Cyber claims stabilize, but remain elevated

Cyber insurance claims have increased significantly in recent years, driven by the rise of threats such as ransomware attacks, but also due to the uptake in cyber insurance. AGCS has been involved in more than 1,000 cyber claims a year for the past two years, compared with fewer than 100 in 2016. Cyber claims frequency has begun to stabilize however, albeit at elevated levels, according to Joerg Ahrens, Head of Global Practice Group for Cyber Claims at AGCS.

Recent years have seen criminals become more organized and better resourced; a development recognized in this year’s Allianz Risk Barometer survey, where cyber was ranked as the top threat for companies by more than 2,600 risk management experts around the world. Ransomware was highlighted as the most concerning peril within this category by respondents – year-on-year attacks increased by 13%, a jump greater than the past five years combined, according to the Verizon Business 2022 Data Breach Investigations Report [1]. A ransomware trend that often goes under the radar is double extortion, where the ransomware attack is actually subterfuge for stealing data as well. In short, companies can get hit twice from the same incident.

For many businesses, the past couple of years have also been dominated by supply chain issues, and this trend is reflected across the cyber security landscape – more than 60% of system intrusion incidents come through an organization’s partner, according to the Verizon report.

Firms often take cyber security actions, but widely overlook their vendors or digital supply chains, with only 43% saying they had conducted a risk assessment of their vendor or supply chain, according to Marsh and Microsoft’s [2] latest annual global cyber risk survey, which quizzed over 1,000 respondents. Such oversights mean business interruption losses can escalate, particularly when larger companies and their digital supply chains are targeted.

“We have seen a number of concerning supply chain cyber-attacks in recent years (although these have not resulted in significant claims for AGCS),” says Ahrens. “Compromising the right partner can be a powerful weapon in the cyber criminal’s arsenal and highlights the difficulties that many organizations face in securing their digital supply chains. AGCS has been working with its customers to prepare and invest in the resources necessary to react to these and other huge cyber threats.”

Gone are the days when companies bought insurance against cyber-attacks instead of investing in attack protection technology themselves. The two have to go hand in hand.

“We’ve also seen a lot of investment over the past 12 months by our customers, and generally in the marketplace of organizations improving their cyber maturity levels, because of the heightened risks that now exist,” says Ahrens. “Companies really need to think about disaster recovery planning, put their plans to the test and then regularly test them. Ultimately, if the cyber maturity levels are there, they’re going to be able to obtain better cyber insurance coverage as a result and that is where the partnership between insurer and insured really comes to the fore.”