Kroll Report: CFOs Overlook Cybersecurity Risks Worth Millions of Dollars
On September 13, 2022, Kroll released the report "Cyber Risk and CFOs: Over-Confidence is Costly," revealing blind spots in CFOs' understanding of cybersecurity. The survey covered 180 senior financial executives worldwide and found that most CFOs are underprepared for cyber risks yet generally overconfident. The report notes that 71% of surveyed companies lost over $5 million due to cyber incidents in the past 18 months, and 61% experienced at least three major cyber incidents.
NEW YORK — A leading global independent risk and financial advisory solutions providerKrolltoday released the report "Cyber Risk and CFOs: Over-Confidence is Costly. The report found that although chief financial officers (CFOs) generally have confidence in their organizations' ability to respond to cybersecurity incidents, their understanding of the cybersecurity landscape is severely lacking.
Commissioned by Kroll and executed byIndustry Dive's StudioID, the report surveyed 180 senior finance executives globally and revealed three core themes:
1. Ignorance is Bliss: A Significant Gap Between Confidence and Knowledge
The survey showed that 87% of CFOs are "very confident" or "extremely confident" in their organization's ability to respond to cyberattacks. However, this level of confidence stands in stark contrast to CFOs' actual visibility into cyber risk issues—only 40% of respondents regularly hold briefing meetings with their cybersecurity teams. In other words, most CFOs maintain a highly optimistic view of their company's cybersecurity posture without sufficient information.
2. Broad Scope of Losses: Financial Impact Far Exceeds Expectations
Report data shows that nearly three-quarters (71%) of surveyed organizations suffered financial losses exceeding $5 million due to cyber incidents in the past 18 months; 61% of surveyed organizations experienced at least three major cyber incidents during the same period. Additionally, 82% of surveyed executives stated that after experiencing the most severe cybersecurity incident in the past 18 months, their company's valuation loss reached or exceeded 5%. These figures indicate that cyber risk is no longer a purely IT issue but a major risk factor directly threatening corporate financial health and shareholder value.
3. Increased Investment: Cybersecurity Budgets Continue to Grow
Facing increasingly severe cyber threats, 45% of respondents plan to increase information security spending as a proportion of overall IT budget by at least 10%. This trend reflects that the corporate world is gradually recognizing that preventive investment is far lower than the cost of remediation after an incident.
Expert Perspective: CFOs and CISOs Need to Work Together
Greg Michaels, Global Head of Cyber Governance and Risk for Kroll's Cyber Risk practice,stated: "We often see that CFOs do not fully appreciate the financial risks posed by cyber threats until they actually experience a cyber event. At that moment, they realize they not only need to be involved in recovery efforts—including approving emergency funding and procuring third-party vendor services—but also need to participate in strategic cybersecurity planning and investment decisions before and after the event. Ultimately, a cyberattack is a financial risk to the enterprise, and an event can have a significant impact on value. Therefore, cybersecurity must be integrated into broader enterprise risk considerations. CFOs and CISOs should work side by side to help organizations navigate both the operational and financial risks in the cyber domain."
David Ball, Managing Director of Kroll's Valuation Advisory Services,added: "Cyber events can cause substantial damage or impairment to a company's assets, especially intangible assets, including intellectual property, customer relationships, and brand value. CFOs must understand the impact of cyber events on these assets and possess the ability to assess and quantify the financial impact and potential risks, which is crucial to the company's long-term sound development."
The full report can be downloaded viathis link.
About Kroll
As a leading independent provider of risk and financial advisory solutions, Kroll leverages unique insights, data, and technology to help clients navigate complex demands. With over 6,500 professionals worldwide, Kroll continues its nearly 100-year legacy of expertise in risk, governance, transactions, and valuation. Its advanced solutions and intelligence services provide clients with a forward-looking perspective, helping build lasting competitive advantage. Kroll's values define how it partners with clients and communities. For more information, visitKroll.com。
