Increasing Complexity and Frequency of Cyber Events: Trends, Costs, and Risk Mitigation Strategies

The session comes from a cyber insurance broker's perspective, drawing on annual insurance applications, client claims, reinsurance portfolio data and public sources. The speaker reviews where cyber losses are heading: event frequency is up, the share of extortion and ransomware events has slipped, and the share of companies paying ransoms dropped to about 18 percent. Wire fraud tied to business email compromise is climbing sharply.

Privacy regulation gets the most attention. The speaker walks through state-level laws such as CIPA and BIPA, website tracking and SDK-related litigation, and large fines and settlements. Business interruption is another major cost driver, illustrated by the CrowdStrike and healthcare outages, with claim adjustment often running a year or more because of disputes over proof of loss and forensic accounting. Third-party and supplier dependencies are flagged as a growing source of disruption.

For mitigation, the speaker points to controls correlated with lower breach likelihood, including phishing-resistant MFA, endpoint detection coverage, and privileged access management. Faster claims handling comes from pre-approved forensic accountants and tabletop exercises. Data minimization, classifying and deleting unneeded data, and privacy-enhancing techniques such as differential privacy and federated learning are presented as ways to reduce exposure.