How cyberattacks are reshaping business risk
From boardrooms to boiler rooms and beyond, cyber criminals are now a mainstream threat. How can insurers and brokers educate and evolve to ensure that clients are properly protected from this new wave of digi-crime?
Cyber-attacks have become one of the most significant operational risks facing businesses today. Once confined to the concerns of IT departments, cybersecurity has now risen to the top of corporate risk registers, with incidents ranging from ransomware to data breaches having the power to shut down operations, destroy customer trust and invite costly legal claims.
A shifting risk landscape
According to the UK Government’s 2024 Cyber Security Breaches Survey, 70% of medium-sized businesses and 74% of large businesses reported experiencing a cyber breach or attack in the past 12 months.
The frequency, severity and financial fallout of these attacks is rising, with ransom demands reaching seven-figure sums and the regulatory penalties for data loss becoming ever more punitive.
What’s more, the scope of risk is broadening. Supply chain vulnerabilities, remote working practices and the growth of AI-driven attacks are exposing new weaknesses in corporate defences. Even businesses with strong IT hygiene are finding themselves liable through third-party failures – or at the mercy sophisticated and relentless cyber gangs.
Just ask M&S who faced over a month without online operations or invaluable customer insights gained from Sparks. The cyber-attack will hit their profits by around £300m – that’s a third of its profit – a sum that will only partly be covered by any insurance pay-out.
Warning: check the small print
There is a widespread misconception that commercial liability policies include cyber cover. Most don’t. Ours doesn’t. We leave cyber protection to the cyber specialists while we focus on protecting other sector specific risks.
But that doesn’t mean that cyber-crime isn’t on our radar.
All commercial insurers still need to be aware of the complex and emerging implications of cyber-attacks and the far-reaching impact on business protection and potential lawsuits.
Although cyber is a niche policy area, it is a growing one that is reshaping the insurance sector and bringing business interruption coverage into the spotlight.
Businesses without a dedicated cyber policy could find themselves dangerously underinsured or entangled in complex disputes over policy response – and payout. Or lack of it.
Blurring the lines between liability and cyber
As digital threats increasingly impact areas traditionally covered under other lines – such as professional indemnity, directors’ and officers’ (D&O) liability and general commercial liability – the lines are blurring.
For example, if a ransomware attack leads to a failure to deliver contracted services, the business may face litigation for breach of contract or negligence – triggering PI or general liability claims. Similarly, directors may be held accountable for failures in cyber governance or risk oversight, putting D&O policies under pressure.
This convergence presents challenges for brokers and underwriters alike. Clarity around exclusions limits and how different policies interact in the event of a cyber-related claim is now more critical than ever before.
Implications for brokers
For brokers and MGAs, the evolving threat landscape presents an opportunity to adopt a more consultative role. Cyber requires a deep understanding of a client’s digital operations, supply chains, regulatory exposure and risk tolerance.
Where clients wrongly assume their general liability or PI policy will respond to cyber claims, brokers must provide education – and where appropriate guide them towards solutions that close the gap.
Fighting fraud
The convergence of cyber risk and online fraud with broader liability exposure will continue to accelerate. With generative AI enabling more sophisticated phishing and fraud attempts, insurers must remain agile and alert.
For the insurance industry, this represents an opportunity: to lead with expertise, drive resilience and help clients navigate the increasingly complex cyber threatscape and how it impacts on all aspects of business liability.
The message is clear: check your policy wording. Read the small print. Examine the exclusions. Study the T&Cs. Ask your insurer. Double check with your broker. It could be time well spent so your business isn’t exposed to cybercrime underinsurance.
