Responsible Disclosure

Oliver Wyman, a Marsh business, is committed to maintaining the security and integrity of its systems and services, as well as protecting client and company information. We encourage the responsible reporting of potential security issues identified in systems or services operated by Oliver Wyman.

If you believe you have identified a security vulnerability, please report it to responsibledisclosure@marsh.com, including a description of the issue and steps to reproduce it where possible.

Reports received through this channel are reviewed by the cybersecurity team and handled through established vulnerability management and incident response processes.

Oliver Wyman does not authorize active security testing without prior written approval.

Individuals reporting potential security issues should avoid activities that could disrupt services, access data without authorization, or impact system availability.

Oliver Wyman will not pursue legal action against individuals who, in good faith, identify and report security vulnerabilities in accordance with this statement and without causing harm to our systems, services, or data.

We appreciate responsible disclosures that help us maintain a secure environment for our clients and our business.