Cyber spotlights on the financial institutions industry: Identify, assess, protect

This spotlight delivers an overview of the latest cyber risks impacting the sector generally, including recent incidents and emerging threat vectors. We also highlight our insurance solutions that can address the cyber vulnerabilities faced by financial institutions. Use our insights to enhance your organisation’s cyber risk management approach.

What cyber incidents have we seen from the financial institutions industry?

Cyber insurance claims we have seen from the financial institutions industry

Cyber claims notifications from the financial institution sector remain high

According to WTW cyber claims data, although H1 2024 claims notifications were lower than projected, the financial institutions sector remains second place (of 14) for number of claims notifications to date (behind the healthcare sector), making up 17% of all notifications to WTW. 35% of those notifications are attributed to malicious data breach and 25% to ransomware. Once H2 results are considered this may alter the status quo, as system failure business interruption losses are considered following the CrowdStrike outage.

Source : WTW proprietary claims data

Attack Vectors

Leading Cyber insurer, Canopius, observe that nation state attacks against Financial institutions decreased in Q2 2024, which continues the trend since 2023, that the majority of attacks from the sector (circa 50%) originate from financially motivated threats (vs espionage, hactivism and terrorism) (Canopius – Financial Services: Threat Intelligence Report Q2 2024).

To defend these attacks, ‘behavior prevention on endpoints, such as EDR technologies, is the most effective control at mitigating against the types of attacks targeting the sector’, followed by ‘Filter Network Traffic’ (‘using network appliances to filter ingress or egress traffic and perform protocol-based filtering’) in second place (Canopius – Financial Services: Threat Intelligence Report Q2 2024).

Regulatory landscape

As of 17 January 2025 the Digital Operational Resilience Act will come into force within the European Union. This will impact a wide variety of Financial Institutions from Credit Institutions to Insurance Organizations (Akamai/Glossary/What-is-dora). The focus of the Act is on ensuring resiliency and robust procedure to build strong cyber defences for the industry. Whilst many sophisticated Financial Institutions in the EU may already have such measures in place (for example vulnerability management programs and incident reporting procedures), Akamai suggest that ‘to prepare your organization for DORA legislation adherence, covered entities should carry out a gap analysis to see if the existing deployed measures meet some or all applicable requirements.’ (Akamai/Glossary/What-is-dora)

Our perspective on cyber market trends for the financial institutions industry

The cyber market has remained favourable for financial institutions this year with strong competition on primary and excess layers. Capacity in the London market remains ample, as insurers have a high level of confidence in the cyber security credentials of the sector. Moreover, financial lines insurers are eager to deepen their relationships across the various classes of insurance (PI, crime, D&O and cyber) on a cross-class basis, further driving competitive results. There has also been a greater flexibility from Insurers regarding retention options available, and capacity lines greater than $5M are now commonplace.

Although buying conditions have been favourable, limit purchasing for Financial Institutions has largely remained stable. Many WTW clients have taken a risk based approach to limit adequacy, utilising analytics tools such as WTW’s Cyber Quantified 2.0 to steer decision making, rather than available budget.

Instead, coverage analysis (including Retention options) has been of primary concern, including the alignment of internal incident response procedure with cyber insurance notification requirements and vendor panel solutions. This is of increasing interest to information security teams who can utilise insurer vendors to complement their own panels. Moreover, some insurers are offering discounts on selected information security tools for insureds to deploy on their infrastructure (e.g. EDR solutions) including advisory services. For example, Beazley have established their own in house cyber security function (Beazley security) and we expect this trend to develop further in 2025.

Captive deployment on Cyber programs remains an area of investigation for Financial Institutions. They can create competitive and generous coverage options. Although, given the competitiveness of the current insurance market they are yet to be deployed regularly for the sector, despite many clients regularly deploying their captives on other lines e.g. PI/Crime.

How WTW can help with identifying, assessing, and protecting your business