American Oil and Gas Reporter - August 2023 - 65

SpecialReport: Cybersecurity
generally lack cutting-edge cybersecurity
technology and work far too often with
'end of life' (obsolete) software that no
longer receives security updates from its
creator and may contain vulnerabilities
bad actors can exploit.
Meanwhile, as the price of oil increased,
so did the value of upstream
firms and the potential revenue loss from
a business interruption. This accelerated
the rate increases that already were occurring
in response to more frequent and
severe cyberattacks.
Fast-forward to the fourth quarter of
2022, and the cyber insurance market has
begun to calm. Premium increases
dropped 20%-80% in the first half of
2022, but by the fourth quarter organizations
with superior cybersecurity controls
saw steady or reduced premiums. This
trend has continued into 2023, with premiums
falling as much as 10%-20% for
organizations with strong cybersecurity
controls and flat revenues.
What happened? In most cases, upstream
companies made necessary upgrades
to technology and controls that
insurers wanted for cybersecurity (and
that government regulations required). As
these upgrades took place, insurers began
seeing fewer and less severe claims. This
change gave underwriters the confidence
to provide more competitive rates to organizations
that invest in superior cybersecurity
controls and training.
The upstream industry's experience
mirrors broader industry trends. Figure 1,
which comes from a report AM Best published
in June, chronicles how quickly
U.S. insurers' loss ratio grew in 2020,
causing the cyber insurance market to
harden. Cybersecurity requirements during
the past two years have helped mitigate
claims. Alongside the premium
increases referenced in Figure 2, these requirements
have helped bring the cyber
insurance industry's loss ratio below 50%
and stabilize the market.
Insurers remain concerned about cybersecurity
risks in the oil and gas supply
chain, but these concerns have become
less acute as claims data shows that investing
in cybersecurity pays off.
The Cost Of Inaction
Upgrading technology and implementing
robust cybersecurity controls
can be expensive, but failure to do so can
AUGUST 2023 65
be even costlier. Cybercriminals try to
optimize their time, which means they
look for easy targets. Bad actors in general,
and ransomware groups in particular,
love preying on organizations that
lack adequate cybersecurity and have
outdated technology and/or software with
security vulnerabilities.
An upstream company that neglects
cybersecurity can suffer tens of millions
of dollars in potential losses from one attack,
with the severity depending on the
organization's size and operations.
The news media covers the ransom
demands associated with high profile ransomware
attacks, but it rarely highlights
attacks' other costs, which include the
time and money dedicated toward conducting
forensic IT investigations, obtaining
legal advice, restoring data and
https://www.bokfinancial.com/
American Oil and Gas Reporter - August 2023

Table of Contents for the Digital Edition of American Oil and Gas Reporter - August 2023
