A new report from reinsurance specialist Guy Carpenter highlights the significant financial impact of business email compromise (BEC) claims, which are often categorized as attritional and frequency-driven within the cyber insurance market.
The report, titled “Cyber's Sleeper Threat: Business Email Compromise” examines the threat and impact of BEC attacks, a sophisticated form of phishing that targets human vulnerabilities rather than technical ones.
In these attacks, perpetrators impersonate trusted entities to deceive employees into transferring funds, evading traditional security measures.
The report notes that the majority of these events resulted in losses around 0.1% of company revenue. For a company with $1 billion in revenue, this translates to a $1 million loss.
Despite the financial threat posed by BEC, the report states that cyber vendor models vary in their approach to accounting for BEC claims in their catastrophe event catalogs. Only one leading industry vendor has explicitly included BEC as a cyber peril in its models.
Erica Davis (pictured above), global co-head of cyber at Guy Carpenter, said that while cyber threats like ransomware attacks, zero-day vulnerability exploits, and cloud service provider outages often dominate headlines, the consequences of a successful BEC can be greater.
“The consequences of a successful BEC attack, however, can also be devastating for an organization and create large losses for cyber re/insurers. By driving awareness of the right cybersecurity measures, we can collectively improve the resilience of organizations against BEC threats and mitigate its impact on underwriting profitability,” Davis said.
What are your thoughts on this story? Please feel free to share your comments below.
