The ransomware trend continues to run rampant. One in four breaches involve ransomware, and organized crime actors use ransomware in more than 62 percent of incidents. Cyber criminals are taking advantage of these new opportunities to exploit a greatly expanded attack surface: But ransomware is only one small piece that a security leaders has to manage. The threat of ransomware is compounded by a distributed workforce, trends toward technology consolidation, geopolitical upheaval, and budget constraints.

This week in London, SecurityScorecard hosted a roundtable discussion on cyber risk in the insurance supply chain. Keynote speaker Santosh Pandit, head of Cybersecurity at the Bank of England, shared his insights with 20 London-based insurers on managing cyber risk in the financial sector and the latest regulatory initiatives that may impact the insurance industry.

New disclosures regarding the widespread exploitation of CVE-2023-34362, a new vulnerability affecting the MOVEit file transfer software, and the Cl0p ransomware group’s claim of responsibility for its widespread exploitation and the resulting data theft, have continued in the weeks since the vulnerability’s original publication.

Effective communication is at the heart of any successful organization. It ensures that information is clearly conveyed, understood and acted on. But sometimes, despite our best intentions, there can be a gap between what we say and what the other person hears. The result? Confusion, misunderstandings and missed opportunities. When it comes to talking about cyber risk, you can bridge this communication gap by translating technical, information security data into the language of business impact.

Cyber risk quantification (CRQ) can be an invaluable tool. The ability to put a number to cyber risk aids in communicating with board members, planning strategic investments, calculating the return on investment of cybersecurity spending, and right-sizing cybersecurity insurance coverage. However, many organizations avoid taking advantage of CRQ due to some common misconceptions.

Last week, a vulnerability in the popular MOVEit managed file transfer service was exploited by the CL0P ransomware gang to execute data breaches – an increasingly common cybersecurity attack technique where popular software is exploited to target, by extension, their users. Victims of this hack include British Airways, Boots, BBC, and multiple US government agencies.

“Market risks” are risks specifically related to investments. These risks are defined by the behavior of the market overall, and can be caused by factors unrelated to your line of business. Really, any market fluctuations in any area might potentially affect your company’s investments. Market risk also refers to risks that are inherent to investments, in the sense that some amount of uncertainty will always be at play.

When it comes to improving cybersecurity at your organization, there are some fixes that you can undertake with very little preparation. More robust risk remediation efforts, however, usually start with a cybersecurity risk assessment. These assessments are commonly offered by third-party consultants, sometimes as a stand-alone service and sometimes as the first step in a larger end-to-end cybersecurity engagement.

At Mend.io, we’re always looking for ways to help organizations understand their application security risk. This week, we’re proud to announce a new initiative designed to make it easier than ever for organizations to visualize and remediate their biggest sources of risk: the Mend.io AppSec Risk Assessment Program.

Every cybersecurity leader is looking for best practices to prevent cyber threats and cyberattacks. Chief among them is a relentless focus on cyber hygiene—the practice of maintaining the cyber health of your digital infrastructure. Good cyber hygiene significantly lowers the chance of cyber incidents. Indeed, a Bitsight study found that poor cyber hygiene, as determined by an organization’s security rating, increases the risk of a ransomware attack by 4.6 times.