Singapore’s growing business and cyber risks
The latest edition of Beazley’s Risk and Resilience research, which studies the current risk concerns of business leaders around the world, has shown that when business leaders in Singapore and across Asia think about broad categories of risk, they think differently to other regions, say the specialist insurer’s Ms Rachel Turk and Mr Lucien Mounier
In Singapore, leaders are much more concerned by risks in two categories – business risk and digital risks – than leaders in any other part of the world, where concerns over political and economic risk and environmental risk are much more to the fore.
Business risks include everything from supply chain instability, through business interruption, to ESG, employer and boardroom/reputation risk. Digital risks include disruption or disintermediation by others, the risk that technology and systems are not up to date, cyber and intellectual property (IP) infringement risks.
Singapore is particularly exposed to risks in both categories, for two reasons: the talent crunch and the influence of China. As a global trading hub with an ageing population, it is clearly dependant on trading partners in a way that many other countries are not.
Concerningly for our industry, the Singapore metrics also point to markedly less faith in insurers and in the value of the insurance proposition. Only 37% report increased trust in insurers for example – 8 percentage points down on the global comparison. This partly reflects the status of a market where the overall penetration of specialist insurance is much lower than in the US or Europe. It may also reflect the fact that clients in Asia are in need of specialist insurance solutions fully designed for businesses operating in this region.
The talent crunch and the influence of China
Singapore has long had a structural problem because of its ageing workforce. This risks being further accelerated by labour market shifts during the pandemic, which may not reverse as completely or rapidly as anticipated. This is likely to create difficulties for businesses in filling roles, particularly low-to-mid tier roles; and of course for the food and beverage industry, which is at the sharp end of the staffing gap. Meanwhile, businesses are having to work hard to maintain operational scalability, as well as innovation capability – fueling concern around the ability to mitigate complex business and technology risks.
Supply chain reconfiguration, introduction of new working models, IT system and process upgrades are not the kind of tasks that can be led by people just entering the workplace. The ageing of the overall workforce is a challenge for businesses and the number of workers aged 55 and above fuels high levels of competition for some roles.
Meanwhile, Singapore had forecast its economy would expand 3-5% in 20221 as the region recovered from the pandemic slump. However, issues have persisted beyond lockdowns, and trade was badly hit in H1 2022 by a persistent issue with Greater China’s borders remaining partially closed. Other lingering effects in 2022 include slowing global growth, rising inflationary pressures, and high levels of disruption to demand, ability to trade and supply chain disruption.
Although these issues will not be resolved swiftly, on the plus side high vaccination rates have created the confidence needed to loosen border measures and ease local restrictions. These moves should support the recovery of lagging sectors and kick start an improvement in trading conditions for businesses more broadly.
Cluster of cyber and technology risks cause concern
Alongside these macro issues, the biggest risk that faces every leader in Asia is clearly the clustered group of technology risks. And whereas in many parts of the world there is plenty of clear blue water separating levels of concern about different types of digital risks, this is not the case in Singapore.
In January 2022, cyber risk was ranked top by the highest proportion of business leaders (29%), but technology obsolescence (27%) and disruption risk (26%) followed very close behind. Only intellectual property (IP) appeared to be something of an after-thought – given top ranking by only 18% of business leaders.
Business leaders in Asia look at cyber risk with particular anxiety both because the cyber insurance market is still maturing, and because regulation takes longer to be implemented in a fragmented region where each country has to develop their own policies. This means more vulnerability to the risk for business.
In particular, business email compromise remains an issue, with a particularly notable rise in professional services firms becoming victim to this attack – this industry class rose to 33% in Q1 of this year.
Beazley’s own data shows a variety of ways that cyber threat actors are compromising organisations – as shown in the graph below
The numbers are pretty evenly split across types of breach, so it’s not enough, clearly, to focus on one area of cyber hygiene. With risk looming on all fronts, just securing the perimeter is no longer enough. Organizations need a comprehensive approach that addresses all stages of the ransomware kill chain in order to be resilient and minimize damage from attacks.
The cyber insurance market has hardened dramatically over the past two years in response to a highly volatile risk landscape. This has occurred in the midst of an increase in frequency of incidents suffered by companies, resulting in the businesses now rushing to purchase insurance facing more restrictive terms as well as diminished choice in the market.
Higher risks bring underwriting challenges
These results are absolutely consistent with our experience underwriting cyber risk and advising clients on risk mitigation. Cyber criminals can extort greatest value in sectors where there is a cluster of financial, health and personal data – as we find in healthcare, financial institutions and the public sector. The public sector in particular is a target both because of the high concentration of sensitive data, but also potentially weaker protections from entities which lack deep pockets such as public service amenities.
Clients need to take steps to improve their risk controls and their insurability, by improving information security, securing open ports and using solutions such as multi-factor authentication.
It is important to understand the mindset behind these numbers. Cyber risk has become an accepted and expected part of every-day business life. While leaders in no way under-estimate the severity of the risk, they have comparatively high levels of confidence in their ability to anticipate and respond – in fact almost a third (32%) feel ‘very prepared’ in Singapore – the highest level of resilience reported to risks in this cyber and technology category.
Perhaps a strong sense of confidence around cyber is reflected in the relatively high ranking given to technology obsolescence risk. Because business leaders acknowledge that out-of-date technology and systems will be a welcome back door to criminals keen to exploit vulnerabilities, this risk is also ranked high but resilience levels are equally robust.
Insurance ask gets bigger
Insurance is not a panacea and not all risks are insurable. But it is clear that as this region moves on from the pandemic, business leaders will expect more from our industry. Understanding businesses’ risk appetites, where they feel most vulnerable and where they need our help to build resilience to a disorientating array of risk exposures will become ever more critical to our ability to provide the value, expertise and services our clients need.
Insurers must continue to invest in supporting clients to proactively manage their less predictable and harder to quantify risks in order to help build resilience. A specialist underwriting approach that focuses on Asian business needs and tailors products to their needs is also critical.
With the right products, Asian insurance penetration will continue to increase, but insurers must work hard to address the real needs of businesses here, which truly differ from the political and economic concerns that dominate in Europe and North America.
The positive that can be taken from this is that insurers who do invest in this region will be in a position where they can really help local markets improve their maturity and use of specialist insurance, which is a win for all sides.
More detailed information about the sources of data breaches can be found in the Beazley Cyber Security Snapshot, at https://reports.beazley.com/2022/cyber/charts.html
Ms Rachel Turk is group head of strategy and Mr Lucien Mounier is head of Asia Pacific with Beazley