Evolving nature of cyber threat means historical data of limited use: CyberCube and Guy Carp

The pace of change in cyber risks means a forward-looking approach is essential, as historical data has limited relevance.

“You can’t just look at the rear-view mirror to understand this risk, you need to come up with new approaches,” Pascal Millaire, chief executive of CyberCube, told a press conference at the Monte Carlo Rendez-Vous.

“How can insurers and reinsurers gain access to a forward-looking view of risk? It’s certainly not by looking at historical data alone.”

Millaire said hard data could be helpful, but he pointed to the value of experts in predicting what events will impact insurers and reinsurers over the next 12 months.

Another important factor, he said, was thread intelligence, which includes an understanding of the perpetrators of cyber attacks. He stressed the importance of combining the various approaches, although the methodologies would sometimes come up with very different results.

CyberCube and Guy Carpenter recently published the findings of a report that analysed 23 catastrophe loss scenarios, ranging from attacks on critical infrastructure to breaches affecting the cloud environment.

The report said the biggest potential loss value generator was widespread data loss from a leading operating system provider, estimating the loss for this at $23.8 billion. However, it added that the likelihood of this occurring was the lowest of the scenarios it had examined, as it was likely to be less frequent than once in 300 years.

The next biggest loss, at $22.2 billion, was from large-scale data loss from a cloud service provider.

“Ransomware will continue to be significant,” Mike Rogers, a director of CyberCube, told the briefing.

“You’ve seen ransomware mostly targeting data. One of the things that worries me is ransomware as a tool attacking continuity of business.”

Rogers joined CyberCube last year after a 37-year career in the military. He served as director of the National Security Agency and commander of the US Cyber Command.