Why investors should care about cybersecurity

Today 100% of companies rely on the internet to operate, compared to one in four 10 years ago, according to a study from Accenture.

Add to this greater connectivity the increased volume of data being handled by companies, and the shift to remote working brought about by Covid-19, and it’s not hard to see why cybercrime represents a significant risk for companies.

Cybercrime in the headlines 

There has been a spate of recent high-profile cyberattacks in which significant companies have been held to ransom. 

Colonial Pipeline, the largest fuel pipeline in the US; JBS, the world’s biggest meat processing company; Ireland’s national health service; and South Africa’s shipping terminals are just some of the recent victims of ransomware attacks. 

A ransomware attack is a type of cyberattack that involves locking the user out of their own files or systems and demanding a ransom in return for access. In Colonial Pipeline’s case, the ransom was $4.4 million, while JBS was forced to pay the equivalent of $11 million. 

Other examples include the foreign exchange company Travelex, which was held to a $6 million ransom in early 2020; the attack on British Airways in 2018 (which resulted in a $26 million fine for the company because it was found not to have sufficient security measures in place) and the 2016 hack into the central bank of Bangladesh’s systems, where criminals made off with $81 million.  

Many attacks don’t make the headlines. On a global basis, it’s reported that more than 30 billion data records were stolen in 2020. This is more than in the prior 15 years put together. In the US alone, the FBI received a record nearly 800,000 cybercrime complaints in 2020, a 69% increase on 2019’s total complaints, with reported losses at more than $4.1 billion. In Europe, cyber attacks increased by 75% over 2020 compared to 2019. 

Cybercrime prevention: spending surge 

The cost of cybercrime globally is expected to hit $6 trillion annually in 2021, and $10.5 trillion by 2025, according to Cybersecurity Ventures, a cyber research company. Cybercrime costs include damage and loss of data, money, productivity, intellectual property, business interruption, the restoration of hacked data and systems and reputational damage. 

As a result, spending on protection mechanisms has sky-rocketed. Global spending on cybersecurity products and services is expected to increase at a compound annual growth rate (CAGR) of 7.7 -14.5% between 2020 and 2026. CAGR indicates the growth rate over multiple periods, taking into account the effects of compounding. 

Figure 1: Cyberspend is expected to grow at 7.7-14.5% CAGR (USD bn annually)

What does cybercrime look like? 

Cybercrime can take various forms and is becoming increasingly sophisticated. Most involve a user unwittingly clicking on dangerous links or opening harmful attachments that install malicious software (known as malware), enable the disclosure of confidential information and prevent legitimate users from accessing to necessary systems and data.  

Figure 2: Types of cyberattacks

Weak spots of cybercrime vulnerability

Email is the most common way attackers infiltrate a company’s systems and data. Employees therefore represent the biggest weakness, with the main cause of cybersecurity failures reportedly being human error. This could be an employee failing to install security updates in time, not using a strong enough password to protect sensitive data or falling prey to phishing emails.  

On a global basis, 43% of firms view employee naivety about cybersecurity as their most significant organisational weakness, according to the 2021 State of Email Security Report issued by the cybersecurity provider Mimecast. This percentage is notably higher in some countries: in the UK, the Netherlands, South Africa and the United Arab Emirates 50% or more participants view employees’ lack of cyber knowledge as a major threat to their companies’ security, according to its survey.  

Rob Hyde, Schroders’ Chief Information Security Officer and Head of Enterprise Technology, said: “Training our employees is our best defence against cyberattacks. While we have high-security products to provide protection, ensuring our employees are educated as to how to spot a suspicious email or link is key to our ability to effectively guard our systems and data. 

“Corporations have four key adversaries that we try to protect ourselves from. The ‘malicious outsider’ is someone external to the organisation that tries to penetrate our defences in order to access sensitive or proprietary information. The ‘malicious insider’ is similar, but is an employee that we’ve trusted with access to such information. The ‘accidental insider’ is an employee who has unwittingly become part of an attempted attack by clicking on a harmful link or opening a harmful email. We also have the ‘supplier’, which refers to the risk we take on when engaging the services of third-party providers.  

“We have measures in place to guard against all four of these and are constantly improving our protection as attackers are becoming increasingly sophisticated in how they try to penetrate our defences.  The advent of cryptocurrencies, for example, is creating a means for attackers to profit from their actions in ways that the traditional financial services system would make very difficult,” he said. 

Cybercrime can have a considerable impact on financial companies

Any firm that uses the internet is a potential target for cybercriminals and a cyberattack can have a significant impact on a company, whether that’s financially or operationally.   

