v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity Risk Management and Strategy
Aegon employs a comprehensive, multi-layered security strategy
(defense-in-depth)
that integrates preventative, detective, and corrective controls designed to protect critical systems, and data that flows through these systems, against cyber threats like ransomware, DDoS and data breaches. Key measures include data protection (e.g. DLP), identity and access management (e.g. MFA and privileged access management), network and endpoint security (e.g. segmentation and firewalls), application and cloud safeguards, backup and disaster recovery practices, ongoing employee security training and the Global SOC real-time monitoring and response.
Our Cybersecurity risk practices are risk-based and aim to manage risks and be responsive to evolving cyberthreats based on learnings from industry security events, threat intelligence and developments. Cybersecurity risk management is an integral part of our IT Risk Management Framework. IT and Cyber risk management is integrated into our Enterprise Risk Management (ERM) program and shares common methodologies, policies, standards, and governance processes.
Key elements of our cybersecurity risk management include, but are not limited to the following:
 
●
   IT Risk Taxonomy, Risk Appetite & Tolerances: Technology and cybersecurity risks are part of Aegon’s risk universe and are aggregated and reported as part of Aegon’s IT Risk profile. Global IT Risk and Cybersecurity Tolerances are established and underpinned by metrics to serve as input into risk measurement and reporting.
●
   Policies & Standards: Global policies and standards (e.g., Global Information Security policy, Global IT Risk Management policy), which set out minimum requirements designed to help ensure controls are implemented and cybersecurity risk is adequately managed.
●
   IT Control Framework (ITCF): Aegon has developed the ITCF as the library of Aegon’s global IT controls, based on industry standards, designed to govern, manage, strategize, protect, develop, and operate Aegon’s information assets.
●
   IT Risk Management Lifecycle: The IT and cybersecurity risk management lifecycle involves identifying, assessing, controlling, monitoring, and reporting risks. These processes and procedures are incorporated across the first and second lines of defense, integrating with existing Enterprise Risk Management (ERM) frameworks, IT management areas, and related capabilities.
●
   Training and Awareness: Tone at the top along with periodic management/employee training and awareness, to promote positive risk culture across both the IT organization, and its users, aligned with existing risk culture initiatives.
 
 
 
 
 
●
   Third-Party Risk Management (TPRM): Aegon has established a TPRM Policy in order to set minimum requirements for managing risks associated with third parties and to ensure that the targeted Third Party risk is mitigated and maintained within the set tolerance. Cybersecurity risks associated with the use of third-party service providers are is scope of this Policy, as well as integral part of Aegon’s Information Security monitoring processes.
●
   Engagement of third parties: Aegon uses external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls.
Cybersecurity Incidents
Aegon maintains a Global Incident Response plan (as part of the Global Information Security Incident Response Framework), which is a collection of documented processes, technical playbooks, and resources needed in order to respond to potential cybersecurity incidents.
As previously disclosed, during 2025, two of our third parties in the US experienced data breaches resulting from cybersecurity incidents, such as a social engineering attack. In 2025, we have not identified any risks arising from known cybersecurity threats including those related to prior incidents that have materially affected or are reasonably likely to materially affect our organization, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity risks and threats continuously evolve and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See
Risk Factors
for additional detail.
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Aegon Risk Committee (Committee) oversight of cybersecurity and other IT risks, including oversight of management’s implementation of our cybersecurity risk management program. The Committee reports directly to the Board regarding its activities, including those related to cybersecurity, and focuses on the effectiveness of the design, operation and appropriateness of the enterprise risk management framework and the internal control systems of Aegon. The full Board also annually receives briefings from Management on our cyber risk management program. Board members receive presentations on cybersecurity topics from Global Chief Information Security Officer (Global CISO) and internal security staff as part of the Board’s continuing education on topics that impact public companies.
The Committee receives regular reports from Aegon’s Chief Risk Officer covering all known material cybersecurity risks of the Company including but not limited to operational risk, technology and information security risks. In addition, management updates the Committee, as necessary, regarding significant or potentially significant cybersecurity incidents.
The Committee receives periodic updates from our Global Chief Information Security Officer. These include, but are not limited to: progress updates on cybersecurity strategy and execution against the Aegon strategic roadmap, a review of cybersecurity metrics, updates on the evolving threat landscape, and a review of our control environment.
Our management team, including our Global Chief Technology Officer (Global CTO), Global CISO, Directors of various Security Services (e.g., Identity, Cloud, Data, SOC) along with Business Unit Security Officers (BISOs), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Management team supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Management team includes broad range of executive, strategic, and technical experiences across diverse number of technology and cybersecurity domains. Aegon’s Global CTO brings more than 30 years of experience leading largescale technology organizations in the financial services sector, with a demonstrated record of strengthening operational resilience, improving security and risk controls, and delivering customer centric digital capabilities across global business operations. Aegon’s Global CISO is a seasoned executive with extensive leadership experience in information security, technology strategy, and risk management. Prior to joining Aegon, he held senior positions at various large organizations and has over 30 years of experience in leading information security programs, including as the CISO for Fortune 500 financial and healthcare companies. He also holds several industry-leading certifications related to various areas of information system risk and security.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Our Cybersecurity risk practices are risk-based and aim to manage risks and be responsive to evolving cyberthreats based on learnings from industry security events, threat intelligence and developments. Cybersecurity risk management is an integral part of our IT Risk Management Framework. IT and Cyber risk management is integrated into our Enterprise Risk Management (ERM) program and shares common methodologies, policies, standards, and governance processes.
Key elements of our cybersecurity risk management include, but are not limited to the following:
 
