How Cyber Risk Touches Nearly all Aspects of Business Risk

According to Aon’s 2021 Global Risk Management Survey cyber threat was predicted to remain the top risk globally for 2024, outranking COVID-19 and broken supply chains.1 The prominence of long-term hybrid working, supply chain-related attacks, geopolitical instability, and digital connectivity continued to drive a material increase in focus around cyber risk for companies around the globe.2 Additionally, tighter requirements by insurers from 2020 to 2022 made it more challenging to secure a cyber policy and increased the need for companies to demonstrate proper security controls’ and their resulting  effectiveness. In this higher threat and more stringent underwriting context, organizations could no longer expect to have cyber insurance capital readily available to hedge against the financial volatility stemming from cyber risk.

Cyber risk can be defined as the risk of financial loss, business interruption, or damage to an organization from some failure connected to its information or operational technology systems. But cyber risk goes far beyond technology. Cyber is, among others, a holistic and enterprise risk that poses a financial, operational, people, regulatory, and even catastrophic threat to all organizations, regardless of size or sector. As such, understanding an organization’s business drivers and the daily decisions related to them often proves the critical link towards managing the journey to achieving holistic and sustainable cyber resilience.

CyQu Findings: Aon Clients Report

The 2022 CyQu client data tell us that, on average, organizations across industries and revenue bands improved their cyber maturity from “basic” to “managed.” The global average of CyQu risk scores, which increased in 2022 from 2020, reflects this growth. Increased underwriting rigor in the Cyber and E&O insurance market in 2021 and the first half of 2022 drove greater scrutiny of security controls, more rigid guidelines, re-evaluation of risk, and subsequent reduced market capacity, which likely influenced this progress in cyber maturity.

Clients across industries and revenue bands reported that the budget for cyber security increased between 2020 and 2022, with an average of 10 percent of the information technology budget reportedly spent on security.

From a controls perspective, five domains demonstrated the most significant risk profile improvements, and from this inferred budget increases: Data security, application security, remote work, access control, and endpoint and systems security.

Across revenue bands, mid-market clients reported the most significant improvements in overall cyber maturity.  In contrast, organizations in the global and enterprise segment reported improvements but remained at “managed” maturity. Improvement in incident response (IR) planning, data protection, endpoint logging and monitoring, and remote work vulnerability and monitoring drove the upgrade in the security profile for the mid-market. These controls moved from “basic” to “managed” in 2022. Client data reflect that access controls, data and security, and business resilience were areas of focused improvement for most revenue bands. At the same time, third-party contract diligence and inventory management risk scores remained flat.

From an industry perspective, all industries reported improvements in overall CyQu risk scores. The healthcare and social assistance, retail trade, and real estate industries reported substantial improvement in moving from “basic” to “managed” security risk profiles.

The most significant gain in CyQu risk scores for the healthcare industry was reported in multi-factor authentication (MFA) (1.9 in 2020 to 2.6 in 2022) and data protection (2.4 in 2020 to 3.0). The industry, however, continued to report marginal movement in third-party, software management, and application security risk profiles. Within the retail sector, 74 percent of companies reported scores higher than 2.5 for user awareness training, and more than half reported similar scores for logging and monitoring capabilities, helping to improve the sector’s overall risk profile.

In real estate, changes in scores across application security development (1.8 in 2021 to 2.5 in 2022), software management (1.9 in 2021 vs. 2.3 in 2022), risk management (1.9 in 2021 to 2.4 in 2022), and user awareness training (2.5 in 2021 to 3.2 in 2022) drove overall profile improvement.

In Summary:

Navigating this risk landscape, while trying to understand the correlation between cyber and business risk has always been challenging. The pressure is on to not only continuously block and tackle, patch vulnerable systems and understand the connection points across highly integrated technology stacks, but also keep on top of the potential impact of emerging threats and regulatory changes. The result is security and technology teams must constantly evaluate the organization’s preparedness for evolving threats and provide quantifiable evidence of current controls effectiveness to insurers and the marketplace. Alignment with best practice control standards, like those specified by the National Institute of Standards and Technology (NIST) or the Center for Internet Security (CIS) is prudent. Security teams should regularly assess controls to determine effectiveness across preventative and response cyber maturity.