S&P Global Inc. (SPGI) Earnings Call Transcript & Summary

Hello, everyone. Welcome to our first Cyber Risk Insights webinar of the year. Last year, we began this series of monthly webinars to discuss how cyber risks are affecting credit ratings. Today, we kick off with our views on cyber trends and credit risk for 2023. My name is Alexander Gombach, Director of Structured Finance, and I'll be moderating today's call. With me today for our first portion: Scott Crawford, Research Director of Information Security, 451 Research, S&P Global Market Intelligence; Sudeep Kesh, Chief Innovation Officer at S&P Global; and Tiffany Tribbitt, Senior Director, U.S. Public Finance and Lead for Global Cyber Security Research. So before we begin, we have a few housekeeping issues. We know some of you have pre-submitted questions. And during the presentation, you'll have an opportunity to ask questions by typing them into the QA box on the left side of your screen. Immediately following our discussion, we will take as many questions as time permits. Please send your questions at any time during the webinar. You don't have to wait until the end of the presentation. You can find a copy of today's presentation and links to publications we mentioned at the bottom of your screen in the red resource list, which is also on the left side of your screen. We'd like to let everyone know that a replay of this webinar will be available in 24 hours, and that can be found on our website at s&pglobal.com/ratings. The replay is valid for 1 year. And please complete our post-webinar survey by filling out the form on the right side of your screen. It will remain present throughout the duration of the live event. It will also pop up automatically at the conclusion, so you may save your responses until then. I cannot stress this enough. Your feedback is truly important to us, as you will likely see today. We carefully consider all comments and suggestions for improvement. So about a year ago, Ukraine's governmental systems were attacked and users were met with a message on their screens: "Be afraid and expect the worst. This is your past, present and future." This seemed an ominous sign of things to come in the area of cybersecurity. And since then, we saw a wide range of attacks and incidents through the year unleashed not only by the war but by other actors and in other theaters, such as the MFA-related attack on Uber, the Optus breach in Australia. A recent world economic cybersecurity study noted that 91% of respondents stated that they believe a "catastrophic cyber event" is possible within the next 3 years. So how to make sense of all of this? And how might it impact credit risk and ratings? Well, our panel today have attempted to shed light and bring much needed insight and detail to this topic in their recently published piece, Cyber Trends and Credit Risks.

So to begin, Tiffany, can you start us off with key takeaways from that research?

Sure, Alex, and thank you for having us all on here today to give us an opportunity to kind of dig into this research. I'll start with the kind of our key takeaways. We've put them on a slide for you so that I don't have to read them all out. But really, the headline here is that last one. The overall takeaway here is that we really view cyber risks as something that should be embedded into overall risk management policies for our issuers. It's not something anymore that's only banks and governments should be thinking about. It's really everyone because this is an evolving risk. Sudeep and Scott are going to talk more about that later in this presentation. But we really do expect our issuers to kind of stay on top of the trends, adapt as new technologies emerge or as best practices evolve. Some of the notable trends that I'll cover here are kind of going back to what you were saying, Alex. We've seen this really come to a head with the Russia-Ukraine conflict. We're living in an age of hybrid warfare. Cyberspace is simply another battlefield. This can really cause collateral damage in terms of third-party vendor risks and spill-outs from attacks. We saw those back with the NotPetya attack. And I know that Scott later is going to kind of talk about how some of these systemic risks can really amplify the impact of an attack. Another one of the areas that we've been monitoring is disclosure. We're seeing some of the regulators really got interested in what folks are writing about cyber and what are they doing to protect against attacks? Are they disclosing when they do have attacks? And as a ratings agency, we always love disclosure, but we're also looking at as increased disclosure, does this increase reputational damage for companies? Could this become a regulatory risk if you're not complying with the disclosure regulations? And so that's something we've been monitoring. And then I'm going to flip to another slide with some eye-popping numbers just about some of these trends. And I think all of these numbers really get at what we've been saying for a while now. This is a threat that's not going away. It's only going to continue to increase in importance and credit relevance. We've seen insurance premiums rising. I know we got a lot of questions about insurance, so we're going to dig into that in a little bit. The cost of attacks, the number of attacks, the cost of IT budgets, all these things are trending upward as we're entering into a downward cycle in the economy. So it's going to be a very pressured situation for issuers, making really tough choices in how they're allocating budgets. Finally, this brings me back to where I started. Cyber risks aren't going away. We really need to evolve our understanding of the threats, and we expect to see our issuers embedding cybersecurity preparedness and response planning into their enterprise risk management strategy. There are a lot of interesting takeaways when you dig into the attack trends and things like how much time does an attacker have in the network. And my co-author, Sudeep, did a lot of research on that for our piece. And so I'll hand it back to you, Alex, to go to him for some takeaways there.

