Current and Emerging Cyber and E&O Risks
The following key trends are shaping the current and future cyber and E&O risk environment:
Artificial Intelligence: Advancements in artificial intelligence (AI) have helped cyber criminals automate and scale attacks, especially those involving social engineering. Even further, its use among threat actors is expected to increase in 2025. Insurers are interested in knowing how organizations are using AI to strengthen and expand their cyber security.
Global IT and Supplier Outages: 2024 witnessed several potentially catastrophic cyber events. The full financial impact of these on the global cyber insurance market remains unknown. In 2025, cyber insurers are expected to intensify their scrutiny regarding the use of supply chain vendors and cyber security platforms.
Privacy Litigation: Insurers continue to review policy language and coverage concerning wrongful or unlawful data collection. Privacy liability exposures will evolve as privacy laws are added, updated and used in enforcement activity or civil litigation. Aon has observed a rise in privacy claims related to website tracking, pixel tracking and legislation, including the Illinois Biometric Information Privacy Act (BIPA).
Ransomware: Ransomware incident frequency remains high, with the software supply chain being a recurring target for threat actors. Dependent business interruption poses a significant concern for insurers, as large vendor incidents can trigger numerous policies from a single event. Insurers are continuing to address the challenges of underwriting systemic events that could lead to aggregation issues.
Cloud Security Breaches: While cloud services have become integral to modern business operations, they also present significant cyber risks. Breaches in cloud security can lead to data loss, financial loss and reputational harm. In 2024, the number of new and unattributed cloud intrusions increased by 26 percent compared to 2023.1
IoT Device Vulnerabilities: The widespread adoption of IoT devices has created new opportunities for cyber threats. Attackers can exploit vulnerabilities in these devices to gain unauthorized access to networks and systems.