Cyber budgets increase and executive overview improves: Moody’s

Spending on cyber risk has risen fast and attention paid to the issue by top management has significantly increased, according to Moody’s 2023 cyber survey of more than 1,700 corporations worldwide. But the ratings agency reports that the news is not all positive. It said that advanced cyber practices remain out of reach for many corporations and that the survey responses raised questions about the effectiveness of some cyber initiatives. “Companies and organisations are also facing other looming challenges, including a growing cybersecurity talent shortage and the advent of generative AI, which will introduce new risks,” said Moody’s. It explained that its 90-question survey gauges cybersecurity practices among global debt issuers and collects data on an emerging risk that carries the potential to influence the credit profile of all debt issuers. The ratings agency pointed out that the number of cyber breaches soared between 2014 and 2020 but has plateaued at a high level since then, according to its affiliate cybersecurity ratings company Bitsight. It noted that a small but increasing number of rating actions are tied to cyber incidents. The survey found that cybersecurity spending rose by 70% over the past four years. “There was considerable variance in growth rates among respondents, but budgets were up overall, and significantly for most sectors. Budgets for corporates grew the most at 100%,” said Moody’s. Not only are budgets rising in absolute terms, they are also rising as a percentage of the whole technology budget, it added. Overall, issuers say they devoted a median of 8% of their technology budgets to cybersecurity in the survey, up from 5% in 2019. “The increase is likely a response to rapid digitalisation and an accompanying rise in cyber risk in recent years. A shift to remote work during the Covid-19 pandemic has also broadened issuers’ digital footprints and opened new channels for cyberattacks,” said the ratings agency. Cybersecurity is typically more resilient to economic pressure than other technology-related budget items because companies must often meet certain compliance and regulatory requirements or minimum spending levels to qualify for cyber insurance, it added. But there are signs that organisations are tightening their belts, according to Moody’s. While cyber budgets have increased, so have the demands made on them, it said. “Cyber insurance has become an indispensable tool in the risk management toolkit for many issuers, and premiums increased by a median of 50% across the board between 2020 and 2022,” concluded Moody’s. “These hikes were in response to losses cyber insurers suffered in 2020 after a steep increase in ransomware attacks during the Covid-19 pandemic. Attacks proliferated because the pandemic forced employees to work from home on their home computer networks that had weaker controls. Increased employee distractibility in remote environments also led to security mistakes. On top of that, cybercriminals targeted virtual private network (VPN) software that employees use to access their employers’ networks,” said the agency. Moody’s noted that the rising premiums hit some issuers harder than others. Some US issuers in education, healthcare, construction and manufacturing experienced premium hikes of 300% or more in 2021. “The rise in premiums peaked in 2021 but has eased off since then as insurers found greater profitability, new carriers began writing cyber insurance, and the volume of ransomware attacks decreased,” added Moody’s. Despite the higher cost of cyber insurance, only 3% of participants in the survey said they planned to buy less cyber coverage in 2023 than in 2022. “The vast majority (82%) plan to purchase about the same amount, and 16% said they would buy more. These numbers hold even for those that have faced substantial increases in cyber insurance premiums,” noted Moody’s. Among those whose premiums increased 100% or more, 89% said that in 2023 they would purchase about the same amount of coverage, 8% planned to purchase more coverage, and only 3% said they would purchase less coverage. Notably, 30% of respondents in Asia Pacific (APAC), where penetration of cyber insurance is much lower than in Europe, Middle East and Africa (EMEA), and the Americas, said they would purchase more cyber insurance in 2023 compared with 14% and 15% for the Americas and EMEA, respectively. “Despite the high premiums, new insurance signups are increasing, with 76% of respondents saying they had taken out specialised cyber insurance in the latest survey, up from 71% in 2020. The share of issuers with cyber insurance grew by eight percentage points in the Americas, where cyber insurance is most common, while in EMEA and APAC, which have less mature cyber insurance markets, growth was 11 and 20 percentage points, respectively,” said Moody’s. The agency said that high-profile ransomware attacks such as the May 2021 ransomware attack against Colonial Pipeline Company in the US are raising concerns among regulators and policymakers. “New requirements for issuers to disclose details about their exposure to and management of cyber risks are increasing as a result. Disclosure mandates provide more transparency for investors, enabling them to differentiate between companies according to the strength of their cyber risk governance,” said Moody’s. “Disclosures also benefit governments, which need data to understand the extent of the risk and to develop appropriate policies for curbing the effects of attacks. Mandatory disclosure also helps establish defense benchmarks that organisations can use to improve their cybersecurity by comparing their cybersecurity practices against others. Furthermore, they reduce system-wide risk because information about attacks is shared with other organisations, which can use it to defend themselves from similar attacks,” it added. However, the agency pointed out that new regulations add operational burdens and costs, too. This is especially true for entities that report to more than one regulator since the resources required to comply with these measures can be considerable. One positive finding for risk and insurance managers is that executive oversight appears to be improving in this area. “Apart from rising budgets, another significant improvement in cybersecurity governance since Moody’s first survey three years ago is an increase in the frequency that cyber managers report to the most senior decision maker, such as the chief executive. In the previous 2020 survey, a third of issuers said that their organisation’s chief executive received direct briefings from the senior cyber manager on a quarterly basis. This time, nearly 45% said that these briefings take place monthly,” it said. “Likewise, last time, only 61% of cyber managers were reporting to a c-suite individual, such as a CEO, CFO or CIO. In this survey, 90% of issuers said their cyber managers did so. This indicates that issuers have an increased understanding of the importance of the cyber manager’s role and are working to ensure that cyber managers have better visibility within their organisations,” concluded Moody’s.

Cyber budgets increase and executive overview improves: Moody’s

Cyber loss prevention remains a challenge

Want to read this article?

Read Next

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

US insurance prices rise in Q3 but pace slows

UK and US agencies release joint AI cybersecurity guidelines

North American buyers face hardening rates into 2024: WTW

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

US insurance prices rise in Q3 but pace slows

UK and US agencies release joint AI cybersecurity guidelines

North American buyers face hardening rates into 2024: WTW

This website uses cookies to improve your experience. You can review our Cookie Policy here.

Want to read this article?

Read Next

Legal sector faces surge in cyberattacks

Munich Re hopes Global Shield picks up momentum at COP28

US insurance prices rise in Q3 but pace slows

UK and US agencies release joint AI cybersecurity guidelines

North American buyers face hardening rates into 2024: WTW

Related Articles

This website uses cookies to improve your experience. You can review our Cookie Policy here.