New Year, New Threats: 5 Cyber Mitigation Techniques to Review in 2024

With the cost of 2023 cybercrime estimated at $8 trillion worldwide, it’s high time to review the cybersecurity measures that actually work.

By: Autumn Demberger | March 25, 2024

Topics: Cyber | Cyber Risks

Cybercrime is not going away.

If anything, it’s becoming more and more prominent, to the point that even schoolkids are learning how to thwart bad actors alongside their ABCs.

Just hearing the numbers is scary: Nationwide notes that Cybersecurity Ventures estimates that the world spent upwards of $8 trillion on cyber threats in 2023 alone and that the cost of cybercriminal activity will reach $10.5 trillion by the end of 2025 — less than two years from now.

For the savvy risk manager looking to boost their cybersecurity efforts, having a cyber policy in hand can inspire a sigh of relief. But policies are beholden to the swings of the market, and with something as prevalent, volatile and relatively new as cyber, that can be challenging.

“One of the major ways to help combat the challenges of the market is by improving a company’s risk profile and equipping it with pre-breach strategies,” said Tim Nunziata, vice president and head of cyber risk, Nationwide.

“These are loss-mitigation strategies that can be offered through the primary carrier that are constantly evolving alongside the cyber landscape.”

Keeping up-to-date with those best strategies is key. Not only can they help protect against attacks, but they can also be a preventative measure that any risk manager is sure to want in their cyber risk tool kit.

It’s fundamental to work with a carrier that’s knowledgeable on these different loss-mitigation strategies and can connect a business to the right vendors to bolster its security efforts.

Below are five techniques that are proven to help stop cyberattacks in their tracks.

1) Multifactor Authentication

Tim Nunziata, vice president and head of cyber risk, Nationwide

Multifactor authentication, commonly referred to as MFA, requires all users within a system to provide a combination of two or more credentials that help confirm their identity before gaining access.

That could mean providing a password and also answering a security question, or it could mean logging in and then entering a code sent to their email or phone.

“Having that extra layer to log on can help prevent cybercriminals from getting into the system,” Nunziata explained.

Identity-based attacks — wherein cybercriminals steal someone’s personal login credentials and use that information to impersonate them across a business’s network — are on the rise. According to Crowdstrike’s 2023 Global Threat Report, 80% of cyberattacks leveraged identity-based techniques to compromise credentials during the previous year.

Having multiple steps to log in can thwart bad actors before they have a chance to get into the system.

2) Endpoint Detection and Response

EDR (endpoint detection and response) solutions are a great tool to prevent a breach.

Designed to provide continuous monitoring capabilities and enhance visibility across a network, EDR solutions include data search and investigation triage, contextualized threat hunting, and malicious activity detection, validation and containment.

These security tools actively analyze events stemming from laptops, desktop computers, mobile devices, servers, and even IoT and cloud services. If suspicious activity is detected, EDR solutions aim to shorten response time and get the cyber team activated before the damage is done.

“EDR provides the company with real-time monitoring of activity and reports on any unusual activity. These improved data analytics enable front-line risk evaluation and response to save time and money in resolving security issues.”

3) Patch Management

Any business using technology will have gone through some iteration of a software update. In the cyber world, these updates are called patches, and one of the best ways to prevent attack is through patch management.

“From the insured standpoint, the patching on their systems should be a constant effort. Even with all the understanding around known vulnerabilities, there are so many unknowns still out there, and as we get a better understanding of loss drivers, vulnerabilities and exposures, it’s important to implement patches and control what can be controlled,” Nunziata said.

Patches are implemented to fix bugs in the system, reduce digital vulnerabilities and improve performance.

It’s key to involve all the appropriate stakeholders in the process as well, including senior leadership, IT experts, insurers and their vendors, and even automated tools designed to keep networks up-to-date. And these patches should be constant.

“It’s those notifications on your device that say your computer is going to restart in four hours,” explained Nunziata. “This constant system management can be provided through the insurer as well, whether that’s inside-out or outside-in, to help identify vulnerabilities and patch them.”

4) End-of-Life Software Management

Another reality in the technology world is that old tech can become obsolete. When software reaches the end of its life, manufacturers will often discontinue technical support and upgrades for it.

End-of-life software management is paramount in protecting a company from the exploitation of vulnerable outdated technology at the hands of bad actors.

“The business should be asking itself on an annual basis about any services or software that may be winding down that might need action or upgrades,” said Nunziata.

As a loss-mitigation service, insureds will want to invest in a life cycle management plan that outlines protocols for phasing outdated or unsupported software out of their network. These plans should also help in introducing new technologies and planning for replacements when necessary.

This step will keep the entire network from having the weak spots that cybercriminals find ripe for infiltration.

