Wie sind die Öffnungszeiten?

Montag 09:00 - 17:00 Dienstag 09:00 - 17:00 Mittwoch 09:00 - 17:00 Donnerstag 09:00 - 17:00 Freitag 09:00 - 17:00

Cyber Risk GmbH

Startseite
Schweiz
Horgen
Cyber Risk GmbH

Wegbeschreibung Website Kontaktieren Sie die Schule/Universität

Cyber Risk GmbH, Handelsregister des Kantons Zürich, Firmennummer: CHE-244.099.341. You may visit: https://www.cyber-risk-gmbh.com

15/10/2026

Japan: Recent Hybrid Threats.

October 9, 2026: Japan's Information Technology Promotion Agency (IPA) warned of successive cyber incidents affecting financial institutions, telecommunications operators, and other organizations. Reported incidents involved unauthorized access and the compromise of substantial amounts of personal information.

October 9, 2026: Japan's Financial Services Agency (FSA) issued a warning about unauthorized access to customer facing services and business systems, including incidents involving personal information and identification document images.

October 13, 2026: Japan's National Institute of Information and Communications Technology (NICT) published findings about App-to-Backend Attacks (A2B). Attackers can analyze publicly distributed mobile applications to identify backend infrastructure, API structures, and communications mechanisms, facilitating unauthorized access and information theft.

October 14, 2026: Japan's National Cybersecurity Office (NCO) published a consolidated announcement about successive unauthorized access and information leakage incidents affecting organizations across multiple sectors.

The developments of October 2026 illustrate why incidents that initially appear to be conventional cybersecurity threats must be examined through a broader hybrid risk management lens, where technical, human, financial, legal, operational, and geopolitical dimensions interact and reinforce one another.

We must move beyond the traditional approach of examining cybersecurity incidents as isolated events, following a linear sequence of incident detection, investigation, response, recovery, and closure. A consequential possibility is that the observed cyber incidents are merely the collection phase of an operation whose true targets and objectives will become apparent later.

What if the unauthorized access and information theft are not the adversary's ultimate objectives, but preparatory activities intended to enable a broader campaign?

14/10/2026

Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération. (Security incident targeting remote controllers of refrigeration installations).

Refrigeration controllers can be used to manage temperature related processes, including defrosting schedules. Unauthorized changes to refrigeration control settings could cause physical and economic damage. Depending on the facility, the consequences might include compromised food storage, pharmaceutical cold chain disruption, inventory losses, and operational interruption.

One sentence in the CERT-FR bulletin particularly caught my attention: Vérifier les conditions contractuelles d’assurance avant de couper la remontée des données Internet vers le prestataire frigoriste. (Verify the contractual insurance conditions before interrupting the transmission of data over the Internet to the refrigeration service provider).

This demonstrates a *difficult interaction between cybersecurity and contractual compliance*. An operator may need to disconnect an exposed system to reduce the risk of further compromise. However, the disconnection might also interrupt monitoring arrangements relevant to an insurance contract.

This incident provides an unusually clear real-world illustration of how cyber-physical risks can propagate across operational, contractual, financial, and governance dependencies, creating interconnected vulnerabilities that are particularly relevant to hybrid risk management

13/10/2026

Introducing the Full Banking Hybrid Stress Test.

Cyber Risk GmbH (Handelsregister des Kantons Zürich, CHE-244.099.341) is pleased to introduce the Full Banking Hybrid Stress Test, designed to examine how complex, interconnected threats challenge institutional resilience, governance, and professional judgment.

Banking institutions have invested extensively in risk management, regulatory compliance, cybersecurity, operational resilience, internal controls, and corporate governance. Yet an important question remains: What happens when an institution manages individual incidents appropriately, but fails to recognize the larger threat emerging through their interaction?

This is not an exercise in responding to multiple incidents. It is an examination of how incomplete information, institutional specialization, fragmented responsibilities, competing priorities, cognitive overload, and decisions made under uncertainty can influence the ability of even highly sophisticated institutions to respond to coordinated hybrid threats.

For further information, please visit our website, hybrid-stress-testing .com, and select BANKING HST from the main navigation menu. In accordance with our security policy, we do not include clickable links in social media communications.

29/09/2026

Welcome to the September 2026 edition of our newsletter (7.63 MB, 82 pages). It can be accessed securely at the Reading Room of Cyber Risk GmbH.

In response to hybrid threats and the systematic misuse of hyperlinks by malicious actors, we have implemented a strict no URL policy for social media communications.

Malicious actors frequently copy legitimate social media posts and republish them with the original links replaced by attacker controlled URLs. Because the text, branding, and timing closely mirror the original message, the altered post appears to originate from a trusted source. Attackers often use fake profiles posing as colleagues or senior executives, which further reinforces credibility. In such cases, the link is perceived as trustworthy. This exploitation of trust significantly increases the likelihood of successful compromise.

21/08/2026

20 August 2026, Update - The AI Liability Directive has been withdrawn, but the underlying liability gap still exists. (1/4).

The withdrawn AI Liability Directive has not been replaced by any single legal instrument. The regulatory and remedial space that the proposed Directive was intended to occupy is now addressed only partially and cumulatively through a fragmented, multi layered legal framework that includes the revised Product Liability Directive, the AI Act, applicable national rules of tort and delict, contractual remedies, data protection and antidiscrimination law, and sector specific liability regimes.

