Why cyber insurance does not prove UK financial firms’ resilience

Insurance and bigger security budgets do not establish cyber resilience

UK financial-services leaders need evidence of operational resilience alongside insurance cover and security spending. ESET’s survey found that 99% of respondents had cyber insurance, yet firms still reported substantial losses and recovery delays. Insurance provides financial protection; resilience also depends on whether a firm can detect an attack, restore critical operations and absorb the costs it retains.

The findings cover a defined part of the market. The research behind UK financial firms lose GBP £1.01bn to cyberattacks surveyed 500 UK financial-services companies with 50 or more employees and annual revenue between GBP £500,000 and GBP £500 million. ESET, a cybersecurity vendor with a commercial interest in demand for protection services, reported findings across companies of different sizes within that group.

Within this market, breaches affecting prominent digital-finance and crypto groups have intensified scrutiny of security preparedness. The survey gives that scrutiny a financial and operational basis: how often incidents occur, what they cost and how long recovery takes. Those outcomes help decision-makers examine what their insurance and investment deliver during an incident.

Repeated incidents create an annual financial and operational burden

The frequency of reported attacks makes recovery a recurring business concern. ESET estimated that cyberattacks cost UK financial-services firms GBP £1.01 billion over the past year, while 97% of surveyed businesses reported at least one incident. Repeated attacks were common: 62% said they had experienced more than one. Firms therefore need to prepare for further disruption while dealing with an initial incident.

Repeated incidents also affect how leaders should read the financial figures. Across the surveyed businesses, cyber incidents cost an average of GBP £726,000 over the past 12 months. This measures each business’s reported costs over a year that could include several incidents. So budget owners need to assess annual exposure when deciding how much financial capacity the business needs.

That exposure includes the time needed to resume essential work. Among businesses that suffered an incident, restoring critical business operations, the activities a firm needs to perform to function, took an average of seven days. Leaders can use this recovery outcome to assess their own plans. But technical repairs, financial consequences and customer concerns can require further work after critical operations resume.

Insurance leaves firms with costs and customer risk

Recovery also takes money, and the survey recorded considerable recent insurance purchasing. Alongside near-universal coverage, 41% of respondents had taken out a policy within the past year. A policy provides financial protection, but the amount recovered determines how much incident cost the business must bear. ESET found that an average of 44% of cyber-incident costs remained unrecovered through insurance.

The unrecovered share leaves firms with a substantial financial burden. Applying that share across the sector, ESET calculated that firms could have to absorb as much as GBP £456 million in annual losses. For an individual firm, the practical question is which incident costs its policy covers and how it would fund the remainder.

Beyond those retained costs, firms face wider commercial consequences. Customer churn, meaning customers leaving, reputational damage and business interruption may fall outside many claims calculations, even where insurance cover exists. These consequences add to the recovery effort. Recovering insurance payments and restoring operations therefore leave a further task: protecting the customer relationship.

Customer research cited in ESET’s study shows the risk to that relationship. Only 11% of UK consumers said they would continue using their financial-services provider as normal after a major breach that exposed customer data. These answers describe consumers’ stated intentions in a hypothetical event. For providers, they make rebuilding confidence a distinct part of recovery.

Steve Round, Co-founder and President at SaaScada, linked the frequency of incidents to the need for stronger protection. SaaScada has a commercial interest in financial firms’ technology spending, so Round’s recommendation comes from a company that can benefit from that investment. “With almost every FS firm experiencing recent security incidents and financial losses, we‘re well past warning signs,” he said.

Round extended that warning to lasting commercial harm. “Despite relatively strong cyber maturity, organisations urgently need to move beyond the basics. If not, they will continue to face serious financial losses, customer churn, and damaged reputations.” His recommendation shifts attention to the capabilities firms need beyond their existing basic controls.

Basic controls leave gaps in detection and response

ESET described adoption of basic security controls as relatively strong, but found gaps in more advanced protection and response preparation. These are different levels of capability: installing basic measures is one step, while detecting an intrusion and managing its consequences take continuing operational work. Leaders therefore need to examine how fully their controls cover the business and how reliably teams can use them.

Continuous detection is one area where coverage matters. The survey found that 65% of respondents lacked a 24/7 managed detection and response service, which monitors for threats and helps respond to them. Firms can arrange detection in other ways, so they need to assess how their chosen approach maintains continuous monitoring. The practical questions are who watches for threats and who acts when suspicious activity appears.

Uncertainty about existing breaches makes those questions more pressing. Nearly six in 10 respondents considered it possible that their organisation had already suffered a breach that remained undiscovered. Their answers describe concern about a possible intrusion. To resolve that uncertainty, firms need evidence from monitoring and investigation that gives them confidence about the condition of their systems.

The survey also found gaps in response preparation and device protection. Some 57% of respondents lacked complete incident response plans, while 60% lacked complete endpoint security, which protects devices such as computers and servers. Response plans guide an organisation’s actions during an incident; endpoint security protects equipment attackers may target. Firms need to examine both whether protection is complete and whether recovery arrangements are usable.

Improving these capabilities takes people, sustained operating effort and workable technology. Talent shortages were the leading challenge for 38% of respondents, while 33% identified the demands of operating security continuously, 24/7, and 32% identified securing legacy technology. A firm seeking stronger coverage may face several constraints at once. Its improvement plan therefore needs to account for the specialists it can recruit, the operations it can sustain and the older systems it must secure.

AI investment creates a separate governance task

The need to turn resources into working protection also applies to artificial intelligence, or AI. Some 46% of surveyed firms identified securing AI adoption as their top cybersecurity priority for the next 12 months. That places AI security in near-term planning. It also makes the rules governing adoption an immediate concern for leaders approving new uses of AI.

Spending had already increased across much of the surveyed market: 86% said they had raised cybersecurity investment because of AI. Yet 62% reported that they lacked an up-to-date AI security policy. Taken across the group, these results show widespread investment alongside widespread gaps in current governance. Executives reviewing an AI-related budget therefore need to examine the policy governing its use as a separate part of the decision.

Policy decisions also need to account for the changing threats highlighted by Matt Knell, UK Country Manager at ESET. His recommendation reflects ESET’s commercial interest in demand for cybersecurity protection. “The British FS industry must continue adapting to keep pace with cybercriminals,” he said. He then specified the direction: “That means bolstering their cyber resilience, delivering always-on protection that can keep up with increasingly dangerous cyber threat actors, and taking steps to protect against a rising AI attack surface and AI-powered threats.”

Knell’s reference to an AI attack surface concerns the systems and access points exposed through AI use, while AI-powered threats concern attackers using AI. Firms therefore have two separate tasks: examining what they expose as they adopt AI, and assessing whether their protection can respond to attackers’ changing methods. Current governance needs to address both as AI use expands.

Main highlights

• Plan for repeated disruption: In ESET’s survey, 62% of UK financial firms reported multiple cyber incidents, and affected firms averaged seven days to restore critical operations. Risk and operations owners need recovery plans that account for further attacks during recovery.
• Budget for retained losses: Despite 99% insurance coverage, an average of 44% of incident costs remained unrecovered through insurance. Finance and risk owners need to check policy coverage, fund the remaining exposure and include customer confidence in recovery planning.
• Close detection and response gaps: Some 57% of respondents lacked complete incident response plans, while 60% lacked complete endpoint protection. Security owners need to verify device coverage, test response arrangements and establish who monitors and acts on threats around the clock.
• Align AI investment with governance: While 86% of firms increased cybersecurity investment because of AI, 62% lacked an up-to-date AI security policy. Technology and security owners need current rules covering risks introduced by AI adoption and threats from attackers using AI.