The Return of the Black Swan: How Emerging Technology Will Impact Cyber Risk and Insurance

Monumental technology shifts come in waves. While innovation remains a constant, there are times when emerging technology fundamentally changes how the world works and organizations operate. In periods of gradual advancement, organizations can adapt their resilience programs to prepare for risks they see coming — so-called gray rhinos. But during cycles of emergent technology, anticipated cyberthreats can morph into unprecedented forms that risk and resilience programs are unprepared to handle.

The rapid proliferation of artificial intelligence has launched the world into one of those cycles, and organizations must contend with a stark reality: Black swan events are firmly back in play.

New Technology Is Reshaping Risk

Black swans — rare, unpredictable events that are difficult to prepare for — become more likely under certain conditions. As people and organizations embrace generative artificial intelligence and other forms of AI, they venture from familiar, known risks into uncharted territory.

For example, it’s widely understood that discussing sensitive, private information on a public chat forum is a major risk concern since anyone can view the information. But when software engineers at a leading technology company attempted to improve their unreleased proprietary code by having ChatGPT analyze it, they didn’t know they were providing the chatbot’s parent company with full ownership and access to the entered data. Subsequently that code could then be freely disseminated to anyone else using the service, including potential competitors and cybercriminals.

That situation highlights the twofold challenge modern technology creates for organizations: the inherent risks that come with the technology itself, and the risks that come from people interfacing with it.

The Dual Risk Challenge

By its very nature, modern technology comes with a set of unknowns that can expose organizations to increased risk. It could be a flaw in a program’s code, misconfigured application access, or myriad other security vulnerabilities IT teams need to address. Those are risks directly from the technology itself. But the emergence and sudden ubiquity of AI adds a wrinkle into cybersecurity, with new technology creating complex vulnerabilities directed at system users.

Deepfakes — AI-generated video and audio meant to look and sound exactly like a real person — have been used in sophisticated phishing campaigns to trick employees into divulging sensitive company information. By creating believable messages that look and sound like legitimate information requests from a known source, cybercriminals are launching spear phishing attacks that are increasingly difficult to recognize. In other examples, bad actors have used generative AI chatbots to create emails that look authentic to try and trick employees into providing security credentials.

And this is only the beginning. AI is continuously getting better at mimicking human language, speech, and even facial movement. This has created a world in which organizations must not only prepare for cybercriminals to sneak in the back door, but for employees to be tricked into handing them the key to the front.

According to a report by Tokio Marine, a 1-in-200-year cyber event could cause up to $33 billion in economic loss. That only tells part of the story, though. Cyber events are not random occurrences like natural disasters; they are deliberate, planned actions driven by motivated cybercriminals. This makes modeling the likelihood and shape of a cyberattack challenging, particularly because AI has created a potent, new dimension to cyber breaches.

Preparing for New Risks

Despite the uncertainty that new technology brings to organizational risk, there are some steps companies can take at the board level to better position their resilience strategies. These include:

• Alignment of risk strategy across technical, financial, and leadership teams
• Organization of core governance documents, including business continuity, incident response, and crisis communication
• Development and maintenance of a cyber response playbook
• Oversight of resource allocation and budgets

These actions can help risk managers and their organizations take a proactive approach to incident response, even during a black swan event.

Regulation Is on the Way

Organizations aren’t the only ones keeping an eye on the emergence of AI and its related technologies. Regulatory bodies are beginning to implement new rules as the impact of emerging tech and its implications to cyber breaches become clearer. Specifically, the Securities and Exchange Commission’s new cyber disclosure rules will come into effect in mid-December.