Board Questions on Ransomware Severity and Control Decay Risk

The Board-Level Governance Case for Ransomware Severity Tied to Control Decay

A board risk committee can reasonably assume a cyber reinsurance book is well underwritten if loss ratios have tracked to plan and the standard annual security questionnaire process is in place across cedants. That assumption is exactly what current industry data is starting to challenge, since encryption success rates and average recovery costs are both rising even in a market where frequency-side indicators look stable. This is precisely the kind of gap board oversight exists to catch, provided the board asks the right questions. Boards that only ask questions their own standard reports are already built to answer will never surface a risk those reports were never designed to capture.

Why Should the Board Ask About Ransomware Severity Tied to Control Decay?

The board should ask because current annual attestation processes were never designed to see a control decaying between renewal dates, making this a genuine structural gap rather than a lapse by any single underwriting team. A cedant can pass its questionnaire honestly at binding and still carry meaningfully weaker control coverage eighteen months later, without any formal event ever having flagged the change.

Standard board reporting on cyber underwriting typically tracks loss ratio and frequency trends, neither of which isolates whether rising severity is being driven specifically by decaying controls, a distinction the 2026 industry data makes clearer than ever before. A board that reviews only these standard metrics can believe the book is performing normally right up until a handful of severe, control-decay-driven claims reveal otherwise.

What Is the Single Most Important Question a Board Should Ask Management?

The single most important question is direct, whether the organization can currently distinguish cedants with recently verified, full-scope controls from those relying on a stale, point-in-time attestation from their original binding date. A confident, specific answer backed by actual data indicates management is already ahead of this risk.

A vague or reassuring but non-specific answer is itself the warning sign, since it suggests the organization has not yet built the continuous verification capability this risk genuinely requires. This question should become a standing item, asked consistently across meetings, not a single check that gets marked complete after one satisfactory answer.

How Should the Board Test Whether Management Has Real Visibility?

The board should ask for a specific figure, such as the share of the book with control verification older than twelve months, rather than accepting a general assurance that underwriting "monitors security posture closely." A management team with genuine visibility can produce this number, along with how it has trended across recent renewal cycles, without difficulty or delay.

What Should a Risk Committee Report on This Topic Include?

The report should show a severity trend over time, name the specific control categories, such as identity and access management, driving the largest gaps, and describe any underwriting or wording actions taken in response. A report that simply states the risk "is being monitored," without a trend line or specific control categories named, gives the board too little to exercise meaningful oversight.

How Often Should This Report Reach the Board?

At minimum annually, timed ahead of the main renewal cycle, though a board overseeing a book with meaningful exposure to smaller organizations or legacy-heavy sectors should consider a semi-annual cadence, given how quickly the underlying attack patterns have shifted in recent data. Reporting this only after a severe claim has already occurred defeats the purpose of proactive oversight entirely.

How Does This Fit Into the Organization's Risk Appetite Statement?

This risk should be added explicitly as a named severity-driver category with its own defined tolerance, rather than folded into general cyber risk appetite language written before this specific pattern was well understood. A general risk appetite statement can easily miss this exposure, since the shift toward identity-based attacks and rising encryption success is a relatively recent development in the data.

Naming it explicitly, with a tolerance such as a maximum acceptable share of the book with verification older than a defined threshold, gives management a concrete target to manage against and gives the board a concrete metric to hold them to. The capital and margin consequences of this severity trend are what should inform where that specific tolerance gets set.

What Should the Board Ask About Retrocession and Rating Agency Exposure?

The board should ask whether this severity trend has been disclosed proactively to retrocessionaires and rating agencies, and specifically how each has responded to that disclosure. Proactive disclosure, made before a severe claim forces the conversation, is viewed far more favorably by both audiences than the same information surfacing only after the fact.

A Cyber Maturity Assessment AI Agent output can give the board concrete, defensible portfolio data to reference in these conversations, rather than relying on a qualitative assurance that the risk is understood internally.

How Should the Board Hold Management Accountable Over Time?

The board should track the control-recency and severity metrics at every relevant meeting, treating a stagnant or worsening trend as a standing agenda item requiring explanation rather than a figure reported once and then dropped from future agendas. Consistency in tracking is what turns a one-time disclosure into genuine ongoing accountability.

Boards that let this metric fall off the agenda after an initial satisfactory report risk losing visibility exactly when severity might be climbing again, since the underlying attack patterns in the broader market have continued evolving rather than stabilizing.

What Red Flags Should Prompt the Board to Escalate Concern?

Management being unable to produce a control-recency figure, even directionally, is the clearest red flag, since it indicates the organization has not yet built the visibility this risk requires. A rising severity trend with no corresponding underwriting or wording response is an equally serious flag, suggesting visibility exists but has not translated into action.

Either red flag warrants the board requesting a specific remediation timeline from management, rather than accepting continued monitoring without action as an adequate response. A practical operating model for closing this gap already exists and can be referenced directly when the board asks management what a credible remediation plan should include.

How Should the Board Compare Practice to Peers?

Boards benefit from asking how peer reinsurers are approaching control-recency verification, since this is an area where practice is still developing unevenly across the market. Industry-wide data, such as Sophos surveying over two thousand organizations and finding a persistent identity-based attack pattern across the market broadly, gives boards an external reference point for what a reasonable pace of internal progress should look like.

Asking management how the organization's approach compares to what peers are reportedly doing is a useful way to calibrate whether internal progress is adequate, rather than judging progress purely against the organization's own prior baseline.

What Should the Board Do If Management Says the Data Does Not Exist Yet?

The board should treat this as an acceptable starting answer only if paired with a concrete remediation timeline, not as a closing answer that ends the conversation for another reporting cycle. A management team that acknowledges the gap honestly and proposes a specific plan is taking a reasonable first step, provided the board follows up at the next meeting to confirm actual progress against that plan.

What the board should not accept is the same "data does not exist yet" answer repeated across multiple consecutive meetings with no visible movement, since that pattern suggests the issue is acknowledged but not genuinely prioritized.

What Does Strong Oversight of This Risk Actually Look Like in Practice?

Strong oversight looks like a standing agenda item, a specific tracked metric, an explicit risk appetite tolerance, and a documented escalation path when that tolerance is approached or breached. It does not require board members to become cybersecurity experts, it requires the board to insist on specific, quantified answers rather than general reassurance.

Boards that establish this discipline now will be asking informed questions well before the next severe, control-decay-driven claim tests whether their oversight was adequate. Boards that wait will be asking the same questions only after a loss has already answered them the hard way, at a materially higher cost to the organization's capital and reputation alike.

The cost of building this discipline now is small relative to the cost of a board discovering, during a post-loss review, that decaying controls behind a severe claim had been visible to management for some time without ever reaching the boardroom. That is precisely the outcome proactive, specific board questioning is designed to prevent.

Sources

• Sophos: The State of Ransomware 2026 - Payments Drop as Encryption Climbs
• Veeam: Cyber Extortion Payment Trends Q2 2026 (Coveware by Veeam)