Despite a history stretching back more than a quarter century, cyber insurance continues to evolve. Frequently, the cyber insurance industry experiences rapid changes, impacting everything from underwriting to coverage to regulatory influence.

With all the big cyber events of 2022, Lockton Affinity and CyberLock Defense see more change on the horizon for the cyber insurance market. Here are our six cyber insurance predictions for 2023 and beyond, plus our tips on how your organization can stay ahead of the curve.

Cyber Insurance Predictions for the Coming Year

1. Insurers Will Focus on Third-Party Risks

In 2023, most businesses depend on some form of supplier, vendor, contractor or other third-party service provider. Cyber criminals know this and look for the weakest link in that supply chain. According to research from Blackberry, four in five IT security professionals were aware of a vulnerability or attack in their software supply chain in the last 12 months. What’s important to realize is that while you may be able to outsource certain services rendered, you can’t as easily outsource the risk and liability for those services.

Here’s what can happen:

• If a third party experiences a cyber incident, organizations that utilize that vendor will likely face the consequences.
• The impact of such a breach or attack can be fiscally, operationally, reputationally and contractually significant.
• Data shared between your firm and external suppliers, vendors, contractors or service providers could be exposed.
• Your internal operations could also be affected by malware and ransomware threats that originate from the vendor.

CyberLock Defense predicts that third-party vendor risks and how businesses act to mitigate those risks will be a significant focus for insurers over the coming year. Here are three things you can do:

• Implement solutions to identify, mitigate and monitor your third-party vendor exposure from both a technology and contractual standpoint.
• Be aware that threat actors across the world are seeking new ways to target supply chains knowing the disruptions it will cause.
• Make sure to review your policy’s response to third-party exposure, checking for sub-limits, coverage restrictions and coverage exclusions.

2. Businesses Will Face Increased Cloud and API Exposures

Cloud computing is the go-to solution for backups, analytics and software development. Many such services use Application Programming Interfaces (APIs), which make it easier for computers to exchange data and information quickly. However, these cloud and API technologies also open new doors for hackers.

Here’s what can happen:

• Insecure APIs can be compromised and lead to more opportunities for bad actors.
• Sensitive data is the main target, meaning that if you lose access, it’s highly disruptive.
• Both your business and client data could be held for ransom or exposed on the dark web.
• Account hijacking is also possible, allowing a hacker to intrude further into your system and data.
• In some cases, hackers may recruit insiders at your organization to assist in their cyber crime.

CyberLock Defense predicts that cloud and API exposures will increase in the next year, requiring a response from businesses and their insurers. Here are two things you can do:

• Understand how your business uses these technologies and do your due diligence with their providers, being sure to push for robust contract protections.
• Ensure that your cyber insurance coverage is not restricted with respect to events arising from cloud service provider events.

3. Inflation Will Have an Impact on Risk Management

Inflation is having an impact on everything these days, including cybersecurity. Despite the need, the economic environment is likely to impact the allocation of cybersecurity spending, which may also impact cyber event and cyber insurance claim costs.

Here’s what can happen:

• A reduction in allocation or lack of new investment in cybersecurity can put a business’s operations, assets and reputation at risk.
• With a significant cyber event, regulator and insurer scrutiny is likely to follow, creating additional challenges.
• A non-investment decision due to expense is risky when it comes to mounting a Business Judgement Rule defense.

CyberLock Defense predicts that insurers are likely to have an increased focus on how an organization approaches cybersecurity investment from both a cyber insurance and directors and officers liability perspective. Here are three things you can do:

• Realize that your CISOs, Heads of Security and other key leaders may face some tough decisions in 2023.
• The continuing engagement of CISOs, CEOs and others in executive risk roles will be key to forming an overall risk plan.
• Remember that the right cyber insurance is an essential part of a holistic approach to cyber risk management.

4. Directors and Officers Will Face Increased Risk

A significant cyber incident can impact more than operations. Clients and customers as well as other business partners can also be affected. While a hacked business entity is often scrutinized, individual directors, officers and C-suite executives could also be held personally liable. Expanding regulation may further increase the risk.

Here’s what can happen:

• Fines and penalties are likely if reasonable steps are not taken to mitigate risks.
• Class actions and criminal prosecutions may result from a lack of due diligence.
• Reputational harm is another potential consequence of failing to prioritize cybersecurity.
• Cyber events also have the potential to escalate to loss of revenue and share price decline.

CyberLock Defense predicts that decision-makers will continue to face increasing scrutiny from consumers, regulators, shareholders and business partners over the coming year. Here are three things you can do:

• Consider what methods are available for collating and holding data and de-identification.
• Realize that many stakeholders today have high expectations for organizational cybersecurity.
• Look for ways to bridge the gap between boards and CISOs and strengthen cybersecurity.

5. AI Will Play a Larger Role

With innovations like ChatGPT, artificial intelligence (AI) is now playing a more prominent role than ever. Such AI tools can respond to complex questions and save businesses time and money. However, the same tools can be used by threat actors to increase the effectiveness of a hack attempt. If given access to sensitive information and relied on for decision-making abilities, the risk of AI increases.

Here’s what can happen:

• AI can help businesses by analyzing and detecting patterns that indicate a threat and shutting down infected systems or quarantining malicious files.
• Threat actors can also use AI, launching mature and effective cyber attacks such as phishing and AI-based malware designed to avoid detection.
• The use of AI for data analytics and other purposes should be monitored to make sure it’s in compliance with applicable regulations.

CyberLock Defense predicts that businesses will continue to face opportunities and risks as they incorporate AI into their operations in 2023 and beyond. Here are three things you can do:

• Involve the board in decisions concerning the adoption of AI techniques that may impact the data privacy of customers, clients, employees and other stakeholders.
• Explore all your options to protect systems from malicious AI, including use of best practices such as data encryption and system segmentation.
• Give careful consideration to the benefits and exposures of AI and make sure to address both appropriately in coordination with your insurer.

6. Cybersecurity Standards Will Be Tightened

Much of the risk of business technology is managed with the broad adoption and implementation of cybersecurity standards. However, cybersecurity standards have shifted. Personal passwords and multi-factor authentication are now less secure than they used to be. New hacking techniques are also having more success finding unpatched vulnerabilities and effective phishing messaging.

Here’s what can happen:

• Personal passwords saved in web browsers are vulnerable to a hack.
• Facial recognition tech can be hacked to accomplish identity fraud.
• Unpatched software systems can be exploited to gain system access.
• Improved phishing and social engineering scams can deliver malicious files.

CyberLock Defense predicts that the cybersecurity minimum standards businesses have grown comfortable with will be tightened to account for the increased risks in the coming year. Here are four things you can do:

• Focus on training and awareness to keep your organization resilient, since human error remains one of the biggest cyber risks.
• Patch maintenance is key to ensure your systems have critical updates, but frequent patch stress-testing should also be done.
• Automated vulnerability scanning can help identify other security flaws that could be exploited by hackers.
• Be aware that the minimum standards expected by the cyber insurance market will likely be higher than industry standards.

Taking the Guesswork out of the Future

The future is always uncertain, and uncertainty is inherently risky. But taking action on your cybersecurity now can help minimize the risks you’ll face in 2023 and beyond.

The right cyber insurance plays an important role in this strategy. With CyberLock Defense, you can get comprehensive coverage at competitive rates. Coverage can help defend your business against a wide variety of cyber risks, covering costs related to cyber attacks, privacy breach notification expenses, litigation, loss of income and regulatory fines and penalties.

To learn more, visit CyberLockDefense.com.