Yes. Thanks, Tiffany. That already is a key theme developing, right? This constant evolving nature of this risk that we really saw last year. So Sudeep, can you give us some perspective on how that threat landscape has evolved and what you're thinking about for 2023?

Sure. Thanks, Alex, and thanks to the audience for their attendance as well as all of -- we've gotten a lot of great comments in terms of the research, and I'd really encourage everyone to read the research that's sort of attached to this. But I think when we talk about evolution, a lot of times, I think cyber's a scary topic, right? So we just have to sort of acknowledge that. And -- but I don't want to give the impression that it's perpetually sort of accumulating to something that's worse and worse and worse things. Some things get better, some things get worse, but it's really important to just kind of call it how it is. And as Tiffany alluded to, it's a big problem, right? So it's $10.5 trillion is the projected cost of global cyber crime by 2025, so just 2 years from now. Just to keep that in perspective, I mean that's nearly 3/4 of the GDP of the second largest economy in the world, China. So that's a huge problem. It's also a people problem, largely. So Scott, my colleague, will be talking about some of the research in terms of user behavior. But what we've found is -- and digging through a lot of the data that's on the next slide, actually. And by the way, on the web version of this article, all of these graphics are interactive, so you could actually kind of play around and see what's happening. But really, 82% of the cybersecurity breaches that were investigated and some of the data behind the scenes is coming from Verizon has a report called the Data Breach Investigations Report, and they have a community database. It's an open source database. We were able to then pull that and mine it and be able to come up with some of these statistics. And we found that about 82% of the cybersecurity breaches investigated involve a human element. And some of these can be, in terms of how to rectify them, it's often something where staff training can do a great part of it. But also what -- piggybacking on what Tiffany was saying is that if you think about risk management more generally, it's a team sport. And you really have to have this level of sort of connectedness between the IT community, the security community within IT, the risk managers within an organization, the general management, the employees, human resources, training. All of these other things is -- they all facilitate a team, which is really the secret sauce to be able to defeat these things while also kind of recognizing that some things receive, for example, a DDOS attack that distributed service. So there's a lot of technology that has become ubiquitous that has reduced sort of the severity and sort of the widespreadness of certain attacks and then you have an increase in things like ransomware. And most recently, I know everybody's heard of ChatGPT and these different sort of AI-based technologies. Those are starting to become weaponized as well. So it's one of these things that we have to be hyper vigilant on development and technology in general and how they're actually -- can be weaponized in the sense of cyber crime, but also how we can use sort of the social constructs behind teamwork and really having sort of a cyber community, a risk management community, general management community, business community, user community all integrated, which is really part of the problem. One of the other things I just want to point out, and if it just kind of underscores the point, is on the next slide. This is what I call sort of a sleeping problem. Organizations typically discover a cyber attack months after a compromise. So it's particularly important to not rest on your laurels because the -- given the network effects of cyber attacks or the network nature of cyber attacks, these things can metastasize very, very quickly because you haven't seen them, like you don't know where the seeds are. So that's why it's really important that if you have this level of sort of comprehension in terms of your cyber strategy and it's actually holistic in nature, then you at least have more eyes to be able to kind of discover these kinds of things. And in the case of phishing attacks and things like that, then at least you have a community that's at least kind of blocking the entry for some of those seeds of destruction. So with that, let me just conclude. The cybersecurity industry, it's not nascent. There's been -- it's been an industry for quite a while, but it's still really in the early days. And there's a couple of people issues there as well in terms of a talent deficit. So roughly 40% of companies still don't have a CISO, a Chief Information Security Officer. For those that do, 25% are on the job for less than 1 year. And government institutions especially, I think it's this budgetary problem where things are constrained in terms of resourcing. So you may have to outsource a lot of these kinds of things, if at all. Sometimes it's just they don't even have the funds to even outsource things. But then it becomes kind of the providence of a third party, which has another spring of risks. And one thing I could say about the CISO because, for better or for worse, I've personally been contributing some of this deficit by hiring 1 or 2 CISOs from the industry, one of whom actually is Scott. So let me pivot there. So Scott can give some remarks. He's a former CISO with quite a lot of [indiscernible].

