>> Thank you Janet. It's a pleasure to be

>> This is a great question and I think it

Escalating cyber attacks are reflecting the increasing volatility of the global environment and according to the world economic forum AI is anticipated to be the most significant driver of change in cyber security in 2026. An entity operate operating online is at risk of a malicious attack and constant vigilance is required to mitigate that risk in 2026. What does that look like? I'm Janet Eastman and today on Trade Securely, my guest is Sophia Kudlick. She is senior vice president cyber and technology at Hub International and she's going to help us understand the current risk landscape and navigate through it. Sophia, great to have you on the show. Uh thanks for joining us and give us a little bit of background on yourself. >> Thank you Janet. It's a pleasure to be here. I am uh currently at hub sitting in the broker seat uh liazing between businesses and insurance companies. However, over the past 10 years uh my career has spanned from incident response and forensics to insure techs as well too. So I'm excited to bring that full circle here to my client advisory at hub. >> Okay, perfect. So let's let's kick things off with the evolution of the cyber risk. How has the cyber security risk evolved over the last 5 years? >> This is a great question and I think it speaks uh you know more credibly to my experience especially since I'm returning back into the cyber insurance world after 5 years being really solely focused on cyber attacks and cyber claims. What I've noticed is that of course the cyber risk has evolved and um you know there's a growing sophistication in attacks. Not only that, the frequency and severity of these attacks are also growing. So, it's not getting any simpler for businesses to combat these um these digital risks. If anything, they're increasing at enormous speeds. And um this really is changing the conversation in terms of what businesses need to do in order to stay vigilant. Overall, I'd say in the past two to three years, the insurance market specifically has gone through a change where there's a lot of competition flooding the market. It's easier than in the past uh for businesses to procure cyber coverage. They're getting broader terms at cheaper prices. So, overall, it's a great buyer market to consider how to effectively transfer risk. However, not long ago, uh during the pandemic, this was a very different story. going remote overnight really meant that thread actors really had frontline access to businesses their personal data which weren't secured. That gave rise to you know the the biggest spike in cyber attacks that we've seen ever. Um so the market is the insurance market is uh coming out of that a little bit now which is positive to see but I am uh hopeful but not optimistic that it will continue to be that way for much longer considering the evolution of cyber attacks how crafty cyber criminals are getting these days. Mhm. I think it's interesting that you said the speed of them has really really increased because I have personally noticed that myself. But uh anyway, let's talk about the current impact and what key risks are challenging business now and what could evolve in 2026. >> Absolutely. So I like to anchor the conversation into uh you know the the risks that we have always seen and the risks that we will continue to see. that being social engineering fraud or funds transfer fraud. This is when businesses are tricked or duped into transferring money um to an unknowing party. Business email compromise. This is when either with loss and stolen credentials, there is a threat actor that gains access into your emails and your system and is planning their attack. The most severe is the third type of attack and this is ransomware. Ransomware has always been uh you know the frontlininer and synonymous with cyber risk as well too. This is where um you know data is encrypted, businesses are shut down, there's potential business interruption effects and cyber criminals are really extorting an organization in order to get back up and running or to retrieve their data. So these are sort of steady and true uh and have always been in the cyber risk landscape. However, where we're seeing the conversation change is around how businesses interact with others. So, this whole concept of thirdparty risk is now becoming front and center because it's not just about how you protect your own business. Your security is relying on how other vendors um or other uh other companies that you rely on as a partner conduct their cyber security as well. those challenges can lead to business interruption uh which is really something that we're seeing quite concerning. So through this third party risk angle, we are expanding our conversation about cyber security risk to encompass not just the company itself, but who are you doing business with? How are they protecting their systems? And what does that mean for you if they go down? So this is something that's changed a lot more in the last 5 years that we've seen this reliance on external parties as well. So apart from those steady and true cyber risks, this is where we're seeing the conversation change. >> Wow. Okay. Um I may can we just expand a little bit on that third-party risk part of it just very briefly? I I'm looking at it kind of like as the supply chain. >> Yes. >> Right. You you can't you can't you know what you're doing but you don't know what either side is doing beside you in your Yeah. So it's it's very much the same way. Right. >> Absolutely. And the way we like to advise our clients is you know a lot of this third party risk management comes in the form of contracts. So what standards you set for the businesses that you rely on or that rely on you. How do you set that baseline cyber security standard? Um, and how do you hold those other companies accountable to what you believe is good risk management? I think the misconception a lot of the times is, you know, we own this data, but because we're transferring out to a third party, whether that's your payroll or any other type of software as a service, you think that you're the company thinks that they're ridding themselves of that risk or transferring it out. Ultimately, this is a