New Year, New Threats: 5 Cyber Mitigation Techniques to Review in 2024

With the cost of 2023 cybercrime estimated at $8 trillion worldwide, it’s high time to review the cybersecurity measures that actually work.

Cybercrime is not going away.

If anything, it’s becoming more and more prominent, to the point that even schoolkids are learning how to thwart bad actors alongside their ABCs.

Just hearing the numbers is scary: Nationwide notes that Cybersecurity Ventures estimates that the world spent upwards of $8 trillion on cyber threats in 2023 alone and that the cost of cybercriminal activity will reach $10.5 trillion by the end of 2025 — less than two years from now.

For the savvy risk manager looking to boost their cybersecurity efforts, having a cyber policy in hand can inspire a sigh of relief. But policies are beholden to the swings of the market, and with something as prevalent, volatile and relatively new as cyber, that can be challenging.

“One of the major ways to help combat the challenges of the market is by improving a company’s risk profile and equipping it with pre-breach strategies,” said Tim Nunziata, vice president and head of cyber risk, Nationwide.

“These are loss-mitigation strategies that can be offered through the primary carrier that are constantly evolving alongside the cyber landscape.”

Keeping up-to-date with those best strategies is key. Not only can they help protect against attacks, but they can also be a preventative measure that any risk manager is sure to want in their cyber risk tool kit.

It’s fundamental to work with a carrier that’s knowledgeable on these different loss-mitigation strategies and can connect a business to the right vendors to bolster its security efforts.

Below are five techniques that are proven to help stop cyberattacks in their tracks.

1) Multifactor Authentication

Tim Nunziata, vice president and head of cyber risk, Nationwide

Multifactor authentication, commonly referred to as MFA, requires all users within a system to provide a combination of two or more credentials that help confirm their identity before gaining access.

That could mean providing a password and also answering a security question, or it could mean logging in and then entering a code sent to their email or phone.

“Having that extra layer to log on can help prevent cybercriminals from getting into the system,” Nunziata explained.

Identity-based attacks — wherein cybercriminals steal someone’s personal login credentials and use that information to impersonate them across a business’s network — are on the rise. According to Crowdstrike’s 2023 Global Threat Report, 80% of cyberattacks leveraged identity-based techniques to compromise credentials during the previous year.

Having multiple steps to log in can thwart bad actors before they have a chance to get into the system.

2) Endpoint Detection and Response

EDR (endpoint detection and response) solutions are a great tool to prevent a breach.

Designed to provide continuous monitoring capabilities and enhance visibility across a network, EDR solutions include data search and investigation triage, contextualized threat hunting, and malicious activity detection, validation and containment.

These security tools actively analyze events stemming from laptops, desktop computers, mobile devices, servers, and even IoT and cloud services. If suspicious activity is detected, EDR solutions aim to shorten response time and get the cyber team activated before the damage is done.

“EDR provides the company with real-time monitoring of activity and reports on any unusual activity. These improved data analytics enable front-line risk evaluation and response to save time and money in resolving security issues.”

3) Patch Management

Any business using technology will have gone through some iteration of a software update. In the cyber world, these updates are called patches, and one of the best ways to prevent attack is through patch management.

“From the insured standpoint, the patching on their systems should be a constant effort. Even with all the understanding around known vulnerabilities, there are so many unknowns still out there, and as we get a better understanding of loss drivers, vulnerabilities and exposures, it’s important to implement patches and control what can be controlled,” Nunziata said.

Patches are implemented to fix bugs in the system, reduce digital vulnerabilities and improve performance.

It’s key to involve all the appropriate stakeholders in the process as well, including senior leadership, IT experts, insurers and their vendors, and even automated tools designed to keep networks up-to-date. And these patches should be constant.

“It’s those notifications on your device that say your computer is going to restart in four hours,” explained Nunziata. “This constant system management can be provided through the insurer as well, whether that’s inside-out or outside-in, to help identify vulnerabilities and patch them.”

4) End-of-Life Software Management

Another reality in the technology world is that old tech can become obsolete. When software reaches the end of its life, manufacturers will often discontinue technical support and upgrades for it.

End-of-life software management is paramount in protecting a company from the exploitation of vulnerable outdated technology at the hands of bad actors.

“The business should be asking itself on an annual basis about any services or software that may be winding down that might need action or upgrades,” said Nunziata.

As a loss-mitigation service, insureds will want to invest in a life cycle management plan that outlines protocols for phasing outdated or unsupported software out of their network. These plans should also help in introducing new technologies and planning for replacements when necessary.

This step will keep the entire network from having the weak spots that cybercriminals find ripe for infiltration.

5) Employee Education and Awareness

“Cyber protection review is about employee awareness as much as anything. The lion’s share of incidents is triggered by employee mistakes or oversight,” Nunziata shared.

“Understanding that these threats are out there and why one shouldn’t just click on links or reply without thought is important for cyber defenses.”

Employees are often called the first line of defense against cyberattacks — and for good reason: The World Economic Forum reports that 95% of cyberattacks stem from human error. Making employees aware of threats and how to detect them can go a long way.

“Training on what an inappropriate email looks like and teaching employees to take a step back and think are key,” said Nunziata. &

Autumn Demberger is a freelance writer and can be reached at [email protected].

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.