In an age where digital and financial risks are increasingly interconnected, cyber hygiene stands as a pillar of modern risk management, essential to preserving both operational resilience and financial credibility. This means that cyber hygiene must shift from a technical concern that principally troubles IT departments to a critical component of modern organizational risk and reputation management. The routine actions and practices that protect data and secure systems are now central to an assessment of an entity’s risk management practices and, ultimately, its creditworthiness.
At the same time, cyber threats continued escalation is propelling external parties (including regulators, credit rating agencies, and insurers) to increasingly assess organizations’ cyber security practices as indicators of broader risk management strength. Simply put, cyber hygiene lapses are now recognized to have financial consequences, that can affect everything from insurance premiums to the cost of credit.
Cyber hygiene is now a core practice
Digital transformation has reshaped the commercial world, integrating technology into nearly every aspect of operations. That has brought incredible opportunities, but it has also opened doors to new threats. Cyber attacks are more frequent and sophisticated, with malevolent actors targeting everyone from individuals to major corporations and entire countries.
It is no exaggeration to say that establishing, and maintaining, effective cyber hygiene has become indispensable. According to Microsoft’s 2023 Digital Defense Report, effective cyber hygiene could prevent 99% of cyber attacks.
Yet cyber hygiene is not just about preventing attacks, it is also central to maintaining operational stability and resilience in the event of a cyber breach. In that event robust cyber hygiene can limit the operational, financial, and reputational impact of a cyber attack, thereby enhancing an entity’s overall risk profile.
Given organization’s already significant, and still increasing, dependence on digital systems, those twin benefits elevate cyber hygiene to a position of import equal to any core operational practice.
How Cyber Hygiene Affects Creditworthiness
Creditworthiness is typically associated with financial strength. Yet an assessment of that strength must factor in an organization’s ability to manage and mitigate risk, including cyber risks. Inadequate cyber hygiene, which exposes an organization to potentially costly disruptions, regulatory penalties, and reputational damage, can harm a company’s finances and its operational stability.
Recognition of that fact has driven those that assess credit quality, including S&P Global, to incorporate cyber hygiene within their evaluations of companies’ overall risk management and governance practices. Evidence of effective cyber hygiene indicates preparedness, resilience, and an ability to manage risks that can influence a credit profile. Poor cyber hygiene not only increases the risk of cyber attack but is a gap in response and recovery planning that could amplify the effects of a breach and is a sign of potentially broader vulnerabilities in an entity’s operations. Poor cyber hygiene may also affect assessments of overall management and governance, if there is a belief that an entity is more likely to experience material financial consequences from a breach, potentially impacting ratings and thus weakening a rating assessment prior to such an attack.
Even though it’s critical, data suggests that many organizations struggle to implement even basic cyber security measures effectively. For example, a 2024 survey by Extrahop, a Seattle-based cyber security services provider, found that over half of the respondents admitted to using at least one unsecured network protocol, making them susceptible to attacks. Additionally, 51% of respondents reported that more than half of the cyber attacks targeting their organizations stemmed from inadequate cyber hygiene.
Key cyber hygiene practices include:
- Multi-factor authentication (MFA), which requires more than just a password to gain system access, making it harder for unauthorized users to infiltrate.
- Network controls that limit access to sensitive data and systems, reducing the risk of internal threats and preventing unauthorized users from compromising critical resources.
- Vulnerability management, that ensures systems and applications are up-to-date, and closes known vulnerabilities that cyber criminals might exploit.
- Data protection that tracks data assets and includes appropriate controls to protect valuable information.
- Antimalware protection, which ensures appropriate controls are in place to detect and block malware and minimizes the potential impact of ransomware and phishing attempts.
- The development, implementation, and testing of incident response plans that ensure operational continuity and stability.
The Role of Cyber Insurance in Mitigating Risk
In the battle to minimize the financial and operational risks from cyber attacks, insurance is an increasingly important, and arguably essential, tool. Yet here too cyber hygiene is emerging as an increasingly important factor.
As insurers become more sophisticated in their underwriting practices, they increasingly require organizations to demonstrate effective cyber hygiene before offering coverage. Organizations with poor cyber hygiene can face higher premiums or be denied coverage altogether. Companies without adequate insurance are exposed to greater financial vulnerability in the event of a cyber attack, with potential implications for creditworthiness.
Regulatory Pressures and the Need for Vigilance
Regulators too are increasingly focusing on cyber hygiene, and are putting in place stricter requirements for data protection and cyber security. Organizations that fail to meet these standards risk regulatory penalties resulting in financial and reputational harm, and increasing the potential for loss of customer trust.
A record of non-compliance with established cyber security regulations and failure to keep pace with emerging standards is a red flag that can raise concerns about an organization’s broader risk management practices and ultimately weigh on assessment of its creditworthiness. On the other hand, organizations that meet cyber hygiene regulatory standards could avoid negative impacts to their finances and risk management assessments given their commitment to safeguarding customer data, to the benefit of their creditworthiness.
Cyber Hygiene Should Be Embedded In Corporate Culture
Truly effective cyber hygiene can’t simply be a top-down pursuit, nor can it be an exercise enforced solely through periodic reviews. In a world in which any employee can open the door to an attack by clicking on a link or failing to deploy a security patch, cyber security practices require buy-in across all levels of an organization. Without organization wide understanding of cyber hygiene, and regular training to refresh that understanding, even the most secure environments can be vulnerable
A culture of cyber hygiene supported by investment technology and processes, and aligned to organizational targets and regulatory standards, is the front line of defense against evolving digital threats.
Increasing digitalization, including new technologies such as AI and cloud computing, mean that organizations that don’t prioritize cyber security practices to safeguard assets will be exposed to ever greater risk of disruption. That will weigh in the assessment of their creditworthiness, affect the cost of and availability of insurance, and be central to building trust based on a reputation for resilience and reliability.
About the Author
Martin Whitworth is Lead Cyber Risk Expert, New Product & Analytical Innovation, at S&P Global Ratings. Martin provides cyber risk expertise to S&P’s credit analysts, the Emerging Risk Research & Development team, cross-practice cyber working groups and the cybersecurity research lab.
Martin is a seasoned security and risk leader with over 30 years of experience in practical information security and risk management. He has served as CISO and senior security and risk leader for several blue-chip organizations across sectors including, financial services, utilities, professional services, education, and IT services. In these roles, he has developed and implemented a variety of security and risk strategies and has extensive experience in successful business and board engagement.
Martin has also led research activities for leading industry analyst firms in the security and risk space and has considerable experience as a trusted advisor to security leaders in both the public and private sectors, internationally, and in collaboration with standards and regulatory bodies.
He earned a Master’s degree in Philosophy from the University of Wales and a Bachelor’s degree in Mathematics from The City University, London. Martin is a Chartered Mathematician and a member of the Institute of Mathematics and its Applications.