misconception because that data still belongs to that company and there is still inherent risk that if that data was breached by not not by any fault of your own by that by by that third party um that still falls back on the company to address those uh you know breach response uh matters and uh potential litigation that could arise out of that. So the conversation doesn't stop at transferring out that risk uh or transferring out your data or relying on other parties. If anything, it expands the net and expands the footprint of where your risk sits today. >> Okay, that is a great explanation. Thank you. Okay, let's talk about the role that AI is playing in cyber attacks and cyber security. >> Absolutely. So I think that this is the biggest and most concerning shift and change. Uh before I think 5 10 years ago, we could rely on spelling errors or something that seems a little funky or off in emails or u you know thread actors really trying to get creative in terms of how they're gaining access to your credentials, your email, trying to get you to part with funds. However, now AI has really grown the grown in uh sophistication and the accessibility to not just the topline thread actors who know this business and have been doing it for years, but it really introduces those um less sophisticated amateur thread actors to enter into the criminal ring >> because of these standards that are now lowered uh due to AI. those attacks uh that attack surface is broadening. So if if there is a situation where a company is compromised the time the dwell time um so when a threat actor is sitting in a system studying it deciding how best to proliferate their attack that time is shortening by a lot because of AI. Cyber criminals are able to really scan this scan the environment, target different types of documents, consolidate in in minutes if not seconds. Um that is different than the types of tactics that were used in the past. Um they were studied, they they took a longer time. Now we're seeing that shift in sophistication really really increase. So, just like we're using AI in our day-to-day lives, um, becoming more efficient and transferring some of those mundane tasks, cyber criminals are doing exactly the same thing except at quicker speeds as well, too. So, that's from the attack surface uh, standpoint where we're seeing the most concerning evolution with with AI and how these attacks are are um, growing in severity as well. >> Wow. Okay. So, what should businesses be watching for and guarding against? Like the landscape seems pretty scary out there. What what and what else should they be telling their staff about mitigating these risks? Are there flags to be watching for? >> Absolutely. And and I think that this is one of the positive tales over the last 5 years. we've seen cyber security risk um sort of gain more importance, more headlines and more airtime when it comes to businesses up from the you know starting from the boardroom all the way down to frontline staff. I think the key takeaway is that cyber security risk is no longer an IT problem that was siloed for so long um that now it's becoming uh a lot more of an organizational issue. Um so every single employee is a steward of that organization of that data of protecting that data of flagging something if something feels off. So because we are all gatekeepers um of this risk we are the first line of defense um in that defense and depth really network. And what I mean by that is the more layers of defense that are added by an organization, the better and quicker they can detect when someone is trying to gain access or something feels off. So these layers, they they coexist, but your employees are certainly um the first uh line of sight into when something is off. Should that fail, um, that first firewall, there there goes, you know, there's a a a sequence of different types of riskmanagement tactics that could be used by businesses and that we have seen proven um through claims that work. They minimize the severity of losses, they stop the bleeding, and they stop the damage before it gets out of control. Certain examples of this are uh backups. So testing and keeping backups offline and and testing them frequently uh really is your best line of defense in a ransomware scenario if that data is uh locked away, extorted, you don't have access to it. This gives an organization a fighting chance to recover without relying on those cyber criminals. Another example is really monitoring um that overall attack surface. So really here we're we've evolved the conversation from firewalls to endpoint detection and response or EDR for short. But what good is uh you know a security system if you have no one watching it right so this is where the conversation is changing from EDR into MDR which is called uh managed detection and response. This is so this is where a security team is actually managing and monitoring the behavioral uh changes um of an external network before um you know someone can breach those those digital walls. So those are just two examples of what we see not only in the insurance landscape but in the security world being you know topline items um for for defense. But I think overall, you know, focusing on security, proactive measures as well too, training your staff, making cyber become uh a cultural shift. Cyber risk is a cultural shift of an organization where we're not shaming employees and potentially clicking a link. We're empowering them to know what to do next. Um, so when we gravitate away from that type of culture and invest in more of a proactive culture, the more focused we can be to like, oh, there's a claim. What do we do next? Who do we call? How do we move forward? >> Okay, let's talk about the role of insurance in cyber security. How can you effectively ensure against a cyber incident? >> Absolutely. So I like to uh describe insurance as a really effective risk transfer mechanism that has gotten organizations a lot of leverage when it comes to cyber cyber security and cyber budgets. Effectively cyber insurance is you know a risk transfer mechanism. So this is how organizations as the last resort can transfer out um some of that risk when it comes to dealing with a cyber incident. However, baked into it, cyber insurance has so many