Organisations losing confidence in ability to manage cyber risk finds Marsh/Microsoft survey

A survey by Marsh and Microsoft finds that organisations are losing confidence in their ability to manage cyber risk and highlights a gap between concern and approach to the threat. Startlingly, the global survey of 1,500 organisations reveals that the majority of board members and business leaders responsible for cyber risk management spent less than a day in the last year focusing on this issue. The survey builds on a similar poll in 2017. It reveals that only 11% of organisations have a high degree of confidence in their ability to asses cyber threats, prevent cyberattacks and respond effectively. This is down from 19% two years ago. Meanwhile, those saying they have no confidence in understanding and assessing cyber risks increased from 9% to 18%. The percentage of organisations with no confidence in preventing cyber threats is up from 12% to 19%, and from 15% to 22% for responding to and recovering from events. Marsh and Microsoft say the results show that strategic cyber risk management “remains a challenge” for many organisations. They point out that while nearly two thirds (65%) of organisations identified a senior executive or the board as a main owner of cyber risk management, only 17% of c-suite executives and board members said they spent more than a few days in the past year focusing on the issue. Just over half (51%) spent just several hours or less on cyber risk. Likewise, 88% of respondents identified their information technology and information security functions as primary owners of cyber risk management. But 30% of IT respondents said they only spent a few days or less during the last year focusing on the topic. Risk managers were identified as the third most likely main owner of cyber risk, taking on the role in 49% of organisations. But 25% of risks managers only spent several hours on less on cyber risk in the last 12 months. This lack of time to focus on cyber risk management comes as concern over cyber threats hits an all-time high. According to the 2019 Marsh Microsoft Global Cyber Risk Perception Survey, nearly 80% of organisations now rank cyber risk as a top-five concern, compared to 62% in 2017. The survey also reveals a discrepancy in many organisations’ view of the cyber risks they face from supply chain partners, compared to the level of risk they feel their organisation poses to counterparties. Some 39% said cyber risk posed by supply chain partners and vendors to their organisation was high or somewhat high. But only 16% said the cyber risk they pose to supply chain partners was high or somewhat high. Respondents were also more likely to set a higher bar for their own organisation’s cyber risk management actions than for their suppliers. Kevin Richards, global head of cyber risk consulting at Marsh, said of the findings: “We are well into the age of cyber risk awareness, yet too many organisations still struggle with creating a strong cybersecurity culture with appropriate levels for governance, prioritisation, management focus and ownership… This places them at a disadvantage both in building cyber resilience and in confronting the increasing complex cyber landscape.” Joram Borenstein, general manager of cybersecurity solutions group at Microsoft, said that in the era of transformational technology and more interconnected supply chains, “cyber risk management practices and mindsets of yesterday no longer suffice and may actually inhibit innovation”. “It is incumbent upon senior leaders to focus on these issues for the welfare of their organisations, their customers, their employees and beyond,” he added. The companies say the survey suggests many organisations focus on technology defences and investments to prevent cyber risk, to the neglect of risk assessment, risk transfer, response planning and other risk management areas that build cyber resilience. For example, a substantial 83% of organisations polled have strengthened computer and system security during the past two years, but less than 30% have conducted management training or modelled cyber loss scenarios. On the plus side, 30% of organisations reported using quantitative methods to express cyber risk exposures, up from 17% in 2017. At the same time, organisations continue to embrace new technologies but are uncertain about the risks they bring. Three quarters (77%) of respondents said they are adopting or have adopted cloud computing, robotics or artificial intelligence. However, only 36% said they evaluate cyber risk both before and after adoption. Some 11% don’t evaluate the risk at all. The survey also finds that the number of global organisations buying cyber insurance is on the rise as insureds grow increasingly confident about the cover on offer. Marsh said the survey points to a number of best practices that most cyber resilient firms employ and which all firms should consider adopting: Create a strong organisational cybersecurity culture, with clear, shared standards for governance, accountability, resources, and actions Quantify cyber risk to drive better-informed capital allocation decisions, enable performance measurement, and frame cyber risk in the same economic terms as other enterprise risks Evaluate the cyber risk implications of new technology as a continual and forward-looking process throughout the lifecycle of the technology Manage supply chain risk as a collective issue, recognising the need for trust and shared security standards across the entire network, including the organisation’s cyber impact on its partners Pursue and support public-private partnerships around critical cyber risk issues that can deliver stronger protections and baseline best practice standards for all. Aon recently warned that companies are not doing enough to manage cyber risk.

Organisations losing confidence in ability to manage cyber risk finds Marsh/Microsoft survey

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles