More than a third of risk professionals throughout Africa, Europe and the Middle East have experienced a material or significantly disruptive loss relating to a data breach or security exploit in the past 24 months with the average, financial impact of these incidents in the region of $2.1 million.  The most common EMEA cyber incident was an attack that caused disruption to business and IT operations.

This is according to Aon Risk Solutions in a research report undertaken during March 2015 in partnership with The Ponemon Institute, surveying 545 risk professionals across 15 countries in the EMEA.

“Within the next five years, Cisco estimates there to be 50 billion internet-connected devices in the world by 2020.  The transformation of the world’s economies from historical tangible products and manual labor services to reliance on technology and information assets is rapid and severe. Cloud computing, mobile devices, social media, big data analytics and the explosion of the Internet of Things have driven this digital transformation, and at the same time the inherent and very real risks. In conducting this report, Aon wanted to understand how organisations qualify and quantify the impact of cyber-related assets.  This particular survey is unique as it focused on the relative financial statement impact of cyber incidents compared to tangible asset vulnerabilities,” explains Kerry Curtin, Manager: Financial Institutions & Professional Risks at Aon South Africa.

Aon sponsored the report to help business get a better understanding of the relative financial statement impact of tangible property and network risk exposures, assisting organisations in allocating resources and determining the appropriate amount of risk transfer (insurance) resources needed.  All respondents in the survey were familiar with the cyber risks facing their companies.

In the context of this research, cyber risk means any risk of financial loss, disruption or damage to the reputation of an organisation from some sort of failure of its information technology systems.  Network risk exposures can broadly include breach of privacy and security of personally identifiable information, stealing an organisation’s intellectual property, confiscating online bank accounts, creating and distributing viruses on computers, posting confidential business information on the Internet, robotic malfunctions, and disrupting a country’s critical national infrastructure.

Despite the comparability of the average potential loss to information assets ($617 million) and Property, Plant & Equipment (PPE) ($648 million) the percentages of insurance coverage between respondents differs dramatically. 

The findings clearly show that information assets are either not insured or underinsured against theft or destruction based on the value, Probable Maximum Loss and likelihood of an incident occurring, even though Probable Maximum Loss could exceed $200 million. The disclosure or reporting of a material loss of PP&E and information assets also differs between respondents. Only fifty percent of respondents say their company would disclose the loss of PP&E in its financial statements as a footnote disclosure. However, 34 percent of respondents say a material loss to information assets does not require disclosure. 

Despite the serious risk, companies are reluctant to purchase cyber insurance coverage. Fifty-two percent of respondents believe their companies’ exposure to cyber risk will increase over the next 24 months. However, only 19 percent of respondents say their company has cyber insurance coverage in the first place, even though 37 percent of companies in this study experienced a material or significantly disruptive security exploit or data breach one or more times during the past two years and the average economic impact was $2.1 million.

“In today’s technology-driven environment, enterprise risk management issues are rapidly growing with the increased use of information assets and technology and present an ever-increasing exposure to business.  And yet despite this far too many organisations remain seriously underinsured in respect of cyber risks where the quantum for a catastrophic attack or exploit could exceed $200 million.  This could put many organisations out of business and devastate their brand reputations and trustworthiness in the eyes of the consumer, taking years to recover, if at all.  In this regard, consulting with a professional risk advisor is an invaluable exercise in protecting your reputation, data, clients and bottom line,” concludes Kerry.