By Lewis Nibbelin, Research Writer, Triple-I
Insurers bring considerable expertise to the cybersecurity landscape to help their commercial customers manage this growing risk, but even they are not immune to the threat. A new study from Triple-I and breach recovery company Fenix24 explores how insurers are managing cyber risk within their own operations and where gaps remain as attacks evolve.
Based on interviews with insurance industry executives across various organizational sizes and market segments, the study explains that, while most firms have invested in robust security practices, vulnerabilities persist in areas such as security testing and recovery readiness.
Though many insurers, for instance, reported maintaining immutable backups – i.e., files that cannot be altered and are thus protected from malicious action – definitions for such backups are not universally accepted, meaning standards for one company may not meet those of another. System updates to security weaknesses are similarly variable, with half of the participants indicating they deploy security patches monthly.
“Traditional compliance frameworks don’t move at the velocity of ransomware actors,” said Mark Grazman, Fenix24 CEO and co-founder, in a recent Executive Exchange with Triple-I CEO Sean Kevelighan. “When an organization gets on the phone and tells us, ‘Don’t worry, our data was immutable and therefore survived,’ there’s an 84 percent chance they’re wrong.”
While effective cyber resilience strategies will balance investments in both threat resistance and recovery, Grazman pointed out that “over 90 percent of budgets” are allocated to resistance alone, further reflecting organizations’ false sense of security in preexisting infrastructure against dynamic attacks.
“I’d liken it to, you have a fire extinguisher in the building, but you also have a fire escape,” Grazman said. “Having the focus to resist the attack does not preclude the need to make sure that, if an attack is successful, the organization can bring itself back online and keep its data.”
For large ransomware incidents as well as smaller-scale email compromises, Grazman emphasized that most attacks begin with identity hacking. Though all insurers in the report said they use corporate password vaults and require multi-factor authentication or hardware tokens for administrative accounts, several revealed they still allow less secure methods, exacerbating systemwide exposure.
Noting the convenience of such practices, Grazman encouraged organizations to “assume if the administrator can do it, so too will the threat actor.” He added, “You’ve got to make it so even your own team couldn’t delete data without a very fixed time clock.”
Grazman recommended insurers uphold security practices that meet or exceed the minimum requirements they impose on policyholders, saying, “We need our carriers to continue doing what they’re doing and lead the pack in terms of resiliency, recovery, and setting a standard for themselves and their insureds that keep us all safer.”
Consumers and government also play a role in managing cyber risks, Kevelighan said, especially as businesses become more globally interconnected. He explained that just one sophisticated attack “could potentially generate billions and billions of dollars of losses, if not trillions,” as the disruption propagates across multiple businesses along a supply chain.
While cyber insurance can help mitigate these impacts, Kevelighan noted that many remain unaware of the coverage, necessitating greater outreach to stakeholders on coverage options and benefits.
Learn More:
Cyber Claim Severity Surges as AI, Litigation Accelerate Risk
Amid Data Boom, Actuarial Analysis Belongs in the Forefront
Tech — Especially A.I. — Is Top of Mind for Global Insurance Executives
