Experts at Allianz Global Corporate & Specialty (AGCS) has identified five trends in its Cyber: The changing threat landscape report.
The five trends are:
- Hackers zero in on vulnerable supply chains: Supply chain attacks – whether on critical infrastructure such as the Colonial Pipeline or on cloud services – have emerged as a significant risk. Increasingly, ransomware gangs use the threat of disruption to pressure firms into paying ransom, with manufacturing companies, particularly vulnerable.
- Cloud outsourcing: Companies continue to shift their services and data storage onto the cloud, despite growing concerns around security and risk aggregation. By relying on a small number of providers for cloud services or cyber security, society is creating large concentrations around a few single points of failure. It is a common misconception that the outsourcing or cloud vendor will assume full responsibility in the event of an incident.
- Third-party liability, including fines and penalties, is becoming more relevant with advances in technology, organizations collecting more information and enforced data privacy regulations. Almost any cyber incident – including double-extortion ransomware – can lead to litigation and demands for compensation from affected parties.
- A shortage of professionals is hindering efforts to improve cyber security. While there is a growing awareness among boards, the number of unfilled cyber security jobs worldwide has grown 350% over the past eight years to 3.5 million, estimates show, meaning many companies struggle to hire, impacting their ability to improve their cyber security posture.
- Cyber security is increasingly seen through the ESG lens. Today, companies’ cyber security resilience is scrutinized by far more stakeholder groups than in the past. Increasingly, cyber security considerations are incorporated into the ESG risk-analysis frameworks of data providers, who look into companies’ practices to evaluate their preparedness for cybercrime. Making sure a company’s cyber processes and policies are understood at the board level and that risk monitoring processes are in place has never been more important.
In response to a more complex risk environment and increasing cyber claims activity, the insurance industry is more diligently assessing companies’ cyber risk profiles in a bid to incentivize companies to improve their security and risk management controls.
“The good news is that we are now seeing a very different conversation on the quality of cyber risk than a few years ago,” says Sayce.
“We are gaining much better insights and appreciate clients going the extra mile in order to provide comprehensive data to us. This also helps us to provide more value and offer useful information and advice to customers, such as which controls are most effective or where to further improve risk management and response approaches.
“The net result should be fewer – or less significant – cyber events for our customers and fewer claims for us. Such collaboration will also help in creating a long-term sustainable cyber insurance market which not only relies on traditional coverages but, increasingly, on integrating cyber risks into captive programs and other alternative risk transfer concepts,” he added.