FS more vigilant about cyber threats, Moody’s survey reveals

By Puja Sharma

Moody’s global issuer cyber survey shows that financial institutions, corporations, infrastructure issuers, and governments are becoming more vigilant about cyber threats and increasing their investments in this area. However, their preparedness levels and defensive capabilities are far from uniform.

Another part of the report addresses the types of cyber defence mechanisms used across each sector. Survey responses show that financial services respondents consistently make greater use of each cyber defence practice, while other sectors lag, particularly with regards to the use of more advanced defence practices.

The survey shows that organizations across asset classes are becoming more vigilant about cyber threats and increasing their investments in this area. However, their preparedness levels and defensive capabilities vary widely. According to Moody’s Vice President, Lesley Ritter, “Cybersecurity governance sets the tone for an issuer’s overall cyber strategy. Our survey found that 93% of respondents’ organizations have a cybersecurity manager, a credit positive. But, the importance of this position within the broader enterprise, as measured by reporting lines, varies.”

Cybersecurity governance sets the tone for an issuer’s overall cyber strategy. Of the organizations surveyed, 93% have a cybersecurity manager that reports directly to a member of the executive suite. However, the importance of this position within the broader enterprise, as measured by reporting lines, varies.

Public disclosure depends on defining cyber incidents and materiality. Survey results show that the frequency of reporting cyber episodes to boards of directors is twice as high as reporting such events to the public. The lack of defined reporting guidelines can leave key stakeholders with little information about a matter of growing importance.

Issuers are at various stages of building out their cyber risk management operations. Financial services respondents consistently indicated greater use of each cyber defence practice we inquired about. Adoption of basic cyber defence practices is widely accepted across sectors, while the use of advanced defence practices is lagging. Addressing cyber supply chain risk remains a priority. Survey data shows a keen focus on addressing supply chain vulnerabilities, particularly in North America. In the aftermath of high-profile data breaches and software vulnerability disclosures, we expect this matter to remain a top priority.

Standalone cybersecurity insurance remains the preferred approach to risk transfer. The use of standalone cyber insurance is most prevalent in North America and EMEA, with an average of 57% and 54%, respectively, of surveyed issuers in the two regions carrying these policies. In the rest of the world, only 41% of issuers said they carried standalone cyber insurance.

Cloud adoption is growing, particularly in corporate sectors not facing regulatory limitations. The corporate sector has the highest rate of cloud adoption, followed by the public, financial services, and infrastructure. Regulatory requirements tied to customer privacy and the need to have resilient services with robust redundancies likely explain the slower adoption pace of the financial services and the infrastructure sector, in particular.

Key takeaways

• Cybersecurity governance sets the tone for an issuer’s overall cyber strategy. Of the organizations surveyed, 93% have a cybersecurity manager that reports directly to a member of the executive suite.
• Organizations across asset classes are becoming more vigilant about cyber threats and increasing their investments in this area.
• Financial Services respondents consistently make greater use of each cyber defence practice, while other sectors lag, particularly with regards to the use of more advanced defence practices.
• Standalone cybersecurity insurance remains the preferred approach to risk transfer.
• Cloud adoption is growing, particularly in corporate sectors not facing regulatory limitations.