Third-party risk is biggest cybersecurity blind spot
Third-party risk has emerged as a dominant driver of cyber insurance claims and material losses in 2024, according to new data from leading cyber risk solutions company Resilience.
Cyber insurance claims data shows that third-party risk, including ransomware and outages affecting vendors, accounted for 31 percent of all claims in 2024. Even more startling, third-party risk led to claims with incurred losses for the first time ever, making up nearly a quarter (23 percent) of incurred claims in 2024 (compared to none in 2023).
"Third-party risk isn't only making headlines -- it's driving unprecedented losses. While this risk is often invisible until it's too late, it's now clear that the industry has reached a tipping point," says Vishaal Hariprasad, co-founder and CEO of Resilience. "Businesses can no longer afford to consider their partners' vulnerabilities as siloed from their own. By understanding this new reality of shared risk, enterprises can make smarter business decisions and meaningfully mitigate material loss."
Among other findings 43 percent of incurred claims involved first-party ransomware incidents and 18 percent of incurred claims involved ransomware attacks targeting vendors. Taken together 61 percent of all claims with losses were related to ransomware.
Transfer fraud rose in popularity too, increasing from 14 percent of incurred claims by frequency in 2023 to 18 percent in 2024.
Interestingly phishing proved less effective in causing financial loss. In 2024, phishing led to just nine percent of incurred claims, a significant drop from 2023 in which it accounted for 20 percent.
"As a company that provides both cyber risk quantification software and cyber insurance, we have unique insight into how companies are mitigating financial fallout from today's cybersecurity challenges," says Jeremy Gittler, global head of claims at Resilience. "Even in the face of an evolving threat landscape over the past year, enterprises are continuing to make major improvements in how they manage cyber risk and prevent material loss."
You can see the full report on the Resilience site.
Image credit: Weerapat Wattanapichayakul/dreamstime.com