CyberCube and Munich Re have published the key findings of a joint study on severe ‘cyber accumulation’ events and the relative resilience of organizations to systemic events due to effective mitigation measures.
The survey gathered insights from 93 cybersecurity professionals, and the results provide a view of how systemic cyber events could unfold and of the factors that drive risk exposure across different organizations.
According to a majority of the respondents, a severe malware event could infect up to a quarter of all systems worldwide, but they agreed that in that case only 15% may be fully compromised. Respondents do not believe that an event where more than 50% of the world’s systems are completely compromised is possible.
The survey identified the most plausible vectors for widespread malware propagation as software vulnerabilities, compromised software supply chain updates, and operating system flaws. While social engineering was overwhelmingly seen as the most likely method for initial access, it was not rated as a major driver of mass-scale infections due to its limited scalability. This suggests that although phishing and user error remain critical concerns, systemic malware events are more likely to exploit structural weaknesses in software and infrastructure rather than human factors alone. This distinction is important for organizations seeking to prioritise mitigation strategies effectively.
Patch management, network segmentation, and data backups are identified as the most effective mitigations that organizations have against widespread malware attacks. When done effectively, such mitigations can reduce the chance of being affected by a widespread malware attack by 50% to 80% and reduce the financial impacts from such an event by a similar amount.
Cloud outages
The respondents agree that wide-area cloud outages are possible and likely to last hours to days. Outages beyond 72 hours are considered unlikely but not impossible.
Findings show at least a medium level of dependency on cloud services across most industries, with companies’ business-critical operations increasingly reliant on them. Reliance tends to decrease with increasing company size.
Financial losses scale with cloud outage duration: respondents reported that a single-day outage of their most critical cloud service provider (CSP) would typically result in financial losses equivalent to 1% of annual revenue. However, if the outage extended to five days, more than half of respondents estimated that losses could rise by a factor of seven or more. This non-linear escalation highlights the compounding impact of prolonged disruption and underscores the importance of robust business continuity planning.
Using multiple CSPs was not found to be effective; the option to transfer service from one CSP to another during an outage was seen as unfeasible. Respondents rate Azure, AWS, and Google as the best prepared to mitigate against a major cloud outage and to recover from such an event.
Emerging risks
The respondents believe that new technologies will begin to affect the threat landscape at about the same pace that they are being adopted in cybersecurity practices.
According to cybersecurity experts, in the near term, industrial and consumer Internet of Things (IoT) devices pose the biggest concern. Large Language Models (LLMs) are regarded as having an impact now, while Artificial General Intelligence (AGI) is seen as a greater concern in five or more years.
A fundamental challenge in cyber risk modelling is the deficiency of concrete tail-risk events, such as systemic malware or multi-region cloud outages. The joint survey represents the best attempt to parameterise plausible worst-case scenarios and establish expert consensus. Its objective was to advance market understanding, particularly concerning risk mitigation strategies for systemic cyber events.
