axio - kn

As we continue to grow our Axio family, we’re turning the spotlight on our newest members. Today, we’re excited to welcome Jackie Lentz to the team. Jackie has a decade of experience in the IT industry with a focus on cybersecurity since 2015 and has recently joined us after her time as a project consultant and business manager at a boutique IAM consulting company out of NYC.

Despite the dog days of summer, Axio is growing…and we’re growing fast! In our new employee spotlight series, you will have a chance to meet the newest members of the Axio family.

Funds to Drive International Expansion and Continued Enhancement of Axio360 Platform, Which Empowers Security Leaders to Detect, Quantify, and Manage Cyber Risk

The stark reality of today’s cybersecurity threat landscape is that the traditional approach to managing risk is insufficient. Security leaders need a process that can drive value quickly and deliver results. Cyber risk quantification (CRQ) has emerged as a leading approach to many cybersecurity programs within the past few years. At Axio, we believe that CRQ is a critical component to success in solving cyber risk challenges.

The psychology of fear plays a central role in the success rate of social engineering cyber-attacks. These hackers rely on eliciting an emotional response from their victims, creating a sense of urgency towards action, which often works. This tactic is commonly referred to as “Fear, Uncertainty, and Doubt,” or “FUD,” and it’s not relegated to use by bad actors alone. FUD is also a ploy leveraged by cybersecurity vendors to drive urgency during sales cycles with organizations. By using fear to frame cyber risk, sellers hope to push buyers into a quick decision, which may result in purchasing products that don’t meet business requirements. With various budgetary factors in the balance, CISOs need an unbiased way to look at their risk program to plan and secure security resources, and they can’t be responding to emotion and fear.

With the flood of information coming from all levels of an organization’s cybersecurity landscape, the amount of data that CISOs and other decision-makers must wade through is unwieldy, at best. How can you decide which factors will drive your roadmap? What should be your highest security spending priority? How much will a ransomware attack cost your business? These questions and others are answered with quantification. Cyber risk quantification (CRQ) is necessary for business leaders to understand their organization’s cyber risk in financial terms, providing rapid and transparent results. Why, then, do many CISOs balk at the mere mention of “quantification?” Unfortunately, the term has earned a bad reputation in recent years, with some security leaders suggesting that CRQ does not deliver the results that many vendors claim.

In the year since the calamitous Colonial Pipeline cyber-attack, we’ve seen a heightened awareness and a greater level of engagement in cybersecurity initiatives from the government and industry leaders. For example, President Biden issued an ambitious executive order in May of 2021 to improve federal cybersecurity. In 2022, the SEC proposed an amendment to its reporting requirements around cyber incidents. Most recently in the private sector, the World Economic Forum (WEF) introduced the Cyber Resilience Pledge at its Annual Meeting, Davos 2022. The Pledge is an initiative directed at global gas and oil stakeholders, and it aims to reinforce cyber resilience against dangerous attacks and “mobilize global commitment” across industries.

Intro

In today’s cyber risk climate, water and wastewater utilities operators have discovered they are especially susceptible to cyber threats. The Oldsmar incident of 2021, in which hackers attempted to compromise the Florida town’s main water treatment plant, emphasized just how vulnerable this sector is. Such cyber-physical attacks on under-resourced critical infrastructure organizations have accelerated the growing need for cyber risk insurance. In 2021, insurers paid out significant claims due to ransomware attacks and are now requiring water utilities to meet more stringent cybersecurity requirements. Resources such as those made available by the American Water Works Association (AWWA), which assess the maturity of water and wastewater cybersecurity programs, can serve as a valuable first step for these organizations to build better cyber resilience despite underfunding or understaffing. When developing a cybersecurity program, a measured balance of technology and insurance is pivotal to success. In this article, we walk through the cyber insurance problems water utilities are currently facing, why it’s imperative these issues are addressed and discuss what actions will improve cyber insurability.