Cyber risk management steadies claims levels in Europe: Marsh

Cyber claims rose in 2023, but growth was slight given the number of cyber insurance policies in force, Marsh Europe said in a recent briefing on the cyber market. “There’s a general upward trajectory of claims, particularly since 2019, and we expect this trend to continue in 2024 and beyond,” said Salome Santos, product & claims leader at Marsh Europe, using data from its European clients to track cyber trends. But claims notifications are down significantly from a peak in 2021. Santos attributes this to advances in cyber risk management over the past two years. “Insureds are really recognising the need to understand and mitigate the cyber risk,” Santos said, “There’s a better understanding of how severe the impact of a cyber event can be to their business.” She added that the cyber insurance market has been more proactive in sharing information on cyber incidents alongside an uptake in cyber controls and stronger security posture among insureds. “We think this awareness and bigger collaboration may have led to a more proactive approach in detecting and mitigating cyber threats, and this may be reducing the number of successful cyber incidents notified,” Santos said. Financial institutions accounted for the majority of European cyber claims notifications last year, Santos said, with a significant slowdown noted in claims from manufacturing firms over the past two years, likely due to an increase in IT security, maturing and resilience of the sector, Santos said. However, Marsh tracked a rapid increase in claims notifications from the communications, media and technology (CMT) sector, which recorded the fastest growth in cyber claims in 2023. Santos said technology companies within the CMT sector, particularly IT products and services, accounted for 49% of notifications in the sector 2023, up from 31% in 2022. Florian Saettler, head of cyber incident management at Marsh Europe, said companies in this sector are “very lucrative targets” and allow cyberattackers to scale up their efforts; one breach can spark multiple compromises and opportunities to extort money from numerous companies. Santos said extortion following ransomware continues to be the most reported type of incident, followed by data breach. She said Marsh is still seeing a lot of attacks from exploitation of vulnerabilities in systems and the lack of multi-factor authentication. “For the remainder of 2024, and into 2025, we expect claims notification related to ransomware to be consistent, although we do see a decrease in ransoms being paid,” Santos said. Saettler said companies are working hard to become more resilient to ransomware attacks and working on their back-up hygiene. At the same time, threat actors are moving away from encryption and are more focused on exfiltration of data and using that to extort money, although Saettler said exfiltration only is “not much of a reason to pay”, warning that even when ransoms are paid, resulting losses are not necessarily lower. Ransoms do not always make up the largest part of the loss either. “Typically, the larger component of a cyber incident will be response and recovery cost, and especially business interruption costs, which are a huge driver of the amount of the loss,” Saettler said. Recent law enforcement efforts have helped break up ransomware gangs, but Saettler warned that the threat of cyber extortion is unlikely to disappear, with new groups ready to reform under new names. Saettler said this comes with its own risks for companies. “During some of these actions, individuals from these groups can be identified and put on sanctions lists. Companies need to be very cautious when dealing with cyber extortion threats and consider making payments, because of the risk of violating sanctions rules,” he said. Saettler said while cyberattacks will continue, companies can be more prepared and reduce both the impact and the cost of an event. “There is statistical evidence that if you have a proper incident management function in place and prepare for cyber events by having response plans and procedures, then you will make a huge saving compared to organisations that are not prepared,” Saettler said. Gamze Konyar, head of cyber at Marsh Europe, said SMEs are particularly exposed to the impact of cyberattacks. “We still do not see enough insureds in SMEs,” she said. Konyar added that the industry needs to address the needs of SMEs and find a better fit for coverage. “If we don’t address the cyber risk and needs for cyber insurance in that segment, we will not be able to fully address a cyber resilient economy,” Konyar said. With rates for cyber coverage softening, Konyar said now is the time to optimise cyber insurance and revise limits bought in harder markets. “It’s time to quantify the risk and make your needs more fitted to your insurance programme,” she said.

Cyber risk management steadies claims levels in Europe: Marsh

Want to read this article?

Read Next

NSM team launch $650m Ignyte platform

Donnet re-elected as Generali CEO

Mapfre Global Risks records 7% slide in Q1 net income

Cevian Capital sells Baloise stake to Helvetia shareholder ahead of merger vote

Asian rates decline across major lines

NSM team launch $650m Ignyte platform

Donnet re-elected as Generali CEO

Mapfre Global Risks records 7% slide in Q1 net income

Cevian Capital sells Baloise stake to Helvetia shareholder ahead of merger vote

Asian rates decline across major lines

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

NSM team launch $650m Ignyte platform

Donnet re-elected as Generali CEO

Mapfre Global Risks records 7% slide in Q1 net income

Cevian Capital sells Baloise stake to Helvetia shareholder ahead of merger vote

Asian rates decline across major lines

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters