Navigating the Changing Cyber Landscape: Trends, Costs, and Risk Mitigation Strategies

The speaker, who builds cyber risk models for an insurance broker, frames the talk around how cyber losses and claims have changed since 2017. The data drew on loss databases, public company filings, and the broker's own claims and reinsurance portfolios. The record losses of 2023 were attributed partly to zero-day exploitation and widespread events such as the Microsoft Exchange and CrowdStrike incidents.

The middle of the talk covered costs and timelines. Breach response costs were around a million dollars for a typical event, with legal and data recovery costs carrying long tails, and analysis often took more than a month. Privacy litigation was rising, including pixel tracking and biometric-law cases. Ransomware claims grew in frequency, while the share of victims paying fell to roughly a fifth in 2023 by the speaker's data. Business interruption from third-party and software failures was highlighted, since policy wording decides whether system or contingent outages are covered.

For practitioners, the advice was to involve the insurer early, use counsel and specialist negotiators before any payment, prepare incident checklists in advance, and reduce stored data and supplier exposure. Questionnaire analysis suggested that weak directory configuration correlated with claims, and a short list of baseline controls was presented as a threshold for obtaining coverage.