The NotPetya attack (2017), as well as the SolarWinds supply chain compromise that affected 18,000 organisations in 2020, have since been attributed to Russian actors. These incidents illustrate how a ‘latent’ geopolitical conflict, which has since become an internationalised hybrid conflict, can translate into a systemic cyber threat to the subsidiaries of major groups and their supply chains made up of SMEs. In response, insurers and reinsurers are gradually, and rightly, withdrawing from the systemic risks associated with these events.
Against this backdrop, the increasingly blurred boundaries between geopolitical conflicts and cyber threats (for example, state-sponsored attacks and ransomware targeting critical infrastructure) require SMEs and major groups in every sector, particularly essential sectors (energy, health and transport) and new technologies (cloud, AI and robotics), to rethink their approach to risk management. To ensure an organisation’s resilience, cyber risk management, regulatory compliance (DORA, NIS 2, the AI Directive, etc.) and risk financing (insurance, captives and public funds) must therefore be integrated into a common strategy. This requires bringing together functions, and the people who embody them, that have been kept apart for too long by organisational silos.
That common strategy has yet to be built. Faced with the unknown, what approach should we adopt when the very concept of emerging risks, incorporated into corporate risk maps, now appears insufficient? The methods used to analyse them, including probabilistic scenarios, technology monitoring and predictive modelling, most often fail when confronted with risks that are asymptomatic, have no historical record, are non-linear or are systemic. The Covid crisis was a scenario considered unlikely by the WHO. In their risk maps, organisations feared natural disasters and environmental risks while overlooking the consequences of war risks in Europe or the Middle East.
Technological and societal accelerators of the unknown are now combining, requiring us to lift the veil on the illusion of advance control: organisations that analyse past crises to prepare for the future are arguably reinforcing their blindness to the disruptions of today’s world. The latest cyberattacks, amplified by AI, illustrate this. Paradoxically and counter-intuitively, the more a system is optimised for known risks, the more vulnerable it becomes to unprecedented attacks.
This trend towards organisations reviewing their models and investing more heavily in operational resilience also calls for a faster transformation of the role of insurers and brokers. They will continue their financing and placement missions, but will need to mobilise more resources to help businesses analyse their risk exposures and prevent risks by offering services.
Anticipating the unimaginable and exploring the unknown through new methods are the new challenges that organisations and those involved in risk management and financing must address to strengthen the resilience of our societies.
What if the best way to manage unknown risks were to stop treating them as risks and see them instead as opportunities to reinvent our models?