Spanish risk managers focus on cyber as AI intensifies risk

Spain’s risk management association Agers has published a handbook to help companies and risk managers prepare for cyberattacks that it says will inevitably hit all firms at some point. The goal of the association is to help risk managers deal with the development of cyber risk, which has rocketed in the past decade. The handbook is aimed at professionals who are not experts in cyber risk but need to understand enough about the subject to work in tandem with their companies’ IT security departments and increasingly specialised insurance underwriters. “In my first meeting to negotiate a cyber policy, eight or nine years ago, I could not grasp it, even though we had thoroughly prepared beforehand,” said Belén Medina, the head of control, risks and insurance at transportation concessions group Globalvia, during the recent presentation of the handbook in Madrid. “Even after eight years working with it, I still cannot feel 100% comfortable about it.” It is a complicated subject because cyber threats do not stop evolving. One example is ransomware. The risk has been a concern for companies for several years but has now moved beyond simple extortion to include double, or even triple, extortion events, noted Carlos Rodríguez, regional cyber product leader for APAC and Europe at AXA XL. Also, risk managers report that their chief information security officers (CISOs) have been warning them against sophisticated malware fraud created by generative AI tools such as ChatGPT. Even the most basic kinds of malware have become more frequent as ready-to-use virus packages are available to purchase on the internet, opening the market to common crooks with no programming knowledge, Rodríguez pointed out. “And there are themes such as quantic computing, which can be completely disruptive,” he said. “It changes the paradigm. All our trust in networks is based on encryption. If this technology can break encryption, we will no longer be safe in our communications.” On top of this is the regulatory aspect of cyber risk. Data privacy regulation such as Europe’s GDPR and cybersecurity standards such as the updated EU Directive on Security of Network and Information Systems (NIS2) are spreading around the world. The US National Institute of Standards and Technology (NIST) is also bringing its Cyber Security Framework (CSF) up to date. If companies want to transfer cyber risks to the insurance market they now have to meet increasingly high thresholds from underwriters to provide cyber insurance capacity. The handbook published by Agers throws light on some of those thresholds, and on what companies must do to comply with them. For example, buyers must clearly identify their critical assets that could be affected by a cyberattack. Administrative accounts must be segregated, and the range of privileged access to administrators must be as limited as possible. System back-up copies must be made taken regularly and kept offline with strong protection, the handbook says, while IT security structures must be tested frequently and security parches upgraded whenever possible. Another red line drawn by the insurance market is training staff members on cyber risk. Training must include real life cyberattack simulations and focus on how employees should react to such events. “Awareness is of the essence. Staff members are the weakest link,” Rodríguez pointed out. He stressed that tighter underwriting practices seem to be having a positive impact on the cyber insurance market. The volume of cyber claims dropped in 2021 and initial numbers also indicate a stronger performance last year. But Rodríguez said that many liability risks linked to cyber covers have a long tail and may show up in insurers’ balance sheets in the future. Although the cyber insurance market has loosened up a little at recent renewals, the cover remains expensive and insurers are demanding more information and higher deductibles from buyers. The Agers handbook therefore places emphasis on companies doing their homework before transferring their risks to the insurance market. The booklet is divided into five areas that risk managers need to focus on: risk identification, protection, detection, response and recovery. It warns that even before that work begins, risk managers must be profoundly aware of their companies’ characteristics and exposures. It also helps risk managers navigate a sea of acronyms such as OT, SCADA, DPC, PLC, SDLC and others used by CISOs and underwriters. The handbook is the fifth volume of a series published by Agers on cyber risks. Other titles include topics such as cyber risk mapping and transfer. The handbook, which is published in Spanish, costs €8 in ebook version or €15 on print. It can be acquired on Agers’s website: https://agers.es/guia-cyber-buenas-practicas-en-proteccion-de-ciberriesgos-para-no-expertos/

Spanish risk managers focus on cyber as AI intensifies risk

Agers handbook offers layman guide

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles