How to prepare for cyber risk growing challenge

A positive outlook for the global economy shouldn’t engender complacency. As described in the Global Risks Report 2018 , the rapidly shifting global risks landscape presents a challenging operating and investment environment for businesses.

The pace of change has been increasing, characterized by rapid technological advances, seismic shifts in the geopolitical landscape and growing sources of social instability. The broad range of potential shocks that could emerge in this context demands a strategy that puts a premium on resilience.

The average time companies spend in the S&P 500 index has already decreased from approximately 60 years in the 1950s to 12 years today. The velocity of change in the current environment, creating both new opportunities and new threats, will likely drive down this figure even further.

One place where many of these issues come together is cyber-risk. Cyberattacks are perceived as the global risk of highest concern to business leaders in advanced economies. Cyber is also viewed by the wider risk community as the risk most likely to intensify in 2018, according to the risk perception survey that underpins the Global Risks Report .Exposure to risks from cyber is growing as firms become more dependent on technology. The explosive growth of interconnected devices expands the size of the surface open to cyberattack for organizations — and the number of interconnected devices in the world is expected to jump from 8.4 billion today to 20 billion in 2020. Increased use of artificial intelligence in business processes also heightens exposure to cyber-risks.

At the same time, geopolitical friction is contributing to a surge in the scale and sophistication of cyberattacks, particularly from well-resourced efforts with state backing. Firms, large ones in particular, need to anticipate attacker objectives that range from theft and business interruption to extortion, economic espionage, reputational damage and the infiltration of critical infrastructure and services. This highly diverse and very active set of adversaries makes cyber a very challenging risk to manage.

Awareness of this challenge is growing and investment in cyber-risk management is increasing. However, cyber is still under-resourced in comparison to the potential scale of the threat, a view that’s even more compelling when considered in the context of a more familiar issue — natural catastrophes.
Analysis suggests that the takedown of a single cloud provider could cause $50 billion to $120 billion of economic damage — a loss somewhere between Hurricane Sandy and Hurricane Katrina. And while it’s not exactly apples to apples, the annual economic cost of cybercrime is now estimated at north of $1 trillion, a multiple of 2017’s record-year aggregate cost of approximately $300 billion from natural disasters.

Although cyber-risk management is improving, business and governments need to invest far more in resilience efforts to prevent the same “protection gap” between economic and insured losses that we see for natural catastrophes.

The supportive infrastructure to manage and mitigate cyber-risk is not nearly at the same scale as the one in place for natural catastrophes. National cyber agencies, although expanding, don’t have the same capacity as the public and voluntary sector agencies ready to respond to natural disasters — such as FEMA in the US. Additionally, international protocols for sharing intelligence and mitigating impact, curbing malicious endeavours and forestalling escalation and retaliation are only starting to emerge — and are only endorsed by few countries at the moment, with no sanctions for non-compliance.