Great, everybody. And thank you again. Can you guys hear me okay?

Yes. Sounds good, Scott.

Very good. All right. Again, let me have my thanks to everyone for joining today. This is a very interesting topic, particularly for cybersecurity practitioners. The intersections of business and financial impact and cybersecurity is something we, as professionals have been following with great interest over many years. And what we're seeing now is actually a lot of that expectation begin to bear fruit in terms of what is actually the impact of cybersecurity on the business and how is that becoming manifest. And there are a few places where it's becoming manifest more than in an assessment of credit risk as well as other aspects of financial risk. We'll talk about risk mitigation as transfer here a little bit when we talk in more depth about cyber insurance, for which we have someone who's very well versed in that. But before we begin, let me just step back a little bit. So I've been in the industry as a cybersecurity practitioner for a few years now. And those of you who are on the call who are familiar with the field, who are cybersecurity practitioners yourselves, you know the evolution that we see in our field in terms of the broad overall trends. We went 20 years ago from focusing primarily on things like viruses to, roughly towards the end of the 2000s, we began to see evidence of the more focused adversary, meaning the adversary with the capability and the tools and the resources to pursue very specific strategic attacks. And a lot of these were low-frequency but high-impact incidents. And a lot of them began to become known as the advanced persistent threat, advanced in terms of the ability to field some bleeding edge, if you will, technology in terms of applying malware and attacker tools to an opportunity, persistent in terms of finding ways to embed themselves in an environment, avoid detection and discovery, and continue to have a presence in the target environment, sometimes for a while before they would have an impact or moving laterally around the environment to see what was possible to compromise as part of their strategy. Now that was the very focused, the low frequency but high-impact issue, but APTs, as they're so-called, began to become very commonly discussed in the market. Threat intelligence began to take off because organizations wanted insight into that level of threat. At the same time, however, we saw this evolution of what we had at the time called the industrialized threat, which meant much broader, perhaps lower impact per incident, but the ability to be very systematic about discovering common exposures and vulnerabilities, the ability to exploit those fairly routinely, and a market emerging around that very field, sometimes called the dark web depending on which side of it you may work on. But just as an example, these underground exchanges, aside from the legitimate economy that were -- they're businesses, and they were run very much like businesses. And in fact, they had a lot more latitude than regular businesses did because they weren't obliged to adhere to things like regulatory rules, compliance, standards and specifications. They could do basically whatever they wanted as long as they were effective, made a profit, were good business partners for their partners. And as we saw this mature, we began to see it become manifest, and [ Aversar ] is becoming very specific about these are the types of exposures that we can routinely exploit. And add to that, we can turn this into an even more of a good business if we quite literally hold the targets and the victims hostage. What we began to see coming out of that, if we can move to the next slide is, of course, what we have all become familiar with as the rise of ransomware. And this data point comes from our research at 451 Research within the Market Intelligence division here in S&P Global. And it's going to be no secret, I think, probably to most anyone on this call, we've seen a substantial rise in the incidence of malware, particularly as the pandemic began to become more prevalent, as the increased movement to working from anywhere began to take hold, as networks began to become even more interconnected and the enterprise had to reach out to wherever their personnel happened to be. That was a trend that was already in motion. But its prevalence and the dependence of businesses on that connectivity every day became much more pronounced. So much more widely connected points within any given network. But it also began to reveal what some of the consistent issues were in terms of cybersecurity strategy and practice within organizations. There's a saying among practitioners that everyone gets a penetration test, but you don't always get the results. If you have an incident or an attack, you most definitely get the results in ways that you don't want. And the consistency and pervasiveness with which we began to see ransomware take hold began to show up some of these issues. If we can advance to the next slide, we see how that's had an impact on the perceptions of security practitioners in responding to these incidents. This again is from a survey we conduct as part of our voice of the enterprise here at 451 Research. We asked organizations about their plans and expectations in terms of what they would anticipate in a ransomware attack. We asked them -- they told us that they thought that their endpoint security tool would interrupt the attack. They figured that their network defenses would. They figured that they would be able to successfully restore from a backup. The projected responses you see in the light aqua there, I guess, would be the color. Their actual responses though, check out -- click that slide just once if you would, please, to highlight the one thing that really does stand out. They anticipated -- only 7% anticipated before the fact that they would actually pay the requested amount of the ransom in order to get control of their systems and their data back. In reality, among those that we surveyed who actually had sustained a ransomware attack, nearly 1/4 of them, 22% said, yes, we did pay. So this, in turn, has had an impact on risk mitigation and risk transfer. We can advance to the next slide. We'll see that organizations have increasingly looked to cyber coverage, which has grown in its own right as a dedicated form of insurance, partly because of some of the outcomes and precedents that have occurred in terms of attempting to claim it under terms such as general liability and so on, the rise of cyber insurance coverage over the last several years. In fact, when we ask our survey respondents, do they currently have cybersecurity insurance, 71% of them said yes. Only 29% said no, but of that 29%, another 38% of them -- and this survey was taken last year, another 38% of them said that they, yes, were planning to purchase cybersecurity insurance in the next 12 months. But what has happened, as you might imagine, is that given the rise of claims, particularly around issues such as ransomware, the cost of that insurance has risen, largely because the loss ratio sustained by insurers has risen as well. I'm going to pause there because we do have some depth of expertise on insurance per se and the impact of cyber on the insurance industry. So Alex, let me at this point, hand it back to you for moving forward.

