OVERVIEW
THEMATIC INSIGHT
FIND OUT MORE
Download the full publication
(for existing clients)
The new age of digital is exciting and promising for people, organisations and economies but it does come with a very destructive flipside: cyber attacks. Cyber attacks are fascinating in many respects: for example, their extent, scale, variety, increasing sophistication, persistent mutation, exponential multiplication and destructive power. Conversely, it is astounding to observe how poor the data is on cyber crime, how little attention it gets from companies as well as investors, and how few companies disclose on their cyber security strategies. Cyber risk management is a major strategy issue that cannot be overlooked, and this is what makes cyber security all the more important and exciting for investors.
The digital boon is a double-edged sword
Data is the new world’s most valuable resource but unlike natural resources it is neither fungible nor rivalrous. It proliferates at exponential rates and comes in many forms. The introduction of new digital enablers like Big Data analytics, AI and deep learning will allow companies to make this data even more valuable.
Regulators are struggling to cope
While stakeholder scrutiny is intensifying our analysts don’t think it goes far enough. Regulation comes as a fitting example. According to ITU’s Global Cyber security Index report, only 38% of countries have a published cyber security strategy, meaning there is still ample room for improvement in cyber security regulations worldwide.
Cyber risk: not enough ado about the next big thing
By continuing to use our website, you are accepting our use of cookies. The cookies we use are "analytical" cookies. They allow us to recognise and count the number of visitors and to see how visitors move around the site when they are using it. To find out more or to change your cookie preferences, please refer to our cookies policy.
#contentwithimpact
This page contains financial analysis which reflects the opinion of the Cross-Asset Research department of Societe Generale, at the date of its publication. It does not necessarily reflect the views of the other departments of Societe Generale nor the official opinion of the Societe Generale group. This content has been prepared for use by institutional and professional investors and is not intended for retail investors. Investors should consider this report as only a single factor in making their investment decision.
© Societe Generale 2021
Cookies Policy
Legal Information
Contact
Global cost of cyber crime estimated at between $400bn and $3tn
It is estimated cyber crime cost the global economy between $400bn and $3tn in 2018 and that the figure could reach $90tn by 2030. Estimates of the cost of cyber
attacks can vary greatly depending on the expert, one thing seems certain: the cost is colossal and will keep on rising.
But digitalisation also means companies will end up being more exposed to cyber risk. It requires companies to open up their business models as well as their IT systems, and usually to outsource more which can be an aggravating factor. In addition, the IoT boom will multiply the number of end-points that can be used as hacking backdoors.
On top of that, protecting digital assets is becoming increasingly complex while cyber attacks are becoming increasingly destructive, overwhelming, evolving and accessible. Anybody can launch a cyber attack now causing the ranks of hackers to grow. And this wargame is all taking place under the rising scrutiny of stakeholders.
The EU seems to lead the pack in terms of cyber security regulation. In the US, many acts have been introduced, but few of them have been enacted. The two main
laws that we have identified relate purely to fostering public-private partnerships and information-sharing. As far as Asia is concerned, regulation maturity and depth differ from country to country, with China progressing quickly and South Korea emerging as a cyber security champion.
The average cost of a data breach for a company will be
$150m in 2020e. The challenge of estimating the average total cost of a cyber attack for a company is illustrated by the wide range of estimates available which can vary by a factor of more than 100x. Still, depending on which expert survey you look at, the average cost of a cyber attack/data breach climbs significantly, from below $100k (Radware) to $1.3m (Kaspersky Lab), $3.86m (Ponemon Institute), $11.7m (Accenture) and $150m in 2020 according to Juniper Research.
ACCEPT
Our analysts' regulatory review shows that most of the time, regulations targeting companies are often either voluntary or relate to a handful of sensitive sectors, rather than each and every corporate. In any case, as cyber risk awareness grows and cyber security regulations toughen, the world will inevitably see an increase in the number of mandatory disclosures of data breaches thereby increasing the overall damage caused by those breaches. According to Juniper Research, reported data breaches could account for 90% of all breaches by 2023, compared with only 10-20% today.
Investors must also keep in mind that the average cost of a data breach will increase because of the introduction of new regulations.
Global cyber security index:
heatmap of national cyber security commitments in 2017, from green (highest) to red (lowest)
Source: International Telecommunication Union
MORE THEMATIC INSIGHTS
By continuing to use our website, you are accepting our use of cookies. The cookies we use are "analytical" cookies. They allow us to recognise and count the number of visitors and to see how visitors move around the site when they are using it. To find out more or to change your cookie preferences, please refer to our cookies policy.
ACCEPT
#contentwithimpact
Contact
This page contains financial analysis which reflects the opinion of the Cross-Asset Research department of Societe Generale, at the date of its publication. It does not necessarily reflect the views of the other departments of Societe Generale nor the official opinion of the Societe Generale group. This content has been prepared for use by institutional and professional investors and is not intended for retail investors. Investors should consider this report as only a single factor in making their investment decision.
© Societe Generale 2021
Cookies Policy
Legal Information
Investors must bear in mind that a company hit by a cyber attack will not only incur visible costs like the cost of restoring data and systems or revenues lost through business disruption, but also indirect/hidden costs like customer losses, opportunity costs, reputational harm and loss in equity value.
Sector and geography-wise, it appears that banks and US companies, respectively, are the most heavily affected by cyberattacks.
Banks and US businesses are the favourite targets
Potential impact on global banks’ profits from cyber attacks as a % of net income
In the specific case of banks, the IMF estimates cyberattacks could wipe out up to 50% of their net profits under extreme circumstances.
Estimated average cost of a breached record in 2017 (in $)
The conclusion is straightforward for companies: if they want to go digital and make sure they remain a going concern, they have to implement a proper cyber security strategy.
On top of that, protecting digital assets is becoming increasingly complex while cyber attacks are becoming increasingly destructive, overwhelming, evolving and accessible. Anybody can launch a cyber attack now causing the ranks of hackers to grow. And this wargame is all taking place under the rising scrutiny of stakeholders.
The average cost of a data breach for a company will be $150m in 2020e. The challenge of estimating the average total cost of a cyber attack for a company is illustrated by the wide range of estimates available which can vary by a factor of more than 100x. Still, depending on which expert survey you look at, the average cost of a cyber attack/data breach climbs significantly, from below $100k (Radware) to $1.3m (Kaspersky Lab), $3.86m (Ponemon Institute), $11.7m (Accenture) and $150m in 2020 according to Juniper Research.
Global cyber security index: heatmap of national cyber security commitments in 2017, from green (highest) to red (lowest)
Source: International Telecommunication Union
Source: International Telecommunication Union
Sector and geography-wise, it appears that banks and US companies, respectively, are the most heavily affected by cyberattacks.
Estimated average cost of a breached record in 2017 (in $)
![](http://media-s3-us-east-1.ceros.com/societe-generale/images/2019/05/08/dc4474967aa58ba6612f9bdabdc75a80/plus-icon.svg)