A relatively unexpected impact of many cyber incidents is the damage to reputation and goodwill. Whilst many organisations know to expect short-term technical and operational impacts, we find they are often un-prepared for the longer lasting impact on their reputation.
This is because many incidents are notifiable not just to regulators but often must be disclosed to clients (who have inserted mandatory notification obligations into supply contracts). Also, staff may find out about these incidents when they are asked to help remediate them or if they are impacted themselves, for example, if payroll is delayed. We expect an increase in D&O claims linked to cyber-attacks in the coming year and also expect an increase in third-party litigation arising out of cyber events.
Many organisations were forced to change how their core operations were performed due to pandemic lockdown restrictions. Often this meant hurriedly allowing operations to be made accessible remotely for home-workers. Unfortunately, this also meant that some organisations did this without sufficient preparation or understanding of the greater risks to which this exposed them and many inadvertently opened the door to cyber criminals who moved fast to exploit staff, processes and networks that were suddenly exposed.
With many organisations stating that hybrid and remote work is here to stay, attackers are continuing to exploit this attack vector even more efficiently so the requirement for cyber insurance that protects against malicious attacks has dramatically increased and will continue to do so.
I predict that the cyber-criminal landscape will continue to develop over the coming year; the tactics currently being implemented are so effective at generating financial rewards that they are only likely to increase in frequency, innovation and efficacy. The specialisation we have seen emerging over the past year, with certain groups of cyber-criminals concentrating on specific strategies.
Despite the efforts of various stakeholders in the risk management space, from private organisations to insurers, ransomware will continue to be a persistent and evolving threat in the coming year, making a layered defence including technical and operational measures backed by robust cyber insurance cover essential.
