Marsh survey finds European firms not grasping cyber risk: supply chain weakness exposed

These figures suggest that European firms are overly exposed to cyber risk and that risk managers are unable to articulate their transfer needs to insurers. Marsh’s European 2015 Cyber Risk Survey Report, released this week, finds that 79% of European organisations have, at best, a basic understanding of their exposure to cyber risk. 43% of the risk professionals surveyed have not yet identified one or more cyber scenarios that could affect their business. 68% have not estimated the financial impact of a cyber-attack. Marsh finds it surprising that 25% of organisations surveyed do not have cyber risk on their risk register. Another 30% place it outside the top ten risks. Speaking to Commercial Risk Europe, Stephen Wares, Marsh’s cyber risk practice leader, said: “Overall the survey paints a picture of organisations that have not yet undertaken a thorough investigation of their cyber risk profile and are therefore operating relatively in the dark as to what the operational, reputational and financial impacts are of a cyber-attack on the organisation. The message appears to be that a lot more work needs to be done to improve the understanding of many organisations’ cyber risk profiles.”hideThe survey suggests that much of this problem is caused by a lack of risk management and board ownership of cyber risk. IT departments continue to take primary responsibility for cyber risk in nearly two thirds (65%) of European organisations polled. Risk management has ownership in just 11% of firms, as does the board. While IT is good at preventing cyber-attacks, the function tends not to take a wider view of risk. This leaves companies exposed and unable to understand their cyber exposures. “IT is obsessed with preventing an incident and is tasked with doing that. Their role and their function does not ordinarily extend to identifying the operational impacts and reputational damage that might occur to a firm as a result of something happening. That is usually driven by the board and the risk manager, and so their lack of primary ownership in this area means it is under investigated. It doesn’t indicate that organisations are ill-prepared from a security perspective, but rather from a business impact perspective,” said Mr Wares. “Cyber risk is always an item for discussion but has not been formalised as the responsibility of the risk manager or a board member. It’s a discussion item rather than a clearly defined responsibility I think,” he added. This begs the question: Why are risk managers failing to take ownership of, and responsibility for, cyber risk? Mr Wares believes that, as with any emerging risk, it is simply taking time for cyber risk to become firmly established on people’s agendas. He also suggested that risk managers may be shying away from this technical and complicated issue that takes them out of their comfort zone. But he stressed that risk managers should not be so wary and many already possess the skills needed to help manage cyber risk. “Cyber is viewed as a technical issue still. A lot of non-technical people want to shy away from technical issues. But we are talking about the impact on the organisation here, for which you don’t necessarily need an in-depth understanding of technical issues to assess. The qualities needed are already possessed by risk managers who have the ability to audit an organisation for the risk impacts of an event occurring,” he said. The survey also revealed what Marsh described as a surprising and concerning lack of control over supply chain cyber risk. More than three quarters (77%) of respondents do not assess suppliers and/or customers they trade with for cyber risk. Marsh said this appears to leave organisations exposed and lacking control over IT security standards in systems where hackers might find a ‘back-door’ weakness. “These statistics were quite frightening in terms of the number of organisations that weren’t reviewing their suppliers. That appears to highlight a potential weakness in security control,” said Mr Wares. “Some of the recent hacking activities have been targeting suppliers, be those professional service firms or others with direct links to IT systems. It is becoming really important that organisations check vendors for security and lay down some standards against which they can be assessed to make sure they are as secure as their own networks,” he added. The survey’s findings on a number of key metrics suggest that European organisations are in a poor position to prioritise cyber risk mitigation efforts and risk transfer strategies. If many companies are not assessing or defining cyber risk they are clearly unable to articulate their concerns to the insurance industry. Indeed, 57% of respondents admit they have insufficient knowledge to even comment on their attitude towards cyber insurance. 55% have no plans to purchase cover. Only 12% have actually taken out cyber insurance. However, the cyber risks that respondents identify as most important—business interruption, loss of personal data and crime/fraud—are areas in which the insurance market is focusing their efforts, explained Mr Wares. This suggests there is a good match between the issues companies identify as most concerning and what the insurance market is offering, he added. “Yet at the same time over half of organisations aren’t engaged with the insurance market. We were wondering does that mean the products are not appropriate. I don’t think it is the case because of my previous comment. It must rather be the case that risk managers are in a poor position to go to the insurance market because they haven’t done that risk analysis on their own exposures so they don’t know how to articulate their needs to the insurance market,” he said. It is only when companies can evaluate their cyber risk and transfer needs that they will be able to properly assess whether the market offerings are appropriate. “That will be when they are able to judge the value of insurance. For instance, the terms proposed and whether the premium represents good value. Once companies have gone through that analysis process, buyers will be in a much stronger position to be able to articulate their requirements to the insurance market,” said Mr Wares. Despite European organisations placing a greater focus on cyber risks in the past 12 months, there is clearly still a considerable amount of investigation required by many in order to improve their understanding and management of cyber risk, concluded Marsh. Part of the solution to this lies in moving responsibility for cyber away from IT departments and into the boardroom, it added. “Only with board-level buy-in can companies identify business-critical areas and undertake scenario testing and financial impact analysis to build up their cyber risk profile, enabling them to mitigate and/or transfer the risk accordingly,” it said.

Marsh survey finds European firms not grasping cyber risk: supply chain weakness exposed

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Want to read this article?

Read Next

UK arenas face heightened terror threat, says Pool Re, as Martyn’s Law remains in draft form

Talanx ‘increasingly confident’ of beating full-year profit forecast on Q1 results

US property market stabilises but concern over casualty loss trends

AGCS’s revenue falls in Q1 as rate momentum slows

UK tells firms not to pay ransoms in cyberattacks

Related Articles