Great. Thank you, Scott. Right. So as we heard, we received a lot of questions ahead of time. And by far, the biggest topic in those questions was cyber insurance. So since we know this was a topic that's so important to many, to better help us answer these questions, we've tapped none other than S&P Global Ratings Chief Analytical Officer for Insurance Ratings, Simon Ashworth. Simon, thank you for jumping in here at the last minute to help field some of these questions.

Sure. No problem.

Appreciate that. So first up, we have a bunch of questions around the theme of recent trends in cyber insurance coverage, terms and premiums. Can we talk a little bit about that?

Sure. Yes. Thank you. Pleasure to be here. I've actually waited 20 years for this moment for insurance to be so fashionable. So I'm going to make the most of this opportunity. I think I'm going to back up a little bit just to start and just talk about how important the cyber insurance market is for insurers and reinsurers. It is one of the key growth element within the market. But it's important to say that it is still very much in its infancy. Insurers and reinsurers are actually grappling with questions about how and even if they want to play in this space. So I think we've all heard about the topic of silent cyber, which Scott alluded to before, because often cyber coverage can sometimes be implicitly covered unbeknownst to insurers themselves and reinsurers within existing insurance coverage. And we really think that for a sustainable market to develop that, as Scott said, that actually needs to be segmented and really clearly attributable. Maybe just 1 or 2 more bits of background. So if we look at the economic costs from cyber, they dwarf any comparable other economic cost, economic loss information even compared to perils such as natural catastrophes. So the potential for this market is huge. And actually, in terms of insurance coverage of cyber economic losses, we're talking about 1% of economic losses that are currently covered. So a huge insurance protection gap at the moment. If we just briefly rewind to pre-COVID, this was a segment that was one of the most profitable for any insurer or reinsurer that played in this space. They were really getting extreme levels of profitability, partly because there weren't too many insurers or reinsurers willing to supply and partly because of the absence of larger or more frequent loss events with respect to cyber. But as we all know, excess profits don't last for too long. So Scott and Alex, as you mentioned, we've seen cyber insurance premiums really ramp up over the last couple of years, up almost 200% in some cases in aggregate. And in many ways, that is attributable to underlying loss and risk experience. Obviously, insurers and reinsurers themselves need to make some return on capital. But I think it's important to say that to the extent that corporates and other entities who are purchasing cyber insurance can really highlight that they are good risks or better risks. there's clearly refined pricing levels, just as would be the case if you're a good risk from an auto perspective, you'll get a more beneficial auto premium. So I think it's really also incumbent on corporates and entities themselves to demonstrate to their cyber insurers the depth of their risk management processes to really reduce premium quotes. Alex, back to you.

