Account research example

Aviva plc

Researched 12 November 2026 from public sources, as an example of how I’d prepare before contacting a large UK enterprise. Independent work: I’m not affiliated with Aviva or CrowdStrike, and nothing here describes the state of Aviva’s security.

Fact stated in a linked public source
Hypothesis my guess, to test in discovery
Illustrative an example of how I’d approach it

1Company overview

Fact FTSE 100 insurance, wealth and retirement group [8] operating in the UK, Ireland and Canada. [7]
Fact Operating profit up 24% to £1.3bn in the first half of 2026. [3] Regulated by the PRA and the FCA. [7]
Fact In its 2025 regulatory report, Aviva names IT and cyber security risk first among its operational risks, and says it continues to monitor the threat environment and enhance its IT infrastructure. [9]

2Public business signals

New Group CIO

Fact A new Group Chief Information Officer joined the Group Executive Committee in July 2026, replacing a retiring CIO. [1] [2]

Direct Line integration

Fact Aviva completed its acquisition of Direct Line on 1 July 2025. [4] Around 8,000 Direct Line employees have since transferred to Aviva. [5]

New reporting rules

Fact New FCA and PRA rules on reporting operational incidents and material third parties come into force on 18 March 2027. [6]

3Possible security priorities

Hypothesis One standard across two estates. Merging companies usually means a period of two sets of devices, identities and processes. With IT and cyber security named as a key operational risk, consolidating them is likely to matter.
Hypothesis Faster, clearer incident response. Being able to spot, understand and explain an incident quickly will matter more once the new reporting rules apply.
Hypothesis A window for review. New technology leaders often review priorities and suppliers in their first year.

Still unknown: which security tools Aviva uses and when contracts renew, whether security operations run in-house or through a partner, and how far the Direct Line technology has already been merged.

4Stakeholder personas

CISO or deputy

Risk reported to the board and regulators, programme priorities, budget.

Head of Security Operations

Alert volume, time to detect and respond, team capacity.

Identity and access lead

Joiners, movers and leavers across two companies, privileged access.

Integration technology lead

Timelines, merging systems without disrupting customers.

Typical patterns only. Roles vary by organisation, and I’d confirm names and responsibilities on LinkedIn before reaching out.

5Relevant CrowdStrike capabilities

Illustrative Areas I’d want to understand before a first call. They’re worth raising only if discovery confirms the need. This isn’t a claim that Aviva needs or lacks any of them.

Falcon Insight XDR [10]: Endpoint detection and response, relevant if two estates are still being brought under one standard.
Falcon Identity Protection [11]: Relevant if identities from two companies are being merged.
Falcon Next-Gen SIEM [12]: Relevant if incident investigation and reporting speed is a priority before March 2027.
Falcon Complete Next-Gen MDR [13]: Relevant if the security operations team is stretched by integration work.

6Discovery questions

Now that the Direct Line teams have moved across, are you running one security setup or still two?
When something looks wrong at 2am, how long does it take your team to know whether it matters?
How are you preparing for the new incident reporting rules next March?
Who else would need to be involved if this became a priority?

7Example outreach

Illustrative

Subject: One team, two estates?

Hi [first name],

Congratulations on the progress with the Direct Line integration. Bringing around 8,000 people across is a big job.

When two businesses combine, security teams often run two sets of tools and processes for a while. I’d be interested to hear how you’re approaching that, especially with the new incident reporting rules arriving in March.

Would a 20-minute conversation in the next few weeks be useful? If the timing isn’t right, just let me know.

Plamen

How I’d qualify

A good sign: they confirm the two estates are still being merged, or that incident reporting is on the agenda. A reason to step back: security has already been consolidated on a long contract. Then I’d note the renewal date and return closer to it.

What I wouldn’t do

Claim they have a security problem, name a product in the first message, or contact anyone whose role I hadn’t confirmed.