Key Insights from Cybersecurity Claims and Market Trends in 2023-2024

• 0:02 Introduction: Katherine Lyall, Head of Cyber Incident Response and Claims at Tokyo Marine HCC, discusses cybersecurity claims trends, market analysis, and predictions.
• 0:59 Market Trends: The cyber insurance market saw growth in 2023, primarily due to premium increases. However, the influx of new buyers is stagnating.
• 2:11 Data Sources: The data presented comes from diverse sources, including the FBI (IC3 reports), national insurance statistics, and forensic providers.
• 2:48 Top Crime Types: FBI data indicates that phishing/spoofing is the most common cybercrime, followed by extortion (ransomware) and business email compromise (BEC).
• 3:53 Most Affected States: California, Texas, and Florida experience the highest number of cybercrimes, likely due to their large populations and numerous corporations.
• 4:24 Attack Vectors in 2023:
  • Phishing was the top attack vector due to its ease of execution and effectiveness.
  • Unsecured Remote Desktop Protocol (RDP) was the second most common, offering direct access to systems.
  • VPNs without Multi-Factor Authentication (MFA) were third, with vulnerabilities being rapidly exploited.
• 7:17 Attack Vectors in 2024:
  • Phishing remains the top attack vector.
  • VPNs without MFA have risen to the second position due to a larger attack surface and numerous vulnerabilities.
• 7:54 MFA Adoption: Despite its importance, MFA adoption has stagnated, with 45% of corporations not implementing it in 2024.
• 10:09 Event Types:
  • 10:22 Ransomware: Ransomware attacks have returned aggressively, with high-profile cases like MGM, Caesars, and Change Healthcare. Smaller threat actor groups have led to a decrease in the percentage of entities paying ransoms, but double extortion (data exfiltration and encryption) is becoming the norm.
  • 17:01 Business Email Compromise (BEC): BEC remains a significant threat, with severity increasing year-over-year. Attackers are staying in systems longer, leading to substantial financial losses.
  • 20:55 Data Breach: Data breaches have reached record highs due to increased exfiltration and changing data privacy laws. The cost of data breaches is rising, driven by regulatory changes and third-party lawsuits.
  • 23:02 Supply Chain Hack: The Change Healthcare breach exemplifies the growing threat of supply chain attacks, which can have cascading effects on dependent systems.
• 26:13 Outlook for 2024-2025:
  • Website tracking litigation will continue to be a significant legal trend.
  • VPNs without MFA will be a primary attack vector.
  • Cyber extortion will become more aggressive, with threats of physical harm.
  • Law enforcement is becoming more involved and effective in combating cybercrime.
  • AI will increasingly be used by threat actors for reconnaissance and attack development.
• 32:27 Recommendations:
  • Implement MFA, especially on VPNs.
  • Train employees to recognize and respond to phishing and BEC attempts.
  • Act quickly in the event of a cyber incident, contacting law enforcement and insurance carriers.
• 33:20 Sanctions: The US is keeping up with sanctions against threat actor groups, leading to a shift in attacks towards non-sanctioned countries.
• 34:09 MFA Effectiveness: While no security measure is foolproof, MFA is effective in deterring less sophisticated attacks.
• 35:20 Brute Force vs. Stolen Credentials: Stolen credentials are more commonly used in VPN attacks, but brute force attacks are increasing due to exploits.
• 35:53 War Exclusion in Cyber Insurance: Extortion claims are generally not excluded under war clauses.
• 36:57 Dependent System Failure: There are limited proactive efforts to identify and mitigate risks associated with critical infrastructure dependencies.
• 37:58 Industry-Specific Trends: Healthcare, airlines, and non-profits are particularly lagging in MFA adoption due to outdated technology and cost constraints.
• 38:38 MFA Default Settings: Google's approach of enabling MFA by default is more effective than requiring users to opt-in, as seen with Microsoft.
• 39:02 Conclusion: The cybersecurity landscape is continuously evolving, requiring organizations to adapt and implement robust security measures to mitigate risks.