Insurtech
Cyber Risk Has Shifted From IT Problem to Core Business Threat, Liberty Mutual Says
By Insurance Wire Staff, . Insurance Wire.
Cyber risk has crossed a threshold, and the insurance industry is being asked to respond accordingly. Risk and Insurance published a piece this week framing the shift in terms that underwriters and brokers will recognize: what was once treated as a back-office technology problem has become a threat capable of halting operations, triggering regulatory action, and destroying customer trust.
Erin Halchak, Chief Underwriting Officer for US Cyber at Liberty Mutual Insurance's Global Risk Solutions North America division, put it plainly: "The biggest shift is that cyber has moved from a technical problem to really a core business risk."
Halchak also described how the threat itself has widened. "Ransomware still remains a major concern, but the threat has really broadened to include phishing, social engineering, business email compromise, supply chain attacks, and data theft," she said. Attackers, the piece notes, are now using automation and artificial intelligence to run personalized attacks at a scale that was not possible a few years ago.
For insurers and brokers, the practical implication is that cyber coverage conversations can no longer be confined to IT budgets and patch cycles. A business email compromise attack, where a criminal impersonates a trusted contact to redirect payments, can drain a company's accounts without touching a single piece of software. A supply chain attack can compromise dozens of businesses through one vendor. These are financial and operational risks, not just technical ones, and underwriters pricing cyber policies need to assess them as such.
The piece argues that resilience, rather than prevention alone, is the right frame. No organization can guarantee it will never be hit. The question, as Risk and Insurance frames it, is how prepared a business is when an incident arrives and whether its insurance partner is positioned to help it recover, not just pay a claim.
That framing has real consequences for how cyber policies are structured and sold. A carrier that treats cyber as a narrow technology product, covering data breach costs but not business interruption or reputational harm, may find its policyholders underinsured when a sophisticated attack lands. Brokers placing coverage have an obligation to make sure clients understand what they are and are not buying.
What the Risk and Insurance piece does not establish is how the market is actually pricing these expanded risks, or whether current policy language is keeping pace with the threat evolution Halchak describes. Those are the harder questions, and they remain open.
For professionals reviewing cyber programs now, the signal from Liberty Mutual's underwriting leadership is worth noting: the risk profile has changed, the attack surface has widened, and a policy designed around yesterday's threat model may not hold up against today's.
Insurance Wire provides news and information, not insurance, legal, or financial advice. Consult a qualified professional about your specific needs.