A new report, Overcome by Cyber Risks? Economic benefits and costs of alternate cyber futures, examines the economic impact of cyber costs versus the benefits of interconnectivity under an array of complex scenarios.
The report, a collaboration between Zurich Insurance Group and Atlantic Council, the international affairs think tank, uses economic modeling tools of the Pardee Center at the University of Denver to gain an understanding of just how cyber costs and benefits affect national gross domestic product (“GDP”) over time – and what businesses and policy makers can do in the meantime.
The report explores four alternate scenarios based on two major uncertainties: The dominance of governments versus the private sector in matters of cyber security, and whether risks will be largely manageable or become unmanageable to the point that stable and secure connectivity becomes a luxury good.
“Cyber Shangri-La,” a best case scenario outcome from the report details a possibility where technology booms are driven and supported by strong cybersecurity and the subsequent annual economic benefits result in a potential cumulative net global gain of $190 trillion by the year 2030 – that is about $30 trillion higher than that of the current projection case.
On the opposite end of the spectrum, the most undesirable future scenario, called “Clockwork Orange Internet,” envisions a state of perpetual cybercrime and cyber-warfare that ultimately creates a negative impact of 2.5 percent of global GDP. While this net loss is still not enough to drag down the cumulative benefits to a point where risks outweigh the benefits, if cybersecurity falls dramatically behind, leading to a future of non-stop nation-state cyber attacks and hacks against increasingly vulnerable critical infrastructure, the world could miss out on $90 trillion relative to its current trajectory, according to the report.
Along with the potential future scenarios that the report outlines, it provides specific recommendations to executives who are responsible for creating their companies' cybersecurity protocols as well as policymakers who have a hand in shaping national cybersecurity laws.
Among the recommendations for businesses, the report calls for a continued focus on resilience, the ability to bounce back from disruptions to make them as short and limited as possible. This includes measures such as building redundancy, incident response and business continuity plans; conducting scenario planning and exercises; and considering worst-case cyber futures when looking at business strategies.
For policy makers, the report recommends that governments work with the private sector for “next generation” solutions, with priority given to investments in overall stability, governance and resilience.