Insurance leaders doubt they can manage cyber risk any longer

Increased ransomware attacks and global threats at a time of high level technological changes and almost three years of Covid-induced unrelenting workplace disruption is tempering industry leaders and decision makers’ confidence in cyber preparedness, a new survey by  Marsh and Microsoft has found.

The two companies quizzed over 660 cyber risk decision makers globally and concluded that most leaders are no longer confident in their ability to manage cyber risk than they were two years ago.

A report published by  Marsh, The State of Cyber Resilience, attempted to understand how cyber risk is viewed by various functions and executives in leading organisations, including cybersecurity and IT, risk management and insurance, finance, and executive leadership.

It found that leadership confidence in their organisation’s core cyber risk management capabilities is largely intact, but companies are “still struggling to understand the risks posed by their vendors and digital supply chains as part of their cybersecurity strategies.”

Only 43% of respondents stated that they have conducted a risk assessment of their vendors or supply chains, the report said.

Nearly four in ten respondents (38%) said their organisation uses quantitative methods to measure their cyber risk exposure, which,  Marsh noted, is a critical step in understanding how cyberattacks and other events can create volatility.

Only 41% of organisations said they look beyond cybersecurity and insurance to engage their legal, corporate planning, finance, operations or supply chain management functions in making cyber risk plans.

“Given the continued rise of ransomware and the current tumultuous threat landscape, it is not surprising that many organisations do not feel any more confident in their ability to respond to cyber risks now than they were in 2019,” said Sarah Stephens, head of cyber (international) at  Marsh, said explaining the findings of the report.

Tom Reagan, cyber risk practice leader, US & Canada,  Marsh, added: “Cyber risks are pervasive across most organisations. Successfully countering cyber threats needs to be an enterprise-wide goal, aimed at building cyber resilience across the firm, rather than singular investments in incident prevention or cyber defense. Greater cross-enterprise communication can help organizations bridge the gaps that currently exist, boost confidence, and better inform overall strategic decision making around cyber threats.”

Did you get value from this story? Sign up to our free daily newsletters and get stories like this sent straight to your inbox.