Executive Welcome
Companies are coming off a challenging four years marked by the rise in the number and severity of cyber threats and ransomware attacks, followed by an insurance market with rising premiums and retentions and significant underwriting scrutiny. In working with clients, we observed that the C-suite came to the stark realization that cyber events have the potential to impact all areas of their business. Consequentially, achieving cyber resilience is a recurring theme in board room discussions and the threat is finally being considered from a holistic risk perspective.
Between 2020 and 2022, insurers reacted to the sheer enormity of cyber risk and the need to ensure profitability.
Increased underwriting rigor was introduced in the cyber and E&O market resulting in deeper scrutiny of security controls, more rigid guidelines, and re-evaluation of cyber risk overall.1 Based on Aon client-reported data, organizations responded to this increased rigor and began to focus more on improving risk maturity in controls designated as critical, or red flags, by insurers.
This year’s report is a guide for leaders to benchmark their organization’s risk maturity against peer companies and to help make better decisions around managing cyber across six featured risk themes: cyber, operational, supply chain, insider, reputational, and systemic. Data collected globally, from over 2,000 Aon clients across regions, industries, and revenue bands from Aon’s Cyber Quotient (CyQu), a global eSubmission and risk assessment platform, inform this Report. Augmenting this CyQu data is input from Aon’s Ransomware Supplemental Application and Operational Technology Supplemental providing expanded visibility into security controls prioritized by insurance carriers.2 This client input was then layered with cyber claims market intelligence and enriched with commentary from Aon’s Cyber Advisory and Digital Forensics & Incident Response teams, allowing us to provide a comprehensive examination of cyber resilience and risk within this report. The CyQu data helps clarify the broad understanding that the insurance marketplace is a crucial driver of the accepted controls that drive accepted maturity in cyber security. Clients reported that cyber maturity and readiness improved between 2020 and 2022, realizing a global average shift from “basic” to “managed”cyber maturity. Companies, in general, employed measures to strengthen security domains and controls deemed critical by insurers, including an increased focus on access management and multi-factor authentication (MFA) strategies. Correlated with this, we saw ransomware claims decline by 32 percent, and overall cyber insurance claims frequency decline by 14 percent in 2022.3
In contrast, based on the data, organizations across all sectors struggled with third-party risk management, for which no sector reported a “managed” profile. While this result is not surprising, it tends to validate a rising theme within the cyber industry that the risk introduced across a company’s supply chain is complex, and the deepening interconnection across technology stacks exponentially increases third-party risk. As a result of this heightened risk, most recently illustrated in a delivery platform data breach, we expect that many insurers will shift their focus to systemic and correlated risk exposure and impact this year.
This preliminary data marks the tip of the insight delivered across this report. Individual articles comprise this report. Sector analysis is delivered for the finance and insurance, healthcare, and manufacturing industries, and regional views will be published for North America, EMEA, the United Kingdom, Latin America, and Asia Pacific.
Navigating the path towards achieving cyber and ultimately, business resilience, is a significant challenge for any organization. Resilience is an essential component to help minimize risk from a financial, operational and reputational perspective. It demands a holistic view that connects proactive risk management, response preparation, and risk transfer mechanisms. Risk transfer is a fundamental component of resilience and not limited to traditional insurance placement alone. Captives and alternative capital are viable options to be considered for balance sheet protection. Whether you are steering a Fortune 100 company or leading a small to medium-sized entity facing similar risks, yet feeling underserved by the marketplace, I hope this report is a resource and tool to help inform your 2023 and beyond decision-making. Cyber resilience is a journey, best navigated in partnership and through teamwork.
Christian E. Hoffman
Aon Global Cyber Leader
References
1 Aon | E&O and Cyber Market Review | Midyear 2022. Midyear 2021 Errors & Omissions | Cyber Insurance Snapshot (aon.com)
2 See the ‘Methodology‘ article within Aon’s 2023 Cyber Resilience Report
3 Source: Risk Based Security, analysis by Aon. Data as of 1/3/2023
