XML 193 R34.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Consistent with the system of governance set out in section 2 above, Prudential follows a ‘three lines’ model for managing technology-related risks, with a resiliency enhancement programme in progress to further strengthen our capabilities in managing disruptions or failures on system platforms serving our customers. Group Technology, the first line, is primarily responsible for risk identification, assessment, mitigation, monitoring and reporting. Group Technology Risk Management, the second line, provides advisory, assurance and oversight of the risk domains. A number of risk management tools are in place including: key risk indicators covering key technology risk areas; annual risk assessment to identify specific risks, priorities and focus areas; and deep-dive reviews on different technology domains to provide assurance of controls. In addition, the Group Technology Risk Committee is a sub-committee of the Group Executive Risk Committee, which oversees the effectiveness of technology risk management including information security and privacy across the Group. GwIA, the third line, provides independent assessment of control effectiveness and management awareness for both the first and second lines, with a comprehensive audit plan across all risk domains, including cyber security. Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer. Both the Chief Technology Risk Officer and Chief Technology Officer are experienced professionals, each with more than 20 years of experience in information technology and cyber security. Further, the Group Executive Committee (GEC) participates in annual cyber tabletop exercises and risk workshops to ensure members are well equipped to respond to a cyber or information security incident and fully understand the latest threats and regulatory expectations.

The Group formally launched the Global Integrated Command Centre in Kuala Lumpur, Malaysia in November 2024. This state-of-the art centre provides Group-wide monitoring, detection and incident management capabilities to enhance Prudential’s technology and cyber security resilience, and utilises AI-based tools to enhance detection of and response to infrastructure and application stability issues.

The Group has developed data minimisation and ‘privacy-by-design’ principles, where data should only be collected and used for its intended purpose and is not retained longer than necessary. The handling of sensitive data is governed by policies such as the Group Information Security Policy, the Group Privacy Policy, and the Group Data Governance Policy, each aligned to applicable laws and regulations. These policies, together with our third-party risk management practices, aim to ensure privacy and system availability are maintained for Prudential and its third-party service providers.

AI advancements are shaping the present and future of the insurance industry. Our goal is to remain at the forefront by providing services that are technologically advanced, ethically sound, and socially responsible. With our customers at the core of our operations, we apply our AI Ethics Principles in everything we do. These principles apply to both our own and third-party solutions, ensuring that every AI system and innovation is thoroughly evaluated via appropriate governance channels for ethical considerations and that associated risks are well managed. Employees are regularly reminded of the paramount importance of these AI ethics across all markets, while we engage in ongoing dialogues and cooperative initiatives with our regulators. Prudential’s AI governance and ethics principles are available at https://www.prudentialplc.com/en/site-services/ai-statement

We continue to observe a rise in malware and ransomware threats and the Group continues to maintain and, where appropriate, enhance defences to protect its systems from cyber security attacks. Prudential has adopted a holistic risk management approach, designed to prevent and disrupt attacks against the Group and to aid recovery, should an attack occur. Other defences include but are not limited to: distributed denial of services (DDoS) protection for Group websites, AI-based endpoint security software, continuous security monitoring, network-based intrusion detection, and employee training and awareness campaigns.

In addition, the Group recognises the evolving threat of AI-generated deepfakes and other sophisticated social engineering tactics targeting corporate activities. As part of our broader cyber resilience strategy, we are enhancing awareness efforts, strengthening detective controls, and bolstering incident response capabilities. While deepfake detection technologies are still maturing, we continue to monitor advancements and collaborate with industry partners to assess and integrate emerging solutions as they become enterprise-ready.

The Group tests the effectiveness of cyber security and privacy controls via a dedicated ‘red team’ to identify potential vulnerabilities, and engages and rotates external expert vendors to perform adversarial testing on our systems. In addition, we engage external consultants to assess and benchmark the maturity of Prudential’s cyber, information security and privacy controls.