●
   IT Risk Taxonomy, Risk Appetite & Tolerances: Technology and cybersecurity risks are part of Aegon’s risk universe and are aggregated and reported as part of Aegon’s IT Risk profile. Global IT Risk and Cybersecurity Tolerances are established and underpinned by metrics to serve as input into risk measurement and reporting.
●
   Policies & Standards: Global policies and standards (e.g., Global Information Security policy, Global IT Risk Management policy), which set out minimum requirements designed to help ensure controls are implemented and cybersecurity risk is adequately managed.
●
   IT Control Framework (ITCF): Aegon has developed the ITCF as the library of Aegon’s global IT controls, based on industry standards, designed to govern, manage, strategize, protect, develop, and operate Aegon’s information assets.
●
   IT Risk Management Lifecycle: The IT and cybersecurity risk management lifecycle involves identifying, assessing, controlling, monitoring, and reporting risks. These processes and procedures are incorporated across the first and second lines of defense, integrating with existing Enterprise Risk Management (ERM) frameworks, IT management areas, and related capabilities.
●
   Training and Awareness: Tone at the top along with periodic management/employee training and awareness, to promote positive risk culture across both the IT organization, and its users, aligned with existing risk culture initiatives.
 
 
 
 
 
●
   Third-Party Risk Management (TPRM): Aegon has established a TPRM Policy in order to set minimum requirements for managing risks associated with third parties and to ensure that the targeted Third Party risk is mitigated and maintained within the set tolerance. Cybersecurity risks associated with the use of third-party service providers are is scope of this Policy, as well as integral part of Aegon’s Information Security monitoring processes.
●
   Engagement of third parties: Aegon uses external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls.
Cybersecurity Risk Management Third Party Engaged [Flag] false
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] In 2025, we have not identified any risks arising from known cybersecurity threats including those related to prior incidents that have materially affected or are reasonably likely to materially affect our organization, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity risks and threats continuously evolve and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See
Risk Factors
for additional detail.
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Aegon Risk Committee (Committee) oversight of cybersecurity and other IT risks, including oversight of management’s implementation of our cybersecurity risk management program. The Committee reports directly to the Board regarding its activities, including those related to cybersecurity, and focuses on the effectiveness of the design, operation and appropriateness of the enterprise risk management framework and the internal control systems of Aegon. The full Board also annually receives briefings from Management on our cyber risk management program. Board members receive presentations on cybersecurity topics from Global Chief Information Security Officer (Global CISO) and internal security staff as part of the Board’s continuing education on topics that impact public companies.
The Committee receives regular reports from Aegon’s Chief Risk Officer covering all known material cybersecurity risks of the Company including but not limited to operational risk, technology and information security risks. In addition, management updates the Committee, as necessary, regarding significant or potentially significant cybersecurity incidents.
The Committee receives periodic updates from our Global Chief Information Security Officer. These include, but are not limited to: progress updates on cybersecurity strategy and execution against the Aegon strategic roadmap, a review of cybersecurity metrics, updates on the evolving threat landscape, and a review of our control environment.
Our management team, including our Global Chief Technology Officer (Global CTO), Global CISO, Directors of various Security Services (e.g., Identity, Cloud, Data, SOC) along with Business Unit Security Officers (BISOs), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Management team supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Management team includes broad range of executive, strategic, and technical experiences across diverse number of technology and cybersecurity domains. Aegon’s Global CTO brings more than 30 years of experience leading largescale technology organizations in the financial services sector, with a demonstrated record of strengthening operational resilience, improving security and risk controls, and delivering customer centric digital capabilities across global business operations. Aegon’s Global CISO is a seasoned executive with extensive leadership experience in information security, technology strategy, and risk management. Prior to joining Aegon, he held senior positions at various large organizations and has over 30 years of experience in leading information security programs, including as the CISO for Fortune 500 financial and healthcare companies. He also holds several industry-leading certifications related to various areas of information system risk and security.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Aegon Risk Committee (Committee) oversight of cybersecurity and other IT risks, including oversight of management’s implementation of our cybersecurity risk management program. The Committee reports directly to the Board regarding its activities, including those related to cybersecurity, and focuses on the effectiveness of the design, operation and appropriateness of the enterprise risk management framework and the internal control systems of Aegon. The full Board also annually receives briefings from Management on our cyber risk management program. Board members receive presentations on cybersecurity topics from Global Chief Information Security Officer (Global CISO) and internal security staff as part of the Board’s continuing education on topics that impact public companies.
