Analyzing Cyber Security Risk

INDUSTRY RISK ASSESSMENT

While any company or industry can be the target of a cyberattack, there are factors which can expose certain industries to higher risk than others.

* Risk levels can vary significantly within industries, based on company size, geographic scope, and specific business models.

In addition to evaluating an industry’s likelihood as a target, we also consider the degree to which a cyberattack would be a significant threat to the business.

^{Market capitalization is an additional dimension not visualized. While a cyberattack on a small-cap company might affect fewer individuals, any resulting financial loss could be more impactful to the overall business than it would be for a larger company.}

ORGANIZATIONAL RISK ASSESSMENT

While there are risk signals common to certain industries, there are company-specific vulnerabilities that may be difficult to detect by an investor from the outside, including

1. Cultural

Security commitment may just be at the surface level and not fully embedded. Individual employee compliance is also a key variable.

2. Operational

Legacy infrastructure or insufficient planning/oversight may create unknown exposures and technical blind spots.

Financializaton

Significant cyber security incidents are often, but not always, financially material. Ways in which a cyber security incident can be financially material include the following:

• Significant sums of money (which cannot be recovered) may be sent to a fraudulent individual.
• Sensitive data may be lost, with associated fines/damages.
• Underspending on security protections may lead to a sudden and unplanned expense to upgrade systems.
• Inadequate cyber insurance may create large financial exposures.
• Reputational damage may cause loss of customer trust and lower future sales.

Engagement

Engagement can serve two purposes:

1. To better understand the risk profile of an investment
2. To understand the range of remediation activities, post-incident

Some lines of enquiry that can be helpful include

1. Governance

• Board expertise and management oversight
• Degree of cross-functional coordination

2. Strategy

• Scope of cyber management/policy
• Incorporation of emerging risk factors e.g., AI

3. Risk Management 

• Organizational risk tolerance and mitigation
• Incident response testing and impact assessment

4. Metrics & Targets

• Linkage of KPIs to compensation
• Cyber as a % of IT budget and changes over time