Travelers helps clients protect against evolving cyber threats
Authored by James Doswell, Senior Risk Management Consultant, Travelers Europe
Confidential data remains an alluring target for cyber criminals. As long as there is potential for money to be made, threat actors will attempt to access data in any way they feel they might successfully exfiltrate information or apply extortion. The wealth of opportunities for cyber-attacks have transformed malware into an industry in its own right – albeit an illegal one – that continues to grow in sophistication.
As a result, cyber-attacks have become an ongoing challenge for a rising number of organisations, with 39% of UK companies reporting cyber security breaches so far this year. And, this figure is believed to be significantly deflated as smaller businesses tend not to report cyber-attacks. Nearly one-third of these businesses say they have been attacked at least once a week. In Ireland, government cyber security authorities have found that small and medium-size businesses have become frequent ransomware targets – and about 80% of the organisations that pay are attacked again.
The financial costs alone are significant: The National Cyber Security Centre said losses to fraud and cybercrime in the UK between April 2021 to 2022 totalled £3.1 billion. Worryingly, only 19% of businesses reported having a formal incident response plan, leaving many organisations vulnerable to costly interruptions following an attack.
Monitoring and managing risk
Our growing team at Travelers is dedicated to helping clients manage these risks, with support from a large amount of data from third-party vendors, industry partners, and our risks and claims teams. As part of our strategy, we’re tracking threats around the world and close to home so we can alert clients to their exposures and provide case-specific counsel and protection.
The threats are affecting all industries across the economy, but patterns are emerging in the attacks themselves. Phishing remains a primary means of breaching organisations. Of the 39% of UK businesses reporting a cyber-attack in the past six months, 83% of the threats were phishing attempts. Last year, ransomware officially became the UK’s most significant cyber threat because of its potential to harm essential services or critical national infrastructure. This year, double extortion attacks have become routine, forcing organisations to have to recover their stolen data, and then pay to prevent it from being leaked.
Updated cyber security controls provide important prevention, but the broad nature of malware and threat actors means activity is constantly evolving. No single security solution can provide overarching protection – and clients should be wary of any that profess to do so. Multi-factor authentication can provide an excellent level of protection when used correctly, but solutions such as filtering and Endpoint Defence are also incredibly important. Organisations need multi-layered cyber security – one control isn’t enough.
The best prevention and response
We’re eager to secure the best outcomes for clients by minimising the risk of cyber-attacks and, if one does occur, helping them limit any disruption to business. Strong partnerships with brokers are helping us make that happen. It’s important for brokers to have early discussions with us about their client requirements and ensure the organisation’s controls suit its specific functions. This helps us identify cyber security gaps that may exist due to the controls themselves or incorrect assumptions about the organisation’s needs.
Cyber threat actors are highly adaptive – and organisations must be too. Brokers can help clients reduce their exposures by recommending good cyber security practices and ongoing staff training, as well as asking their insurer for support in staying a step ahead of the risks. In an environment that provides rich targets for threat actors, organisations can make themselves less-appealing ones to threaten.
About the author
James Doswell is a Senior Risk Management Consultant at Travelers Europe, where he specialises in cyber risk control for clients in the UK and Ireland. Throughout his 25-year career in IT and insurance, James has helped transform organisations’ technology, achieving robust, secure IT environments and helped test and enhance software used to protect National Critical Infrastructure from ransomware and cyber-attack.