The Committee receives regular reports from Aegon’s Chief Risk Officer covering all known material cybersecurity risks of the Company including but not limited to operational risk, technology and information security risks. In addition, management updates the Committee, as necessary, regarding significant or potentially significant cybersecurity incidents.
The Committee receives periodic updates from our Global Chief Information Security Officer. These include, but are not limited to: progress updates on cybersecurity strategy and execution against the Aegon strategic roadmap, a review of cybersecurity metrics, updates on the evolving threat landscape, and a review of our control environment.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Aegon Risk Committee (Committee) oversight of cybersecurity and other IT risks, including oversight of management’s implementation of our cybersecurity risk management program. The Committee reports directly to the Board regarding its activities, including those related to cybersecurity, and focuses on the effectiveness of the design, operation and appropriateness of the enterprise risk management framework and the internal control systems of Aegon. The full Board also annually receives briefings from Management on our cyber risk management program. Board members receive presentations on cybersecurity topics from Global Chief Information Security Officer (Global CISO) and internal security staff as part of the Board’s continuing education on topics that impact public companies.
The Committee receives regular reports from Aegon’s Chief Risk Officer covering all known material cybersecurity risks of the Company including but not limited to operational risk, technology and information security risks. In addition, management updates the Committee, as necessary, regarding significant or potentially significant cybersecurity incidents.
The Committee receives periodic updates from our Global Chief Information Security Officer. These include, but are not limited to: progress updates on cybersecurity strategy and execution against the Aegon strategic roadmap, a review of cybersecurity metrics, updates on the evolving threat landscape, and a review of our control environment.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our management team, including our Global Chief Technology Officer (Global CTO), Global CISO, Directors of various Security Services (e.g., Identity, Cloud, Data, SOC) along with Business Unit Security Officers (BISOs), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Management team supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Management team includes broad range of executive, strategic, and technical experiences across diverse number of technology and cybersecurity domains. Aegon’s Global CTO brings more than 30 years of experience leading largescale technology organizations in the financial services sector, with a demonstrated record of strengthening operational resilience, improving security and risk controls, and delivering customer centric digital capabilities across global business operations. Aegon’s Global CISO is a seasoned executive with extensive leadership experience in information security, technology strategy, and risk management. Prior to joining Aegon, he held senior positions at various large organizations and has over 30 years of experience in leading information security programs, including as the CISO for Fortune 500 financial and healthcare companies. He also holds several industry-leading certifications related to various areas of information system risk and security.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our management team, including our Global Chief Technology Officer (Global CTO), Global CISO, Directors of various Security Services (e.g., Identity, Cloud, Data, SOC) along with Business Unit Security Officers (BISOs), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Management team supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Management team includes broad range of executive, strategic, and technical experiences across diverse number of technology and cybersecurity domains. Aegon’s Global CTO brings more than 30 years of experience leading largescale technology organizations in the financial services sector, with a demonstrated record of strengthening operational resilience, improving security and risk controls, and delivering customer centric digital capabilities across global business operations. Aegon’s Global CISO is a seasoned executive with extensive leadership experience in information security, technology strategy, and risk management. Prior to joining Aegon, he held senior positions at various large organizations and has over 30 years of experience in leading information security programs, including as the CISO for Fortune 500 financial and healthcare companies. He also holds several industry-leading certifications related to various areas of information system risk and security.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true