Here's why investors should consider cyber preparedness in their investment decisions and how Schroders has engaged on the topic.
Today 100% of companies rely on the internet to operate, compared to one in four 10 years ago, according to a study from Accenture.
Add to this greater connectivity the increased volume of data being handled by companies, and the shift to remote working brought about by Covid-19, and it’s not hard to see why cybercrime represents a significant risk for companies.
There has been a spate of recent high-profile cyberattacks in which significant companies have been held to ransom.
Colonial Pipeline, the largest fuel pipeline in the US; JBS, the world’s biggest meat processing company; Ireland’s national health service; and South Africa’s shipping terminals are just some of the recent victims of ransomware attacks.
A ransomware attack is a type of cyberattack that involves locking the user out of their own files or systems and demanding a ransom in return for access. In Colonial Pipeline’s case, the ransom was $4.4 million, while JBS was forced to pay the equivalent of $11 million.
Other examples include the foreign exchange company Travelex, which was held to a $6 million ransom in early 2020; the attack on British Airways in 2018 (which resulted in a $26 million fine for the company because it was found not to have sufficient security measures in place) and the 2016 hack into the central bank of Bangladesh’s systems, where criminals made off with $81 million.
Many attacks don’t make the headlines. On a global basis, it’s reported that more than 30 billion data records were stolen in 2020. This is more than in the prior 15 years put together. In the US alone, the FBI received a record nearly 800,000 cybercrime complaints in 2020, a 69% increase on 2019’s total complaints, with reported losses at more than $4.1 billion. In Europe, cyber attacks increased by 75% over 2020 compared to 2019.
The cost of cybercrime globally is expected to hit $6 trillion annually in 2021, and $10.5 trillion by 2025, according to Cybersecurity Ventures, a cyber research company. Cybercrime costs include damage and loss of data, money, productivity, intellectual property, business interruption, the restoration of hacked data and systems and reputational damage.
As a result, spending on protection mechanisms has sky-rocketed. Global spending on cybersecurity products and services is expected to increase at a compound annual growth rate (CAGR) of 7.7 -14.5% between 2020 and 2026. CAGR indicates the growth rate over multiple periods, taking into account the effects of compounding.
Figure 1: Cyberspend is expected to grow at 7.7-14.5% CAGR (USD bn annually)
Cybercrime can take various forms and is becoming increasingly sophisticated. Most involve a user unwittingly clicking on dangerous links or opening harmful attachments that install malicious software (known as malware), enable the disclosure of confidential information and prevent legitimate users from accessing to necessary systems and data.
Figure 2: Types of cyberattacks
Email is the most common way attackers infiltrate a company’s systems and data. Employees therefore represent the biggest weakness, with the main cause of cybersecurity failures reportedly being human error. This could be an employee failing to install security updates in time, not using a strong enough password to protect sensitive data or falling prey to phishing emails.
On a global basis, 43% of firms view employee naivety about cybersecurity as their most significant organisational weakness, according to the 2021 State of Email Security Report issued by the cybersecurity provider Mimecast. This percentage is notably higher in some countries: in the UK, the Netherlands, South Africa and the United Arab Emirates 50% or more participants view employees’ lack of cyber knowledge as a major threat to their companies’ security, according to its survey.
Rob Hyde, Schroders’ Chief Information Security Officer and Head of Enterprise Technology, said: “Training our employees is our best defence against cyberattacks. While we have high-security products to provide protection, ensuring our employees are educated as to how to spot a suspicious email or link is key to our ability to effectively guard our systems and data.
“Corporations have four key adversaries that we try to protect ourselves from. The ‘malicious outsider’ is someone external to the organisation that tries to penetrate our defences in order to access sensitive or proprietary information. The ‘malicious insider’ is similar, but is an employee that we’ve trusted with access to such information. The ‘accidental insider’ is an employee who has unwittingly become part of an attempted attack by clicking on a harmful link or opening a harmful email. We also have the ‘supplier’, which refers to the risk we take on when engaging the services of third-party providers.
“We have measures in place to guard against all four of these and are constantly improving our protection as attackers are becoming increasingly sophisticated in how they try to penetrate our defences. The advent of cryptocurrencies, for example, is creating a means for attackers to profit from their actions in ways that the traditional financial services system would make very difficult,” he said.
Any firm that uses the internet is a potential target for cybercriminals and a cyberattack can have a significant impact on a company, whether that’s financially or operationally.
