As the cyber threat environment continues to grow in complexity and multiply in its perils, companies must think more about and devote more resources to protecting their networks, technology infrastructure, and employees, panelists on a recent Lockton and CrowdStrike webcast said.
Threat actors have expanded their attack methods, thanks in large part to artificial intelligence’s (AI) help in honing their techniques and lowering the barrier to entry for newcomers or less capable hackers.
Criminal groups use AI to craft authentic-looking social engineering fraud schemes to trick employees into granting unauthorized access to networks and systems. Threat actors can use AI to deploy their attacks at scales that were once unimaginable.
Companies and their information technology teams try to keep up, but the threats continue to multiply. Companies continue to fall victim to cyberattacks, sometimes due to basic and easy-to-overlook cyber and AI failures.
Companies have virtual private networks and firewalls at the edge of their network infrastructures, but forget to use them. They sometimes exempt employees from multi-factor authentication procedures, making them weak points in otherwise sound security protocols. They may inadvertently misconfigure cloud settings.
The results can be severe. Data extortion, an increasingly common attack method, can expose companies to significant ransom demands to prevent the sale of stolen sensitive data to the highest bidder.
Panelists discussed how companies can manage these risks, including:
Comprehensive AI governance
Consistently enforcing AI and cyber policies
Managing and understanding contracts with vendors, including indemnity obligations and liability caps
Conducting preparedness training, such as tabletop exercises and red teaming to test incident response plans
Panelists also contemplated the latest developments in cyber insurance, including how insurers are approaching AI-related threats. Whereas insurance carriers once easily granted cyber policies, underwriters are asking increasingly detailed questions and expecting more stringent protocols from policyholders.