Ransomware remains a top cyber risk for organizations globally while business email compromise incidents are on the rise and will increase further in the “deep fake” era.

At the same time, the war in Ukraine and wider geopolitical tensions are a major concern as hostilities could spill over into cyber space and cause targeted attacks against companies, infrastructure or supply chains, according to a new report from Allianz Global Corporate & Specialty (AGCS).

The insurer’s annual review of the cyber risk landscape also highlights the emerging threats posed by the growing reliance on cloud services, an evolving third-party liability landscape that means higher compensation and penalties, as well as the impact of a shortage of cyber security professionals.

Such potential vulnerabilities mean that today a company’s cyber security resilience is scrutinized by more parties than ever before, including global investors, meaning many firms now rank it as their major environmental, social and governance (ESG) risk concern, the report notes.

Around the world, the frequency of ransomware attacks remains high, as do related claims costs.

There was a record 623 million attacks in 2021, double that of 2020. Although the frequency reduced by 23% globally during the first half of 2022, the year-to-date total still exceeds that of the full years of 2017, 2018 and 2019, while Europe saw attacks surge over this period.

Ransomware is forecast to cause US$30bn in damages to organizations globally by 2023.

The value of ransomware claims the company was involved in together with other insurers, accounted for well over 50% of all cyber claims costs during 2020 and 2021.

Increasingly, smaller and mid-sized companies which often lack controls and resources to invest in cyber security are being targeted by gangs as larger businesses invest more heavily in security. Gangs are also using a wide range of harassment techniques, are tailoring their ransom demands to specific companies and are using expert negotiators to maximize returns.

Business email compromise (BEC) attacks continue to rise, facilitated by growing digitalization and availability of data, the shift to remote working and, increasingly, “deep fake” technology and virtual conferencing.

BEC scams totaled $43bn globally from 2016 to 2021 according to the FBI, with a 65% spike in scams between July 2019 and December 2021 alone.

Attacks are becoming more sophisticated and targeted with criminals now using virtual meeting platforms to trick employees to transfer funds or share sensitive information.

Increasingly, these attacks are enabled by artificial intelligence enabling ‘deep fake ‘audio or videos that mimic senior executives.

Last year, a bank employee from the United Arab Emirates made a $35m transfer after being misled by the cloned voice of a company director.

The war in Ukraine and wider geopolitical tensions are a major factor reshaping the cyber threat landscape as it increases the risk of espionage, sabotage and destructive cyber-attacks against companies with ties to Russia and Ukraine, as well as allies and those in neighboring countries.

State-sponsored cyber acts could potentially target critical infrastructure, supply chains or corporations.

Although acts of war are typically excluded from traditional insurance products, the risk of a hybrid cyber war has accelerated efforts in the insurance market to address the issue of war and state-sponsored cyber attacks in wordings and provide clarity of cover for customers.

Other trends identified in the Cyber: The changing threat landscape report include:

Hackers zero in on vulnerable supply chains: Supply chain attacks – whether on critical infrastructure such as the Colonial Pipeline or on cloud services – have emerged as a significant risk.

Increasingly, ransomware gangs use the threat of disruption to pressure firms into paying ransoms, with manufacturing companies particularly vulnerable.

Cloud outsourcing: Companies continue to shift their services and data storage on to the cloud, despite growing concerns around security and risk aggregation.

By relying on a small number of providers for cloud services or cyber security, society is creating large concentrations around a few single points of failure.

It is a common misconception that the outsourcing or cloud vendor will assume full responsibility in the event of an incident.

Third-party liability, including fines and penalties, is becoming more relevant with advances in technology, organizations collecting more information and enforced data privacy regulation.

Almost any cyber incident – including double-extortion ransomware – can lead to litigation and demands for compensation from affected parties.

A shortage of professionals is hindering efforts to improve cyber security.

While there is growing awareness among boards, the number of unfilled cyber security jobs worldwide has grown 350% over the past eight years to 3.5 million, estimates show, meaning many companies struggle to hire, impacting their ability to improve their cyber security posture.

Cyber security increasingly seen through the ESG lens. Today, companies’ cyber security resilience is scrutinized by far more stakeholder groups than in the past.

Increasingly, cyber security considerations are incorporated into the ESG risk-analysis frameworks of data providers, who look into companies’ practices to evaluate their preparedness for cyber crime.

Making sure a company’s cyber processes and policies are understood at the board level and that risk monitoring processes are in place has never been more important.

In response to a more complex risk environment and increasing cyber claims activity, the insurance industry is more diligently assessing companies’ cyber risk profiles in a bid to incentivize companies to improve their security and risk management controls.