Yes. Thank you, Simon. Let's stick on insurance for a little bit. Can we talk about some of the metrics that these insurers are using to assess the effectiveness of the cyber risk mitigation? And Scott, I'm hoping you can jump in on this one.

It'd probably be better if I jump in with my microphone on. Yes, we have taken a look at that. We did actually ask organizations as far as their -- what are insurers asking them to do. In fact, that actually in itself highlights the evolution that we're seeing in the security technology marketplace. There's this growing group of companies that are working in, if you will, the interface between enterprises and businesses and their cybersecurity teams and their deployment, cybersecurity deployments, and the insurance industry. On the one hand, the insurance industry does need subject matter expertise to help advise them, guide them on what does actually constitute an insurable security posture. And for the practitioners and the enterprises, they need to know what will be considered acceptable and insurable with our insurers. And that is still rather nascent in terms of that segment that's growing up now, which means that the consensus on what those criteria are or should be is still growing. But what we see insurers are asking for is maybe not so much metrics per se as implementation of specific types of controls. And in particular, this could be interpreted as reflective of the nature of what they're seeing in claims, the issues that contribute to claims that they have to sustain. So they're asking organizations, are you implementing anti-phishing initiatives? There is a metric there that we do see occasionally that's something like there will be some sort of standard of -- not standard, but to criterion of, say, 15% or less of personnel successfully phished, if you will, in an anti-phishing exercise. E-mail filtration, not just for malware, but for suspicious domains, sandboxing a combination for remote connectivity, et cetera. Multi-factor authentication comes up quite often. And one of the reasons that ransomware has been so prevalent is the exploit of identity and access, privilege and controls. There are often a lot of overlaps in terms of the provisioning of access. There could be things like intergroup overlaps and memberships. So a member of one group can be a member of another that has overlapping privileges, which may not -- probably not the best way to deploy those. So identity governance administration, identity verification, these are areas that are growing up around these areas. Endpoint security, the nature of what's in place, antivirus, heuristic behavioral detection and so on, network security, including controls and lateral movement. Security operations, metrics there might include time to triage and contain incidents. Security monitoring response functionality, vulnerability and controls assessment and testing, compliance with an organization to find patching standards. Backup and recovery, obviously, a big one for ransomware in particular. In fact, the notion of immutable backups, which are and should be beyond the reach of compromise in order to support a good and reliable recovery, known return to operations time, testing and demonstrations of resilience. Ransomware specific measures such as a documented response plan, has this plan actually been exercised and tested to see how the organization would perform under these situations. So these are the types of criteria that we see insurers asking their insureds for in order to demonstrate their cybersecurity posture. For the insurers' sake, they do have to see these to get a handle on their loss ratios and continue to capitalize on the opportunity that cyber insurance presents, as Simon has so well described.

Great. Thank you. See, we've got continuing on this theme of insurance, let's think about cyber insurance and government. Tiffany, I think you're well positioned to answer this one. What levels of cyber insurance are carried by governments currently? What do we know about that?

Sure, Alex. And I'll say this one really varies. And I'll also use this question as an opportunity to talk about the fact that we don't really assess a proper level of insurance. What we're really looking at is how does this fit into your overall credit story? How does this fit into your overall profile? It's not really any different than how we look at other event risks. I know Scott mentioned earlier, we see these low-frequency, high-impact events. In my sector, we're looking at hurricanes and wildfires and things like that which our issuers are going to cover insurance for. And really when we're looking at this, it's not just do you have insurance or how much insurance do you have? It's also, well, how high is the risk here? What are you doing to mitigate those risks? What is your liquidity position? Do you have reserves, something we really look at for our local governments? Are you going to be able to float until you get reimbursements from the insurance policies that you carry? But a notable trend that we are seeing here in the U.S. at least is that in the government space, we're seeing some insurers start to get priced out as these premiums rise, which is something we've been talking about. And we're seeing this movement toward these shared risk pools or kind of shared service type agreements at the county or state level. And so that's something we're really monitoring here in the U.S. So I'll turn it back over to you.

Great. Thank you. So I think we're going to move on from some insurance questions and to some more broader topics here. So Sudeep, I'll turn this one to you. With the world becoming more interconnected than it was 10 years ago, what are the risks of a major cyber event in one part of the world negatively impacting companies from other parts?