A private ‘Bug Bounty’ programme invites external security practitioners to identify and report security issues and vulnerabilities, supported by a Vulnerability Disclosure Programme that allows independent security researchers to report security issues and vulnerabilities via the Prudential websites.

The Group has subscribed to services from independent security consultants to monitor our external security posture on an ongoing basis. Whilst the cyber threat landscape has continued to elevate due to ransomware and supply chain compromise events, the Group did not experience any cyber security and data breaches with a material impact on its business strategy, operations or financial condition in 2024.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Consistent with the system of governance set out in section 2 above, Prudential follows a ‘three lines’ model for managing technology-related risks, with a resiliency enhancement programme in progress to further strengthen our capabilities in managing disruptions or failures on system platforms serving our customers.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

Risks related to malicious attacks on Prudential systems or third-parties, service disruption, exfiltration of data, loss of data integrity and the impact on the privacy of our data remain prevalent, owing to the accessibility of attacking tools available to potential adversaries, and increasing advancement of technology such as generative AI. Regulatory expectations of cyber security and data protection controls are becoming increasingly complex as the Group continues to develop and expand digital services and products. Reliance on third-party service providers and business partners is also increasing. Further detail on the risks to the Group associated with operating in high-risk markets is included in sections 3.4 and 3.5 of the Risk factors.

Cybersecurity Risk Board of Directors Oversight [Text Block] Consistent with the system of governance set out in section 2 above
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer.
Cybersecurity Risk Role of Management [Text Block] Consistent with the system of governance set out in section 2 above, Prudential follows a ‘three lines’ model for managing technology-related risks, with a resiliency enhancement programme in progress to further strengthen our capabilities in managing disruptions or failures on system platforms serving our customers. Group Technology, the first line, is primarily responsible for risk identification, assessment, mitigation, monitoring and reporting. Group Technology Risk Management, the second line, provides advisory, assurance and oversight of the risk domains. A number of risk management tools are in place including: key risk indicators covering key technology risk areas; annual risk assessment to identify specific risks, priorities and focus areas; and deep-dive reviews on different technology domains to provide assurance of controls. In addition, the Group Technology Risk Committee is a sub-committee of the Group Executive Risk Committee, which oversees the effectiveness of technology risk management including information security and privacy across the Group. GwIA, the third line, provides independent assessment of control effectiveness and management awareness for both the first and second lines, with a comprehensive audit plan across all risk domains, including cyber security. Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer. Both the Chief Technology Risk Officer and Chief Technology Officer are experienced professionals, each with more than 20 years of experience in information technology and cyber security. Further, the Group Executive Committee (GEC) participates in annual cyber tabletop exercises and risk workshops to ensure members are well equipped to respond to a cyber or information security incident and fully understand the latest threats and regulatory expectations.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Group Technology, the first line, is primarily responsible for risk identification, assessment, mitigation, monitoring and reporting. Group Technology Risk Management, the second line, provides advisory, assurance and oversight of the risk domains. A number of risk management tools are in place including: key risk indicators covering key technology risk areas; annual risk assessment to identify specific risks, priorities and focus areas; and deep-dive reviews on different technology domains to provide assurance of controls. In addition, the Group Technology Risk Committee is a sub-committee of the Group Executive Risk Committee, which oversees the effectiveness of technology risk management including information security and privacy across the Group. GwIA, the third line, provides independent assessment of control effectiveness and management awareness for both the first and second lines, with a comprehensive audit plan across all risk domains, including cyber security. Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Both the Chief Technology Risk Officer and Chief Technology Officer are experienced professionals, each with more than 20 years of experience in information technology and cyber security. Further, the Group Executive Committee (GEC) participates in annual cyber tabletop exercises and risk workshops to ensure members are well equipped to respond to a cyber or information security incident and fully understand the latest threats and regulatory expectations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Cyber and privacy risks are reported regularly to the Risk Committee by the Chief Technology Risk Officer. In addition, the Risk Committee and Audit Committee receive more detailed briefings from the Chief Technology Officer.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true