Marc Rocker
Some Businesses Worry About Fire and Theft. Could They Be Overlooking a Bigger Modern Threat?
Cyber risk is potentially the most significant and constant risk that is faced by businesses and whilst nearly all businesses accept that the risk exists, some may underestimate the impact it could have. Here Marc Rocker, Cyber Insurance Executive at Brown & Brown, looks at some of the things that we believe may contribute towards this thinking.
Invisible Threat
Unlike an incident involving a Fire, Flood or Theft etc., cyber-attacks are largely invisible. Therefore, the only time that it gains widespread attention is when the press decides to publish information. This only tends to happen if the victim themselves are deemed to be newsworthy, so the majority of attacks remain hidden from the public view.
Many people have heard of the attacks on Marks & Spencers or Jaguar Land Rover, but if we talk about Beacon CRM, Knights PLC or British Library, how many people can honestly say that they are aware of all three?
It Will Not Happen to Me
There can be a perception among some SME’s that cyber criminals only target large organisations (perhaps due to press reporting only on those types of organisation) potentially because the perceived ‘reward’ may be greater. The reality of this is very different. Attackers are increasingly targeting smaller organisations because they often have weaker security controls in place and are less likely to have dedicated IT resources.
However, according to Government figures 43% of UK businesses experienced a cyber breach or attack – UK Government Cyber Security Breaches Survey 2025.
The advancement of AI and automated tools means that cyber criminals can potentially attack large numbers of businesses simultaneously, increasing the reach of their campaigns without the need to select individual victims.
It’s an IT Risk
Some may view cyber security as a technical problem which should be owned by their IT Department / Supplier. However, the impact of a cyber incident will likely reach beyond just a computer outage.
Cyber incidents commonly affect operations, revenue and reputation. At the same time they can create legal liabilities and regulatory issues for any business.
There can be an assumption from business owners of multiple locations, is that only part of the business would be affected (similar to a fire destroying one location). However, a cyber incident affecting shared systems can disrupt multiple locations simultaneously and, in some cases, significantly impair business operations.
Business owners should consider Cyber risk as a business risk and not simply an IT problem.
Historical Experience
Most have experienced Theft, Vandalism or Property Damage and have recovered from them successfully. It is easier to prioritise something that you have had past experience of resolving.
Far fewer decision makers have actually experienced a cyber incident and therefore cannot yet comprehend the impact that this will have on the business and the people within it.
Significant cyber incidents can shut down key business operations and may require teams to work around the clock for a considerable period of time to achieve resolution, without even considering the associated financial costs.
Financial Impact
Businesses will often focus on the actual potential Ransom demand itself. However, the majority of the costs involved in dealing with an incident sit beyond this.
Consider that you may need to engage some (or all) of the following –
- Incident Response Consultants
- Legal Advisers
- Ransom Negotiators
- Public Relations Consultants
- Other Specialist Services
Then consider that you may need to engage with these people outside of normal business hours (cyber incidents can be triggered overnight, at weekends or on holiday periods) and you can see how these costs might add up very quickly.
Finally, the Business Interruption impact on your business if you are unable to sell your products or services (all the while continuing to attract the normal day to day running costs of the business).
We would note that over a year after their incident, shares in Marks & Spencers are trading 6-7% lower than they were the day prior to the event.
We Have Never Had an Incident
Businesses can mistake a lack of detected incidents for a lack of attacks. However, increasingly many businesses (and individuals) are constantly under attack through Phishing Emails, Credential Attacks and Vulnerability Scanning and simply do not realise that they have been targeted.
Third Party Exposures
Whilst a business may point to their own security measures, some may overlook suppliers, software providers and service partners. An increasingly common method of attack is to compromise a trusted third party and use that compromise to gain access to multiple businesses.
This scenario was how criminals attacked Marks & Spencers and most recently has caused an issue for Spotify, who advised that the issue was with their third party supplier.
The old adage that you are ‘only as strong as the weakest link in the chain’ definitely applies to Cyber Resilience.
Perspective
People still have a mental image of a hacker breaking into a system. This is normally a lone person sitting at a computer typing furiously on a keyboard (Hollywood definitely does not help us here!).
Modern cyber attacks can involve criminals using, social engineering, supplier impersonation, business email compromises to exploit human behaviour. At the same time they may be running software (which can be bought on the Dark Web) to exploit vulnerabilities in software.
False Sense of Security
If you have operated for a period of time without a major incident, there is potentially a tenancy to think that the controls that you have in place are effective.
Cyber criminals are always adapting and developing new methods of attack (accelerated by AI) and it is simply a race for security measures to keep up with these changes. The moment that the security measures fall behind in the race, can potentially mean you are more vulnerable to attack. At the same time, the lack of a major incident can also be because you have been fortunate.
Conclusion
Most businesses would never dream of leaving their front door unlocked overnight, yet some continue to operate with outdated systems, weak passwords and limited incident planning.
The uncomfortable reality is that cyber risk has become the modern equivalent of fire risk: low probability on any given day, but potentially catastrophic when it occurs and that is where Cyber Insurance can support a business’s recovery.
Brown & Brown can help arrange cyber insurance for your business, helping you access support and resources to assist with recovery following a cyber incident.
Marc Rocker
Cyber Insurance Executive, Brown & Brown
Marc cuts through the technical jargon to explore the real cyber threats facing businesses of every size. From protecting a business’s data and operations to understanding what happens when an incident occurs, Marc will share practical, straightforward guidance to help businesses strengthen their cyber resilience, manage risk and be better prepared should the worst happen.
Marc help businesses unravel the myths & misconceptions around Cyber Insurance and to build risk transfer solution to protect themselves.
“Cybercrime isn’t just an IT problem – it’s a business risk. How prepared are you?”