Cyber risk: How does cyber events become so costly?

The talk examines why cyber incidents become so expensive, using incident and claims data gathered by an insurance broker. Sources include public breach disclosures, regulatory filings and a private claims dataset covering roughly 2017 to 2023. The data leans toward US organizations, and recent years are incomplete because reporting lags. Incident counts climb around 2020, and the industries most affected shift over time, with healthcare, financial services and public administration appearing often.

The middle section breaks costs into categories. Privacy breaches bring legal counsel, forensics, notification and call-center work, plus regulatory fines that can be large even without an attack, since compliance failures drive many GDPR penalties. Business interruption is often underestimated: lost income, extra expenses such as temporary staff and cloud capacity, and long recovery when blueprints or test records are destroyed. For ransomware, the payment is only part of the bill. In one sample of claims, payments and business interruption each made up about 30 percent of costs. Technology errors and omissions and fraud losses add further exposure.

Prevention comes last. Correlating self-assessment answers with claims, the speaker found that security configuration management, account monitoring and multifactor authentication carried the strongest signal, and that partial rollout of those controls gave weaker results. Industries with low adoption showed higher claim rates. The practical takeaway is to focus on the few controls that most reduce claim frequency, since insurers often require them before offering coverage.