Cyber intrusion activity globally jumped 125% in the first half of 2021 compared with the previous year, according to Accenture [1], with ransomware and extortion operations top two contributors behind this triple‑digit increase. There is little evidence that ransomware attacks show any sign of letting up. Weak cyber security, challenging conditions for law enforcement and cryptocurrencies are creating fertile ground for criminals, who continue to find lucrative rewards with little risk of prosecution.

The frequency and severity of attacks has escalated in the past two years. According to the Federal Bureau of Investigation (FBI) [2] there was a 62% increase in ransomware incidents through the first six months of 2021 in the US, which followed a 20% increase in the number of incidents for the whole of 2020 and a 225% increase in ransom demands. Globally, across 2021 ransomware attacks are estimated to cost businesses around $20bn, according to Cybersecurity Ventures [3], a total predicted to reach $265bn by 2031.

The combination of high rewards and low risk for cyber criminals means that ransomware is here to stay, at least for the foreseeable future, according to Marek Stanislawski, Global Cyber Underwriting Lead at AGCS.

“The knowledge threshold to carry out attacks is relatively low and ransomware tools are more easily accessible. Together with cryptocurrencies and the relative ease with which gangs can avoid detection and prosecution, ransomware is an area where criminals can easily thrive.”

Our increasing reliance on digitalization, the surge in remote working following Covid‑19, and IT budget constraints are just some of the reasons why IT vulnerabilities have intensified and there are now countless numbers of access points for criminals to exploit. Initial attacks are typically automated, with many cyber gangs previously limited by the human capacity required to follow up on attacks. However, that capacity has been increasing as gangs have invested in additional resources, Stanislawski notes.

“Now, there are many more malicious threat actors on the scene, while criminals are using ever more aggressive tactics to extort money,” says Stanislawski. “This has helped drive up the frequency and severity of ransomware attacks and claims in recent years.”

Losses resulting from external incidents, such as Distributed Denial of Service (DDoS) attacks and ransomware campaigns, account for the majority of the value of cyber claims (81%) analyzed by AGCS over the past six years. There has been an increase in ransomware incidents over the past two years in particular, with the number of claims rising by 50% year‑on‑year in 2020 (90). The total of ransomware claims received in the first half of 2021 is already the same as reported during the whole of 2019 (60), although this still represents a relatively small proportion of claims overall.

The ransomware pandemic of the past few years has triggered a major shift in the cyber insurance marketplace, as carriers and insureds endeavor to mitigate the rising frequency and severity of attacks and resulting cyber insurance claims. Cyber insurance rates have been rising (according to broker Marsh [5], US rates rose by over 50% in the second quarter of 2021 alone) while capacity has tightened. Underwriters are placing increasing scrutiny on the cyber security controls that are employed by organizations and pricing risks accordingly.

The role of insurance has always been to encourage good risk management and loss prevention, one that can trace its roots back hundreds of years to protecting the first factories and steam boilers. Although ransomware is still an evolving risk, insurers have been working with companies to identify the best practices and standards that can improve their security postures.

Insurers have established certain cyber underwriting criteria that helps to determine their risk appetite. “Therefore, we are able to clearly communicate our cyber risk management and security expectations. If a commercial customer can fulfil the criteria they will be in a better position when it comes to a ransomware attack and to secure insurance,” says Rishi Baviskar, Global Cyber Experts Leader, Risk Consulting, AGCS.

Three out of four companies do not meet AGCS’ requirements for cyber security. However, many customers have been working with AGCS to meet the criteria and reduce their exposure.

“This approach should encourage companies to invest in cyber security and provide Chief Information Security Officers with ammunition in discussions with their boards,” says Baviskar.