APAC: Regulators and Companies Respond as Ransomware and Reputation Risks Intensify

Cyber risk emerged as one of the top five risks for business leaders in the Asia Pacific (APAC) region for the first time, as measured by Aon’s 2021 Global Risk Management survey (Aon’s Survey)1. It also ranked as the most critical future risk topic over the next five years in Aon’s Survey. Together, this helps to represent the shifting threat landscape in the region and the C-suite’s perception that cyber presents a significant business operations risk. Results from Aon’s Cyber Quotient (CyQu)2 assessment also serves to reinforce that managing cyber risk is strategically important to top management, as clients reported that their overall cyber maturity improved from “basic” to “managed” (per CyQu scoring methodology 2.01 to 2.68)3 across the years 2020 to 2022.

There appear to be three chief drivers of risk in the region. Geopolitical tensions elevated the importance of managing supply chain risks, including cyber-attacks on critical dependencies in supply networks; cyber vulnerabilities in digital supply chains; and the exfiltration of intellectual property  from strategic suppliers. Supply chain risk is of particular concern for strategically important industries located at regional hotspots4. In response to this risk, CyQu data showed that supply chain controls improved from the lowest CyQu maturity level, ”initial,” to a “managed” state between 2020 and 20225.

Regulatory6,7,8 and reputational9,10 risk drivers also intensified across the region. The prevalence of reputational crises following cyber incidents has intensified demands for improved corporate governance and risk leaders to play a more active role in cyber risk management. Recent high-profile data breaches in Australia and Asia11,12,13, impacted financial performance, attracted adverse regulatory scrutiny, eroded shareholder value and exposed corporate officers14. In response, a variety of industry, privacy, and consumer protection regulators in Singapore, Thailand, China, Vietnam, Australia and Indonesia have signaled that they will increase data protection review and enforcement15. In response, governance of cyber risk and data protection controls appear to have improved across the region, with clients reporting growth from a “basic” to a “managed” level between 2020 and 2022. This change helps to signify a deeper focus on improving risk oversight and addressing privacy topics for business leaders.

As with other regions, organizations and the APAC insurance market perceived ransomware as the primary cyber threat16. Companies across revenue bands and sectors reported that core control domains responsible for managing cyber-triggered operational disruption — e.g., access management, business resilience and endpoint systems — improved markedly from “basic” to “managed” levels. This advancement tracks with the 40 percent decline in ransomware events in APAC for 2022 (year-over-year)17.

Industries in Perspective

This year, we examined three industries in more depth: manufacturing, finance and insurance, and healthcare. Companies across all three sectors reported an overall cyber posture of “managed” in 2022. The finance and insurance sector demonstrated the most significant gain since 2020, moving to “managed” from the lowest score, or “initial” (<1 on the CyQu scale) readiness.

Business resilience remained at a basic level for manufacturing companies. However, clients reported that business continuity management (BCM) improved. Organizations still need to manage the operational risks sufficiently, while remote working topics and third-party risk management remain particularly acute vulnerabilities due to the inherent challenges of protecting distributed operational technology  networks, manufacturing services and workforces18.

In contrast, finance and insurance companies reported “advanced” maturity in third-party risk management, reflecting the region’s prudent regulatory focus on this topic. Risk management improved to “managed,” demonstrating growing alignment between security teams and traditional banking and financial industry operational risk and insurable risk frameworks19.

Healthcare companies reported “advanced” physical security. However, application security remains at an “initial” stage and presents a significant vulnerability given the growth of connected medical devices and the use of more advanced Internet of Things in the healthcare industry20.

Now What? Suggested Actions for Asia Pacific Leaders

1. Update and strengthen governance frameworks and risk management strategies concerning cyber risk. Privacy regulations across the region are adapting to new data breach threats and emerging technologies, such as artificial intelligence21. As such, it is paramount that senior business leaders properly evidence the adoption of good governance and risk management of cyber threats per best practices and regulatory requirements. This action will not only improve the business’s risk profile but may serve to mitigate potential regulatory and shareholder actions in the event of a breach.
2. Keep vigilant on ransomware threats. While companies in the region have performed well in combating ransomware threats, global trends indicate that ransomware attacks are on the increase (+38 percent Q1 2023 over Q4 2022)22. Continue to focus on security controls that mitigate ransomware attacks, particularly those controls that form a critical part of the insurance underwriting process.
3. Remain forward-looking in the calibration of cyber risk strategies. A myriad of drivers will better shape the outlook for cyber risk in the Asia Pacific region, including ongoing and escalating geopolitical tensions, challenges associated with the reconfiguring of supply chains, and the adoption of emerging technologies (AI, biometrics, smart digital-physical tech in manufacturing and the built environment). Frequently stress test cyber risk strategies against a broad set of complex scenarios to help ensure you are keeping pace with the demands of these megatrends. Include frequent scenario testing of incident response, BCM and crisis management strategies. Extend this by testing insurance limits and policy coverages against similarly complex cyber risk events to help identify silent cyber exposures and risk opportunities to better protect the balance sheet and safeguard shareholder value.