5) Employee Education and Awareness

“Cyber protection review is about employee awareness as much as anything. The lion’s share of incidents is triggered by employee mistakes or oversight,” Nunziata shared.

“Understanding that these threats are out there and why one shouldn’t just click on links or reply without thought is important for cyber defenses.”

Employees are often called the first line of defense against cyberattacks — and for good reason: The World Economic Forum reports that 95% of cyberattacks stem from human error. Making employees aware of threats and how to detect them can go a long way.

“Training on what an inappropriate email looks like and teaching employees to take a step back and think are key,” said Nunziata. &

Autumn Demberger is a freelance writer and can be reached at [email protected].

Sustainability in All Markets

David Guild, Head of Financial Lines, MSIG USA

When looking for a financial lines insurance partner, sustainability should be top of mind. Knowing that an insurer can provide solutions in a hard market alongside the soft will not only provide peace of mind but also help build resilience.

“Leaders should have the room to concentrate on their vision for the company and what it can achieve — not be burdened by potential risks that keep them awake at night. “Your insurance partners should be able to understand the trials and tribulations of running a business, to respect that there is no single right answer to most challenges, and be prepared to assist wherever, whenever issues may arise,” Guild said.

Sustainability is proven in an insurer’s ability to come through on the promises it makes. For example, MSIG USA’s approach has earned it an A+ rating, proof that its team can back the promises it makes and see them through to completion. “We are confident in our ability to serve your insurance needs, on a global scale,” Guild added.

“Everything we speak of revolves around the credibility of our platform, which is reflected in our A+ rating, a 350-year legacy within our family of companies, and our experienced team here in the U.S.”

An Emphasis on Company and Culture

Successful partnerships are built on a solid relationship between insurer and client.

At MSIG USA, “we aim to be a stable and sustainable presence for our clients,” Guild said. “The value of long-term relationships is at the core of what MSIG USA is all about. Our underwriters deeply appreciate the importance of these connections.

“We believe that building and maintaining strong, long-lasting relationships with our customers is essential to navigating the inevitable fluctuations of the insurance market. We are confident in our abilities, and in yours.” he added.

Company culture, as Guild mentioned, is more than an internal commitment; it’s something that can also drive business relationships.

For insurance partners, analyzing and aligning with their clients’ culture helps to solidify partnerships, as well as open the lines of communication and understanding.

“Variables will change, oftentimes rapidly. From our view, what matters is the culture of that company when responding to change. It’s about trusting their character rather than just the policies and procedures in place,” Guild said.

A Source of Truth and Clear Communication

Effective communication goes a long way in clearly understanding an insured’s business and future potential. This allows for sustainable partners to develop coverage that fits and to work closely with their Claims team to understand the partnership in context.

With the amount of data available today, and the number of ways information can quickly be disseminated through different medium, a good insurance partner knows that companies must be the single source of truth for their stakeholders.

“Quarterly and annual earnings calls provide a platform to discuss financial results and respond to investor questions. Investor presentations offer a more comprehensive overview of the company’s strategy, performance and outlook,” Guild explained.

We will look at what analysts and other third parties think about the information provided to try to glean what the investor base will think and how they will act. But ultimately, it is what the company says, and the way they say it, that we will assist in defending, if need be, and so we make sure to listen and learn from the company leadership.

Bringing These Qualities Under One Roof

Leaders want to know that, at the end of the day, their business is a priority for their partners.

Clear communication, a strong relationship and emphasis on sustainability are just the start. Their insurance partners should strive to understand their business, identify areas of concern and craft coverage customized to meet their needs.

With an impressive 350-year legacy, MSIG USA is doing just that for its clients, utilizing its global presence to further its clients’ goals.

“The key elements of our approach are an intellectual pursuit of information, a well-honed practice of underwriting that identifies material aspects for risk assessment, and clear communication of our insights to our clients: brokers and buyers alike. We aim to provide a transparent and informed perspective on the risks we underwrite,” Guild said.

“We bring sustainable, predictable insurance capital and what we believe is best in class service philosophy, honed by working with some of the most sophisticated brokers and buyers of insurance in the world.”

To learn more, visit: https://www.msigusa.com/financial-lines/.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with MSIG USA. The editorial staff of Risk & Insurance had no role in its preparation.

MSIG North America is a member of MS&AD Insurance Group Holdings, Inc. which is the 8th largest non-life insurance group in the world by revenue. Based in Tokyo, Japan, we operate in 48 countries/regions and generated $46B in 2021 with approximately 40,000 employees globally. MSIG North America is the marketing name used to refer to MSIG Holdings (U.S.A.), Inc. (“MSIGH”), and its subsidiary companies.