Third-party risks are emerging as key drivers of cyber insurance claims across 2024, a new star in the line up of cybersecurity threats.

This is accordning to a 2024 review from cyber risk management company Resilience, which found that third-party risks account for 31% of clinet insurance claims, and nearly a quarter (23%) of material losses over the year.

“Third-party risk isn’t only making headlines—it’s driving unprecedented losses. While this risk is often invisible until it’s too late, it’s now clear that the industry has reached a tipping point,” says Vishaal “V8” Hariprasad, co-founder and CEO of Resilience.

“Businesses can no longer afford to consider their partners’ vulnerabilities as siloed from their own. By understanding this new reality of shared risk, enterprises can make smarter business decisions and meaningfully mitigate material loss.”

Third-party risks lead to material losses for the first time in 2024, Resilience found, underscroding the emerging vulnerabiliutes created by interconnected systems and the increased relience on outside vendors.

Ransomware attacks on vendors was the most significant form of loss within third-party risks, with 42% of all claims and 100% of all incurred losses from third-party claims.

However, while ransomware attacks create known losses, some losses from 2024 have yet to be fully realised – for instance, the Crowdstrike outage is anticipated to result in financial losses from businss disruption.

While companies enahnce their vendor selection processes in response, insurance companies are also adjusting their practices to deal with the emerging threats.

Recommended reading

• Comment | The Growing Threat of Third-Party Cyber Risks
• Third-party Attack Vectors Plague Insurance Companies
• UK Proposes Ban on Public Sector Ransomware Payments

Ransomware Still On Top

Ranking as the top contributor to third-party risk, ransomware held its position as the top loss cause in 2024 of first-party ransomware incidents, with 43% in 2024.

However, ransomware’s targeting of third-party vendors created a significant porportion (18%) of total incurred claims, showing the move can be a lucractive tactic for ransomware gangs.

All in all, 62% of all incurred claims with losses were related to ransomware, wither third- or first- party.

Resilience found that supply chain attacks, critical infrastructure vulnerbailities, and legacy systems were contribhutors to these ransomware incidents.

High-pressure industries, like healthcare and manufacturing, were especially vulnberable due to outdated technology and the devastating implications of down time.