UK firms report fall in cyber breaches but increased costs

The number of cyber breaches fell during the past 12 months at UK businesses, including large firms, but costs went up, according to a recent government survey. It also finds that board-level engagement with cyber is rising but remains fairly uncommon, that the General Data Protection Regulation (GDPR) has had a positive effect on cybersecurity, and more firms are buying insurance. The Cyber Security Breaches Survey 2019shows that 32% of companies polled experienced a cyber breach in the past 12 months, down from 43% last year. Large firms remain at greatest risk of cyberattacks, with 61% reporting cases this year. However, this is down significantly from 72% in 2018. The survey finds that while overall cyber breaches or attacks are down year on year, those targeted are suffering more, with the average number of incidents per firm hit rising from four last year to six. Some 48% of firms that experienced a breach said they identified at least one breach or cyberattack every month. The report accompanying the survey explains that a change in cybercriminal behaviour could account for the overall fall in businesses affected by breaches, with attacks becoming more targeted on a narrower range of firms. Phishing attacks remain the largest cause of cyberbreach or attack, accounting for 80% of cases during the last 12 months. Some 28% of attacks were traced to impersonation in emails and 27% were caused by malware or viruses, including ransomware. Businesses recorded an increase in the cost of cyber breaches during the past 12 months. Average losses increased from £3,160 in 2018 to £4,180 per cyber breach. The average cost for larger businesses was £22,700, according to the survey by the Department for Digital, Culture, Media and Sport. Its survey reveals that while the number of firms affected by cyber breaches has fallen, just 23% of medium-sized firms and 40% of large companies have acted to meet all the government’s ‘10 Steps to Cyber Security’. Planning incident responses are the most frequently overlooked area. UK digital minister Margot James said: “We know that tackling cyber threats is not always at the top of businesses’ and charities’ list of things to do, but with the rising costs of attacks, it’s not something organisations can choose to ignore any longer.” The report says the GDPR has had a “positive impact” on firms’ cybersecurity, accelerating changes in attitudes and driving the reduction in cyberattacks. Some 30% of businesses have changed their cybersecurity policy as a direct result of the GDPR, the survey shows. Although the accompanying report warns that some firms are focusing their attention on avoiding personal data breaches at the expense of other breaches and cyberattacks. This is an “unintentional consequence” of the GDPR, it says. “GDPR appears to have had, on balance, a positive impact on cybersecurity to date, but to make progress beyond this, organisations may need to think more holistically about the issue,” the report concludes. While board-level engagement with cybersecurity has improved and more board members are carrying a cybersecurity brief, it is “still relatively uncommon”, finds the survey. Just 35% of businesses have appointed a board member with specific responsibility for cybersecurity, although levels are higher in large firms at 41%. “Instilling better knowledge and understanding of cybersecurity across board members can be the difference between cybersecurity being treated as a fairly high priority, or a very high priority,” the report says. Many businesses are failing to monitor suppliers’ cyber risk and planning incident response, the survey suggests. Just 18% of businesses polled require suppliers to meet certain cybersecurity standards. The report reveals a general shift towards prioritising cyber risks. Some 78% of businesses said cybersecurity is a high priority for their firm, up from 74% in 2018. The percentage is even higher for large firms at 95%. Some 93% of large companies have acted to identify cyber risks in the past 12 months, the report says. This ranges from internal audits (74%) and cyber risk assessments (69%), to regular health checks (64%) and external audits (48%). Some 57% of businesses said they now update senior management on cybersecurity actions at least once a quarter. This is up from 51% in 2018. Written cybersecurity policies have increased and now cover 33% of businesses, from 27% in last year’s survey. Take-up of cyber insurance, meanwhile, has risen from 24% to 35% at large companies and from 19% to 31% at medium-sized firms. Additional reporting by Chris Morrish.

UK firms report fall in cyber breaches but increased costs

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Want to read this article?

Read Next

AXA P&C increases premiums by 7% as rates rise at AXA XL

Hong Kong and Shanghai to cooperate on captives and ILS

Swiss broker Kessler names head of special risks

Supply chain cyber risk concentrated in 15 top vendors with ‘below average’ cybersecurity

US insurers expected to increase casualty pricing as social inflation rises

Related Articles