Your IT team has locked down every endpoint. Your employees can spot a phishing email from a mile away. Your security stack is a fortress. And yet, you’re still vulnerable because the next major cyber attack might not target you directly at all.
The latest 2024 Cyber Insurance Claims Report from Resilience confirms what many security professionals have feared: the biggest threat might be hiding in your vendor relationships, not your network. The findings reveal a seismic shift that’s forcing businesses to rethink their entire approach to cyber risk.
The Surprising Rise of Third-Party Vulnerabilities
Remember when keeping your own digital house in order was enough? Those days are gone. A stunning 31% of all cyber insurance claims this year stemmed from third-party incidents—attacks that didn’t target companies directly but came through their vendors, suppliers, or service providers.
What’s even more eye-opening is the financial impact. For the first time ever, insurers are reporting that 23% of all incurred losses came from these third-party breaches—up from literally 0% last year. This isn’t just a statistical blip; it’s a fundamental transformation in how cyber risk operates.
Ransomware Won’t Go Away (But It’s Changing)
Despite years of heightened awareness and improved defenses, ransomware remains stubbornly persistent, accounting for 61% of claims with losses in 2024. But there’s an important nuance here:
-
43% of these ransomware claims came from direct attacks on companies
-
18% resulted from attacks on vendors that rippled through to their clients
This split highlights how cybercriminals are getting smarter about maximizing their impact—why attack a single company when you can compromise dozens through a shared service provider?
Beyond the Headlines: Other Critical Trends
While third-party risk and ransomware dominate the conversation, the report uncovered several other noteworthy developments:
-
Transfer fraud (think sophisticated payment redirection scams) jumped to 18% of claims, up from 14% last year
-
The transportation, manufacturing, and healthcare sectors faced the highest frequency of claims
-
Healthcare and financial services saw particularly troubling increases in cyber incidents
-
On the positive side, phishing-related claims decreased, suggesting that employee awareness training might finally be paying off
A Shared Problem Requires a Shared Solution
Resilience CEO Vishaal Hariprasad emphasizes a crucial point in the report: cyber risk has become a shared responsibility. His point cuts to the heart of the matter: cyber risk has transformed into a shared responsibility. Your security isn’t just about what happens inside your network perimeter. It’s about the entire ecosystem of partners and providers you rely on.
This reality demands a fresh approach to cybersecurity strategy:
-
Rigorous vetting of third-party security practices before signing contracts
-
Contractual safeguards that establish clear security requirements for vendors
-
Expanded monitoring that looks beyond your network to identify risks in your supply chain
-
Incident response plans that account for scenarios where the breach didn’t start with you
What This Means for Your Cyber Insurance
These shifts are already reshaping the cyber insurance market in tangible ways:
-
Expect policy language to evolve, with more explicit coverage (or exclusions) for third-party incidents
-
Industries with high claim rates may face premium increases
-
Insurers will likely require more evidence of comprehensive risk management, including third-party oversight
-
The definition of “adequate protection” is expanding beyond your own security measures
Taking Action: Protecting Your Business
In light of these findings, here are concrete steps worth considering:
-
Schedule a thorough review of your cyber insurance policy. Does it adequately address third-party risks?
-
Identify your critical vendors and assess their security posture
-
Strengthen your defenses against ransomware and transfer fraud, which continue to drive significant losses
-
Remember that cybersecurity is increasingly a collective effort that spans organizational boundaries
Cybercriminals are already plotting their next move through your vendor network. Staying ahead requires more than just updating your firewall. By understanding these emerging trends and adapting your strategy accordingly, you can better protect your organization in an increasingly interconnected digital world.
