Board and c-suite concern over cyber risk falls: survey

An annual survey from Advisen suggests that fewer board members and executives are worried about cyber risk, as concern fell for the first time in seven years. The research also shows that fear of cyber business interruption remains low, despite widespread disruption caused by recent cyberattacks. Risk professionals, almost predominantly in the US, surveyed in Advisen’s Information Security and Cyber Risk Management report believe board members and executive management view cyber risk less seriously than last year. Just under two thirds (62%) of those surveyed said boards of directors view cyber risk as a significant threat to their organisation, down from 83% in 2016. Sixty percent of the risk professionals surveyed said executive management view cyber risk as a significant threat to their organisation, down from 85% in 2016. In contrast, almost 90% of the 315 risk managers surveyed viewed cyber as a significant threat. “This could indicate board members have become more comfortable in their understanding of cyber exposures. An increased enterprise-wide focus on cyber risk and better communication to company leadership may have eased concerns and increased confidence in cybersecurity controls,” notes Advisen. “Or it could mean risk professionals are not up to date on the evolving nature of cyber risk and the possible magnitude of the losses,” it adds. The report also suggests that US companies continue to find value in cyber insurance. The cyber insurance take-up rate has increased substantially since 2011, but there are signs that market growth may be slowing, at least in the US. During the last seven years, the proportion of US companies buying cyber insurance has increased from 35% in 2011 to 65% in 2017. However, the percentage of companies buying cyber insurance is unchanged from 2016 and only four percentage points higher than 2015. Expenses and fines related to breach of personal information are the primary driver for purchasing a cyber insurance policy, the survey finds. Only 10% of respondents identified business interruption as the primary reason for purchasing cyber insurance. “Overall, the results indicate that businesses may not be keeping up with cyber-related risks or the steps needed to protect themselves against cyber-related attacks. And the evolving threat landscape, which increasingly exposes organisations to business continuity-related losses, has yet to reach the same level of alarm among the risk management community as the more traditional data integrity risks,” Advisen states in the report. Despite recent global ransomware attacks, which caused major disruption to a number of blue chip companies, cyber-related business interruption is still viewed as the lesser risk when compared with data breaches. Asked to rate how their company views various risks, on average, 35% of the respondents rated data integrity as “high risk”, compared with 22% for business continuity risks. Only 53% of respondents said they have made changes in response to the global ransomware attacks in early 2017. In fact, data integrity risks account for the top four cyber exposures as rated by risk professionals. An employee unintentionally infecting a company’s network with malware was rated the number one risk for the second consecutive year. It was followed by a cyberattack via malware, reputation damage due to loss of customer records, and privacy violation or data breach of customer records. The highest-rated business continuity risk, ranked fifth highest overall, is business interruption due to a cyber disruption. Business interruption from a cyber event was the highest ranked business continuity risk, followed by a distributed denial-of-service attack, extortion, cloud vulnerabilities, hacking of industrial control systems and supplier disruptions. High-profile cyber events have shown the potential for substantial cyber losses that go beyond data breaches. However, the survey reveals that many risk professionals remain less concerned about these types of business continuity risks. “This could indicate that risk professionals are either less educated about the exposures, have concluded these exposures are less significant to their business, or are confident (or overconfident) in their cybersecurity controls,” says Advisen. “Or the reason could be that risk professionals are not fully aware that the nature of cyber risk has been evolving beyond data security and toward interconnected risks, including business interruption, due to malware and ransomware attacks,” it says. “Since business continuity events are growing in both frequency and severity, the insurance industry should further educate their clients on these exposures, provide access to pre- and post-incident resources, and offer products that meet the needs of their insureds,” Advisen adds. The survey also shows that risk managers are helping to coordinate their company’s cyber risk assessment. Almost all respondents (97%) said the risk management team works with IT at least occasionally, while 17% consider IT a member of the risk management team. Many organisations are now taking a multifaceted approach to their preparation and response to cyber risk. A cyber risk management programme assessment is the most common external pre-incident service used by companies. However, vendor risk assessment by both internal and external resources is least frequently conducted pre-breach. “Another vulnerability often overlooked is the cybersecurity controls of vendors and other business partners within a supply chain. Many companies with robust cybersecurity controls have found themselves compromised by cybercriminals entering through the back door – a company in the supply chain that has access to their systems,” Advisen says. More than half of respondents say they include cybersecurity requirements in request for proposal and contracts with vendors, while a similar proportion require adherence to standards and/or cyber insurance.

Board and c-suite concern over cyber risk falls: survey

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Related Articles