Cyber risk is business risk. Build resilience.

Attackers are also moving faster. With automation and artificial intelligence (AI) helping threat actors tailor phishing emails, impersonate trusted contacts, and identify vulnerabilities, organizations face events that can spread further and faster than many teams anticipated when they developed their response plans.  

For businesses, the question is no longer whether a cyber incident could happen. It’s whether the organization is prepared to respond when it does. That reality is changing how brokers, clients, and risk managers think about cyber risk and what they should expect from their insurance partners.  

Erin Halchak, Chief Underwriting Officer, US Cyber, recently discussed the state of cyber risk and the insurer’s role in helping organizations build resilience. 

“The biggest shift is that cyber has moved from a technical problem to a core business risk. Ransomware still remains a major concern, but the threat has really broadened to include phishing, social engineering, business email compromise, supply chain attacks, and data theft.” 

Ransomware still captures headlines, but Halchak points to two exposures that organizations often underestimate: people risk and third-party dependency. 

“Leaders tend to focus on the ransomware headlines that we see, but social engineering and business email compromise quietly drive a very large share of losses,” she said. “Most organizations don’t fully appreciate how dependent they are on vendors, cloud providers, and other partners. An incident at a third party can be just as disruptive as one inside of your walls.” 

That dependency makes vendor risk management a critical part of cyber preparedness. Organizations should understand which vendors support key operations, what data and systems those vendors can access, and how a vendor incident could affect business continuity. A formal third-party vendor management program can help document those relationships, evaluate controls, and plan for disruption. That broader impact is why cyber risk needs attention beyond IT. 

“A cyber event can interrupt your operations. It affects your revenue. It creates legal liability, regulatory liability, and reputational consequences. Those are business outcomes,” Halchak said. “The responsibility for managing cyber risk has to go beyond the IT department. It needs to be a part of the organization’s culture from the top all the way down.” 

If leadership sets the tone, employees carry that preparedness into everyday decisions. Strong programs make cyber awareness practical, helping employees understand what to watch for and when to escalate concerns. 

“Technology alone cannot eliminate the human element,” Halchak said. “People are often the first encounter to a threat. When we know how to recognize and report suspicious activity, and that there’s a safe way to do that within your organization without the fear of blame, that can be one of your strongest controls.” 

Effective awareness programs are frequent, practical, and tied to the threats employees are most likely to face. They also give employees clear guidance on when and how to report suspicious activity.  

Beyond training, organizations can strengthen resilience by focusing on the operational basics: 

Tabletop exercises are especially valuable because they turn a written plan into a practical response. 

“A tabletop exercise is a plan on a piece of paper. How do you turn that into a practical response?” Halchak said. “Going through the practical response and the exercise reveals gaps. It provides clarity on who the decision-makers are under pressure, and it builds the muscle memory of a team so that, when it matters, they know how to react.” 

In one example, Halchak recalled a risk manager who held a surprise tabletop exercise late on a Friday afternoon. Many participants believed they were responding to a real breach. The exercise exposed weaknesses in the escalation and vendor contact processes. Three months later, when an actual incident occurred, the team responded faster and reduced the impact of the claim. 

Cyber insurance has matured significantly over the past decade. For many organizations, the value now extends beyond the policy itself. The right insurance partner can help insureds identify control gaps, prepare for an incident, access response resources, and learn from emerging claim trends. 

“The underwriting process really encourages productive conversations about controls and preparedness,” Halchak said. “And then during and after an incident, it gives organizations fast access to expertise and resources when they need them most.” 

Brokers and risk managers should evaluate coverage in the context of an organization’s operations, risk tolerance, and business continuity needs. Brokers and risk managers can play a vital role in helping clients ask practical questions:  

As threats evolve, that partnership matters. Carriers with deep claims experience and visibility across industries can help organizations understand new patterns, prepare for emerging tactics, and adapt before an event occurs.  

That visibility can help organizations identify control gaps, act on lessons from recent claims, and strengthen preparedness before an incident occurs. As Halchak put it, “The industry also helps by pairing capital with expertise.” 

Cyber resilience is not a one-time project. It’s an ongoing discipline that connects people, processes, technology, insurance, and leadership. For brokers, clients, and risk managers, the opportunity is to move the conversation beyond coverage and toward preparedness before the next incident tests the plan.  

Learn more about our cyber insurance solutions at Cyber insurance – Liberty Mutual Business Insurance.