benefits that's that have become more proactive in nature rather than reactive and just sitting um on sitting and waiting for a claim to happen. So, first and foremost, I just like to delineate that why cyber insurance is different is because it has not only the thirdparty traditional liability component that we see in a lot of insurance policies. This is protecting companies against litigation and lawsuits as a result of a privacy or data breach. But they have this firstparty component as well too which provides boots on the ground out-ofpocket immediate support when there is a cyber incident. Not a lot of organizations have this roster of digital forensics breach coaches sitting and waiting to jump in and happen uh to help with an incident. So I think that this is one of the things that differentiates the cyber policy the most. And moreover, what we find is that insurance companies today are baking in a lot of proactive measures to help organizations build up their risk management. Um help provide more defenses in that defense in-depth system and really advise organizations on what to look out for when it comes to overall cyber risk management. >> Okay, quick question in there. We were talking earlier that you know uh when you're worried about AI and and the other risks you're looking at your own business but you're looking at the businesses that you deal with and you know transfer off some of your components like payroll and things like that. Does this cyber security insurance um protect that? >> Yes, great question. So there are elements that do. Yep. They're called things to look out for on your cyber insurance policy are contingent business interruption or dependent business interruption. So this isn't only the interruption that you face. It's um you know as a a downstream effect from those supply chain or third parties as well too. Perfect. Okay. So what's your key takeaway from everything that we've talked about today? And this is a huge subject and we you know we've we've scratched the surface but what's your key takeaway for listeners today? Yeah, I think there's we we sit in a really unique point in time right now where with the softening market conditions, it's making cyber insurance a lot more accessible for organizations than it's ever been before. The market has evolved. The cyber insurance landscape is has become incredibly innovative and broadened. Um, and this is really positive takeaway for businesses who are looking to ask the right questions. If you work with the right experts, you are able to take advantage and leverage this time so that when the pendulum comes swinging back around because of the scary AI landscape that we briefly discussed, it's only a matter of time that we start to see the growing attacks become a more of a problem for businesses and the cyber insurance market will in my opinion eventually catch up um increasing prices and and being a little bit more scrutinous on terms, >> right? So I think that this is this is a moment in time to really take a look at your risk management, ask the questions, bolster your policy, really see what needs to be done proactively so that down the line when we start to see the growing sophistication and severity of these types of attacks, businesses are wellprepared to ride the storm and uh really understand that this is a long-term play and despite the volatility, how can organizations put themselves in the best spot right now today given where we are to protect themselves against this type of volatility. So, that would be my my takeaway. And I know we talked a lot about a lot of scary things with AI, but as always, um I think that there's I'm a I'm a diehard optimist. And I think that there is a lot of opportunity in the market today for more sophistication, uh more collaboration, and more of a proactive stance on how we manage cyber risk. >> Okay, one final quick question. I u you know, people may say, "Oh, well, nothing like this is going to happen to me. I'm a small company. I'm whatever. I think from my standpoint, I'm looking at it and going, sure, they're going to want to attack the bigger companies where maybe there's more money to be pulled out, more data or whatever, but they're also looking for an easy entrance, right? So, it this is this is something that applies to every company. >> Absolutely. And you said it right. I think that, you know, uh a phrase that gets overused in the cyber insurance industry is it's not if, but when. Um, I think that small businesses have historically thought that because they don't have valuable data, they're not on the radar, they are somewhat sheltered. However, we saw a really stark shift in that mentality, especially when it came to the pandemic where it's because small businesses are underresourced and in the IT and and cyber security budget side. Um, they are lowhanging fruit to the cyber criminals. And if you put on your thread actor hat, you can see that those guys, they're just trying to make a quick buck and they're really going after Why spend weeks, if not months, trying to go after the big fish when in a few minutes they can they can really uh do some damage and extort a small business. So we see the spray and prey method being used a lot and it still continues to hold true which is a really unfortunate reality that small businesses are the most exposed but the most underprotected uh from a cyber security angle. >> Okay Sophia, thank you so much. This has been really really helpful. >> Thank you for having me. >> Yeah, my pleasure. Sophia Kudlick is senior vice president cyber and technology at Hub International. I'm Janet Eastman. Thank you so much for listening to the Trade Securely podcast and please share it with your friends and colleagues. You need to get yourself protected. You can find business news tools to help you trade and grow securely at trade seccurely.ca or get a stronger understanding of how trade credit insurance can support your business at receivables insurancecanada.com. You can also follow us on LinkedIn at receivables insurance association of Canada or subscribe to our YouTube channel at trade securely. I'm Janet Eastman. Thanks for listening.

Arming Against the Unseen: Cyber Security in 2026

Show Full Transcript

Repurpose this content with AI