Journal

2022 Marsh McLennan Semi-annual Cyber Handbook: 2nd Installment

Foreword

While advances in new technology are delivering great progress for our society, they’ve also exposed the vulnerabilities of a digital economy. Cyberattacks routinely cost organizations tens — even hundreds — of millions of dollars. It’s no surprise then that these events rank among the most pervasive and pressing risks for business leaders.

As we see from reported events around the world, cyber risk is expanding in reach beyond the most proximal targets – to supply chain constituents and third-party providers – and also giving rise to other forms of digital risk.

It is important to understand the underlying reasons that are driving the increasing frequency and severity of cybercrimes. Attack methods are growing more sophisticated and accessible with malicious forms of ransomware available ‘off the shelf’ to nefarious actors. At the same time, the ‘new COVID normal’ continues to foster distributed work environments that are often easier to penetrate for bad actors.

A cohesive cyber strategy is critical to keep pace with sophisticated cyber-attacks in complex and converging technology ecosystems. Fostering a cyber-vigilant culture across the entire workforce is also necessary. Furthermore, promoting an aggressive cyber posture not just internally but also with customers and partners can be a real asset and means of competitive differentiation. Lastly, utilizing cyber analytics to quantify risk exposure is essential to effectively allocate investment capital to address the biggest cyber vulnerabilities.

Consistent with prior trends, the cyber landscape will only increase in complexity. The Marsh McLennan Cyber Handbook features perspectives from business leaders across Marsh McLennan who routinely help clients become more resilient in managing cyber risk. It explores some of the most significant trends in cyber readiness, cyber response and new cyber regulations.

Understanding emerging sources of cyber risk

Cybercrime costs the global economy $450 billion annually. New technologies such as Quantum computing (QC) and the Metaverse are driving the evolution of cyber risk – amplifying existing risks and introducing new ones. QC represents the biggest data security threat as it can circumvent existing protections entirely when used maliciously. It has the potential to both disrupt and augment cybersecurity. As individuals and businesses expand their use of immersive digital technologies in the Metaverse, this will exacerbate the risks that businesses are already grappling with – such as data privacy and ransomware attacks. It will also introduce new threats in the digital world – further blurring jurisdictional boundaries, elevating interoperability and integration risks between the digital and physical worlds, and creating heightened personal risks to mental well-being and discrimination.

Building cyber readiness

73% of companies surveyed experienced a cyberattack in the past year. These intrusions were dominated by ransomware and phishing events. According to a 2022 survey, most leaders today have no more confidence in managing cyber risk than they did two years ago. An enterprise-wide approach to cyber risk management built on broad-based communication and alignment between stakeholders to drive efficient decision-making will help manage cyber risk better. Organizations can incorporate best practices for response planning, such as hosting incident preparation response plans off-network, establishing a secure off-network cyber war room to facilitate communication, and building and testing response workflows for each type of potential incident exposure.

Cyber insurance in focus

With less than 1% of $1 trillion in crypto assets insured, the Web 3.0 economy is clearly underinsured. Maintaining a sustainable cyber insurance market requires transparency - clarity of coverage, contract certainty, and pricing mechanism clarity - to help buyers make informed decisions about their coverage elections. Despite restrictions in the cyber liability reinsurance market, more capacity is expected to enter the sector, albeit gradually, from both traditional reinsurers and third-party capital sources. According to experts, concerns around systemic risk, ransomware, lack of loss data, the complexity of modeling cyber risks, pricing, and profitability, are among the factors fueling hesitation about involvement in the cyber reinsurance market.

Business Leaders: