Cyber Attacks Are a Balance Sheet Problem, Not Just an IT One

A Column by Iraelia Pernas, Executive Director, Asociación de Compañías de Seguros de Puerto Rico (ACODESE)

From the Oct. 2026 CB Print Edition.

For years, cybersecurity was largely treated as a technology issue, something for IT departments to manage through firewalls, passwords, software updates and other security controls. That view no longer reflects the reality businesses face.

Today, nearly every organization depends on technology to operate. Companies store sensitive information, process electronic payments, rely on cloud-based systems and connect with vendors and other third parties every day. Each of those connections enables businesses to operate more efficiently, but it also generates exposure.

Cyber risk is no longer simply a technology risk. It is a business risk. And that exposure is not theoretical in Puerto Rico.

The question is no longer whether cyber risk belongs on the business risk agenda. It already does. The question is whether organizations are prepared for what comes next when a cyber incident occurs.

Recent developments in an international cybercrime investigation involving an attack against a company on the Island offer a timely reminder that local businesses face the same evolving threats confronting organizations worldwide. In that case, attackers allegedly accessed company systems, demanded payment and ultimately published stolen information when their demands were not met.

The incident illustrates an important reality: the consequences of a cyberattack can extend far beyond a compromised computer system. An attack can interrupt operations, expose sensitive information, generate unexpected expenses, create potential liability and damage the trust an organization has built with its customers.

Businesses can, and should, invest in cybersecurity measures to reduce these exposures. But even strong cybersecurity cannot eliminate risk entirely. That is precisely why cyber risk belongs in the broader conversation about risk management and insurance.

We insure against risks we work hard to prevent every day. A business does not purchase property insurance because it expects a fire, nor does it prepare for business interruption because it expects operations to suddenly stop. It does so because sound risk management requires identifying what could go wrong, taking measures to reduce that possibility and preparing for the financial consequences if it does. Cyber risk should be approached through the same lens.

As cyber threats have evolved, so has cyber insurance. Early policies focused largely on data breaches and the expenses associated with responding to them. Today, businesses must consider a broader range of scenarios, including ransomware, business email compromise, data theft and exposure, attacks involving third-party providers and disruptions that can prevent a company from operating normally.

The consequences can add up quickly. Following a significant cyber incident, a company may need forensic experts to determine what happened, technology specialists to restore systems or data, attorneys to address legal and regulatory obligations, and communications professionals to manage information for customers and the public. At the same time, the company can lose projected income, interrupt operations or receive claims from affected third parties.

This is where insurance becomes part of the risk-management equation. Cyber insurance can help organizations transfer certain financial risks associated with covered cyber events. Depending on the policy, coverage may address areas such as incident response, forensic and legal expenses, data restoration, business interruption, liability and crisis communications.

But insurance should never be viewed as a substitute for cybersecurity. The two are complementary. As threats become more sophisticated, insurers are increasingly focused on how organizations manage their cyber exposure. Measures such as multifactor authentication, secure data backups, employee training and incident-response planning can reduce both the likelihood of an attack and the severity of its consequences. Managing cyber risk therefore requires both prevention and preparation.

That conversation is relevant to businesses of every size. Cyber risk is not limited to large corporations, financial institutions or technology companies. Small and midsize businesses also depend on digital systems, customer information and outside providers, often without the cybersecurity resources available to larger organizations.

For business leaders, the first step is recognizing that cyber risk cannot remain exclusively within the IT department. It should be considered alongside other operational, financial and strategic risks at the highest levels of an organization. Effective cyber risk management also requires shared responsibility across the business, from leadership setting priorities and allocating resources to employees understanding how everyday decisions can create or reduce exposure.

That means considering not only how an attack can be prevented, but also what happens if prevention fails. Business leaders need to understand which systems and information are most critical, how long operations could withstand an interruption and what financial consequences could follow.

Just as importantly, they must determine which risks can be mitigated internally and which should be transferred through insurance.

Technology will continue to evolve, and cyber threats will evolve with it. Businesses may never be able to eliminate cyber risk entirely. But they can understand it, manage it and prepare for its consequences.

The question is no longer whether cyber risk belongs on the business risk agenda. It already does. The question is whether organizations are prepared for what comes next when a cyber incident occurs.