There is also the reputational damage associated with having security defence breaches. On average, it takes two years for a business's reputation to recover after a data breach is revealed, according to research by HSBC. Meanwhile share prices of companies affected tend to underperform by 15.6% in the following three years. 

Figure 3 & 4: Effects of data breaches on reputation and share price 

The finance sector tends to be the worst affected: it experienced the greatest decline in stock prices, of -16.7% on average against the NASDAQ, in comparison to the technology sector, which averaged -2.9%. 

Figure 5: The finance sector tends to fare worst

Assessing a company’s cyber preparedness 

A company’s cyber preparedness should be a crucial consideration in an investor’s investment decision. It is a business risk that investors can’t afford to ignore, according to Samuel Thomas, a sustainable investment analyst at Schroders.  

“We use our proprietary ESG tool, CONTEXT, to help us measure how well a company is managing cyber risk. This involves assessing whether companies have a cyber security certification and ranking companies on how well they protect their customers’ data. 

“We gain further insights through direct company engagement, focusing on how well a company can answer the questions such as: 

1) Is there responsibility for cyber security and data privacy at the board and management level? 

2) How is the company’s technical expertise organised? 

3) What training and monitoring of employees and suppliers is in place? 

4) To what extent does the company work with external cyber security specialists?” 

Fund managers Katherine Davidson and Charles Somers use the above approach to assess the cyber preparedness of the companies they invest in.  

Katherine says: “Ideally, we’d like to see more cyber security and data privacy expertise at the board and management level of the companies we invest in. Typically, this would include a chief information security officer or data protection officer in charge of cyber matters.” 

Research by accounting firms Deloitte and Grant Thornton finds only 8% of FTSE 100 boards had a chief information security officer (CISO) in 2018. Meanwhile more than one-third of FTSE 350 companies that reported technology and cyber security as a key business risk in 2019 did not have directors with relevant expertise on their boards. In the oil and gas, consumer goods and financial sectors, this figure was 50% or more.   

“We also want to see adequate protective systems and controls in place, rigorous and systematic testing of these systems and controls, and regular updates of security software,” says Charles.  

“It’s important to us too that there’s appropriate training of employees and suppliers and that the security team use external specialists to keep up-to-date with industry trends and best practice.” 

A selection of Schroders’ cyber engagements

Given its increased materiality, we have been engaging with companies on the topic of cyber risk and security for some time now. 

For example, we undertook a mass engagement in 2018 with ten of our investee companies across sectors such as financial services, technology and telecoms, which is discussed further in this article: Cyber risk – how investors can prepare for the unpredictable. 

The following year, 2019, saw us engage with hotel group Marriott International, pharmaceutical company Lonza, technology firm Science Applications International Corporation and human resources company Recruit.  

Lonza: 

• Our fact-finding engagement with Lonza yielded greater insights into how they apply cyber best practices 

• There is board level expertise with regular briefings from top management. 
• There is clear and direct management responsibility with dedicated team resources. 

• Risk is pro-actively managed at the group level with penetration testing, interactions with third party expertise and cyber insurance. 
• There is regular communication and coordination between technology counterparts in the various business units. 

Marriot International: 

• While we conduct our own research in-house, we complement this by reviewing external ratings on a quarterly basis to ensure we are assessing risks holistically from a range of perspectives. An MSCI downgrade, driven by the company’s limited data privacy policy and data security governance which lagged peers, and a data security incident in late 2018, prompted our engagement. 
• Specifically, we asked for better and more transparent reporting on data security governance.  

• The company has since included this in its sustainability reporting.

Science Applications International Corporation: 

• Following an acquisition, we contacted the company to gather information on how cyber security was being addressed. 
• We discovered the company has the right tools and processes in place to mitigate cyber security risks, including the appropriate oversight at board level. 

Recruit:  

• After a data breach in September 2019, we engaged with the company and suggested restructuring so that oversight of data security and privacy sat at the board level.  
• Recruit employed new executives to fulfil this role at the board level after our engagement. 

In 2020, we engaged with digital services company Reply SpA and security system provider AssaAbloy. 

Reply SpA: 

• We contacted the company to gain more visibility of its data security practices and human capital management. 
• We requested additional detail on aspects of Reply’s cyber resilience strategy to help investors more meaningfully understand its level of risk exposure and management approach.  
• In particular, we asked for greater granularity over existing compliance mechanisms, such as the scope and frequency of audits and employee training on privacy and data security issues. 

AssaAbloy: 

• We undertook a fact-finding engagement to learn more about the company’s cyber security processes and oversight.  
• We were happy with the response we received from the company but encouraged them to add direct oversight and expertise at the board level.