Staying ahead of cyber exposure during geopolitical conflict

As cyber activity increasingly spills across borders during geopolitical tensions, insurers face a growing challenge in understanding where exposure sits across their portfolios.

When geopolitical tensions escalate, cyber risk rarely stays contained to the region where the conflict begins.

Increasingly, cyber activity forms part of the broader dynamics of geopolitical conflict, with attacks, disruption, and digital dependencies extending the impact far beyond the immediate region. For insurers, this introduces new complexity: understanding where exposure actually sits across their portfolios, and how quickly it could shift as geopolitical developments unfold.

The recent escalation involving Iran, Israel, and the United States illustrates how rapidly cyber risk can evolve during periods of geopolitical tension and how difficult it can be to see where exposure may exist.

To better understand how this might appear in practice, KYND analysed approximately 9,000 North American organisations to map their technographic footprint. While most infrastructure was concentrated in the United States, around 300 organisations, or roughly 3%, had digital assets located in the Middle East.

Although a relatively small proportion, it illustrates an important point: exposure is not always obvious, and even limited infrastructure presence can create potential risk when geopolitical tensions escalate.

The relevance of this becomes clearer when looking at how cyber activity unfolded during the early stages of the escalation. Geopolitical tensions increasingly trigger cyber activity that extends beyond the immediate conflict zone.

Early on, Israel reportedly launched one of the largest cyber operations against Iran to date, plunging parts of the country into darkness. Network monitoring group NetBlocks confirmed internet connectivity across Iran dropped to just 4% of normal traffic, signalling an almost complete nationwide shutdown.

But the cyber activity linked to the conflict did not appear to remain localised. Reports suggest up to 149 hacktivist DDoS attacks were claimed in late February and early March, targeting 110 organisations across 16 countries.

At the same time, physical infrastructure has also been affected. For example, Amazon Web Services confirmed that drone debris struck three of its facilities in the United Arab Emirates and Bahrain during the early days of the conflict.

Taken together, these incidents illustrate an increasingly important reality: cyber exposure is fluid. During geopolitical conflict, it can shift quickly, sometimes affecting organisations far beyond the immediate region.

For insurers, the ability to identify this shifting exposure quickly is critical. As the situation began escalating, KYND immediately alerted our customers to organisations within their portfolios that may have potential digital infrastructure exposure in the region, allowing them to assess possible risk early as events unfolded.

This raises an important question: how well do insurers understand where exposure actually sits across your portfolio and how quickly it could change as geopolitical tensions evolve?

Why this matters

Geopolitical developments can reshape cyber exposure in ways that are difficult to surmise from surface-level information. Organisations may have digital infrastructure, services, customers, or supply chain dependencies linked to regions affected by conflict. Local infrastructure disruptions can have knock-on effects for international operations. Meanwhile, cyber activity associated with geopolitical tensions can spread well beyond the conflict zone.

In practice, portfolio exposure cannot be inferred from geography alone. In response to the current escalation, KYND has continued sharing alerts with insurers highlighting organisations within their portfolios that may have potential exposure in the region, helping them monitor risk as the situation develops.

Because in a world where cyber risk increasingly intersects with geopolitics, visibility matters just as much as security.