vulnerabilities

(05:30) The growing complexity of regulation, including NIS2 implementation challenges and inconsistencies across jurisdictions

(12:10) Why cyber incidents are now viewed as existential crises and how organizations should rethink incident response and resilience

Soundbites:

Pablo Constenla:

“And the real challenge isn't just managing cyber risk, it's connecting the dots across legal, risk and insurance when a collective action is faced.”

Charlie Weston-Simons:

“I think from a legal and insurance perspective, the key issue becomes how do you manage a risk that is evolving faster than regulation and controls can adapt.”