There is also the reputational damage associated with having security defence breaches. On average, it takes two years for a business's reputation to recover after a data breach is revealed, according to research by HSBC. Meanwhile share prices of companies affected tend to underperform by 15.6% in the following three years.
Figure 3 & 4: Effects of data breaches on reputation and share price
The finance sector tends to be the worst affected: it experienced the greatest decline in stock prices, of -16.7% on average against the NASDAQ, in comparison to the technology sector, which averaged -2.9%.
Figure 5: The finance sector tends to fare worst
A company’s cyber preparedness should be a crucial consideration in an investor’s investment decision. It is a business risk that investors can’t afford to ignore, according to Samuel Thomas, a sustainable investment analyst at Schroders.
“We use our proprietary ESG tool, CONTEXT, to help us measure how well a company is managing cyber risk. This involves assessing whether companies have a cyber security certification and ranking companies on how well they protect their customers’ data.
“We gain further insights through direct company engagement, focusing on how well a company can answer the questions such as:
1) Is there responsibility for cyber security and data privacy at the board and management level?
2) How is the company’s technical expertise organised?
3) What training and monitoring of employees and suppliers is in place?
4) To what extent does the company work with external cyber security specialists?”
Fund managers Katherine Davidson and Charles Somers use the above approach to assess the cyber preparedness of the companies they invest in.
Katherine says: “Ideally, we’d like to see more cyber security and data privacy expertise at the board and management level of the companies we invest in. Typically, this would include a chief information security officer or data protection officer in charge of cyber matters.”
Research by accounting firms Deloitte and Grant Thornton finds only 8% of FTSE 100 boards had a chief information security officer (CISO) in 2018. Meanwhile more than one-third of FTSE 350 companies that reported technology and cyber security as a key business risk in 2019 did not have directors with relevant expertise on their boards. In the oil and gas, consumer goods and financial sectors, this figure was 50% or more.
“We also want to see adequate protective systems and controls in place, rigorous and systematic testing of these systems and controls, and regular updates of security software,” says Charles.
“It’s important to us too that there’s appropriate training of employees and suppliers and that the security team use external specialists to keep up-to-date with industry trends and best practice.”
Given its increased materiality, we have been engaging with companies on the topic of cyber risk and security for some time now.
For example, we undertook a mass engagement in 2018 with ten of our investee companies across sectors such as financial services, technology and telecoms, which is discussed further in this article: Cyber risk – how investors can prepare for the unpredictable.
The following year, 2019, saw us engage with hotel group Marriott International, pharmaceutical company Lonza, technology firm Science Applications International Corporation and human resources company Recruit.
Science Applications International Corporation:
In 2020, we engaged with digital services company Reply SpA and security system provider AssaAbloy.
This communication is marketing material. The views and opinions contained herein are those of the named author(s) on this page, and may not necessarily represent views expressed or reflected in other Schroders communications, strategies or funds.
This document is intended to be for information purposes only and it is not intended as promotional material in any respect. The material is not intended as an offer or solicitation for the purchase or sale of any financial instrument. The material is not intended to provide, and should not be relied on for, accounting, legal or tax advice, or investment recommendations. Information herein is believed to be reliable but Schroder Investment Management Ltd (Schroders) does not warrant its completeness or accuracy.
The data has been sourced by Schroders and should be independently verified before further publication or use. No responsibility can be accepted for error of fact or opinion. This does not exclude or restrict any duty or liability that Schroders has to its customers under the Financial Services and Markets Act 2000 (as amended from time to time) or any other regulatory system. Reliance should not be placed on the views and information in the document when taking individual investment and/or strategic decisions.
Past Performance is not a guide to future performance. The value of investments and the income from them may go down as well as up and investors may not get back the amounts originally invested. Exchange rate changes may cause the value of any overseas investments to rise or fall.
Any sectors, securities, regions or countries shown above are for illustrative purposes only and are not to be considered a recommendation to buy or sell.
The forecasts included should not be relied upon, are not guaranteed and are provided only as at the date of issue. Our forecasts are based on our own assumptions which may change. Forecasts and assumptions may be affected by external economic or other factors.
Issued by Schroder Unit Trusts Limited, 1 London Wall Place, London EC2Y 5AU. Registered Number 4191730 England. Authorised and regulated by the Financial Conduct Authority.