A material residual liability and remedial gap remains. This is particularly significant for:

1. Non contractual, fault based claims arising from AI enabled services or decision making.

2. Claims for pure economic loss falling outside harmonised product liability rules.

3. Certain forms of harm affecting fundamental rights or legally protected interests.

4. Cases in which the opacity, complexity or autonomous characteristics of an AI system make it disproportionately difficult for a claimant to establish the factual and causal nexus between the defendant's conduct, the operation or output of the AI system, and the damage alleged.

The evidentiary dimension of that gap is especially important. The proposed AI Liability Directive was expressly designed to address situations in which conventional national rules governing proof of fault and causation could place an injured party at a structural disadvantage because the relevant evidence is technically inaccessible, controlled by the defendant, or obscured by the complexity and opacity of the AI system.

The withdrawal of the AI Liability Directive leads to divergent outcomes across the Union. This creates incentives for jurisdictional arbitrage, regulatory shopping and, where procedural rules permit, forum shopping. In the absence of a harmonised horizontal regime governing fault based liability for AI related harm, comparable conduct gives rise to different liability exposures depending on the Member State whose substantive and procedural law is applicable.

Divergences arise in the standard of care, the allocation and standard of proof, presumptions of causation, disclosure of evidence, the recognition of pure economic or non material loss, limitation rules, and the assessment of damages.

21/08/2026

20 August 2026, Update - The AI Liability Directive has been withdrawn, but the underlying liability gap still exists. (2/4).

The 5 Post AI Liability Directive indicators | Legal Intelligence.
We monitor five indicators.

1. National divergence, the fragmentation indicator.

This is the primary indicator. The question is whether materially comparable AI related harm produces materially different civil law consequences, depending on the Member State in which the claim is determined.

We monitor divergence in legislation expressly dealing with AI liability, but also across the entire liability architecture, including the legal characterisation of fault, use of AI Act obligations in establishing a standard of care, recoverability of pure economic and non-material loss, treatment of discrimination and fundamental rights harms, access to technical evidence, disclosure obligations, presumptions and standards of causation, limitation periods, remedies, and calculation of damages.

The legal intelligence trigger would be: The same or substantially equivalent AI conduct begins producing systematically different liability outcomes across Member States because of differences in national substantive or procedural law.

2. First wave AI litigation, the doctrinal formation indicator.

The first significant cases will matter, as courts will have to translate the AI Act's regulatory obligations into existing private law categories.

The critical litigation question will be: What private law consequences, if any, follow from breach of an obligation imposed by the AI Act?

A claimant may argue that non compliance with obligations concerning risk management, data governance, documentation, logging, transparency, human oversight, accuracy, robustness or cybersecurity constitutes evidence of negligence or otherwise contributes to establishing breach of the applicable duty or standard of care.

That does not mean that every AI Act infringement automatically gives rise to damages. The cause of action, protected interest, fault requirement, causation and recoverable damage will still have to be established under the applicable liability regime.

We will monitor whether national courts treat AI Act obligations as regulatory requirements, or as relevant evidence of civil fault, or, more significantly, as normative standards capable of materially shaping the applicable private law duty of care.

21/08/2026

20 August 2026, Update - The AI Liability Directive has been withdrawn, but the underlying liability gap still exists. (3/4).

3. CJEU preliminary references, the Judicial Harmonisation Indicator.
As national courts encounter disputes between the AI Act, Product Liability Directive, GDPR, consumer protection, equality law, fundamental rights and national tort law, questions of Union law interpretation may reach the Court of Justice (under Article 267 TFEU).

The questions referred will be more important than the number of referrals. We will watch particularly for references concerning the meaning and legal effect of AI Act obligations, whether particular Union provisions confer rights or protect interests relevant to damages claims, the relationship between AI Act non compliance and product defectiveness, evidentiary consequences of missing documentation or logs, causation, effective judicial protection, and the interaction between Union rules and restrictive national rules governing remedies.

The liability challenges will move from national doctrinal experimentation to European judicial harmonisation. This could create a form of harmonisation without AILD 2.0 (not comprehensive legislative harmonisation, but incremental harmonisation through CJEU jurisprudence).

4. Insurance differentiation, the monetisation of uncertainty indicator.

Insurers price prospective liability risk. Insurance markets will detect legally significant divergence before legislators formally recognise it.

We will monitor changes in underwriting questionnaires, exclusions, endorsements, sublimits, deductibles and premiums relating specifically to AI.

5. Jurisdictional arbitrage, the internal market distortion indicator.
This is the most sensitive indicator and should be built carefully. We will avoid suggesting that companies can simply select whichever Member State offers the weakest tort regime. The intelligence question is narrower: Does divergence in AI related civil liability begin influencing legally available choices concerning corporate structuring, contractual arrangements, establishment, deployment, distribution, insurance, litigation strategy, or other connecting factors?

If so, we begin moving from legal fragmentation to economically consequential jurisdictional arbitrage.

21/08/2026

20 August 2026, Update - The AI Liability Directive has been withdrawn, but the underlying liability gap still exists. (4/4).

We distinguish three concepts:

Regulatory arbitrage. Structuring activity to benefit from differences between applicable regulatory/liability environments.

Jurisdictional arbitrage. Structuring legally relevant connections to obtain a more favourable jurisdictional or governing law position where Union law permits.

Forum shopping. Selecting among legally available fora after or in anticipation of a dispute. (Forum shopping describes the conduct of a litigant who, where more than one court is legally competent to hear substantially the same dispute, selects the forum perceived to offer the most advantageous legal or procedural environment.)

The five indicators should be read together. The intelligence value comes from correlation.

16/08/2026

After Rotterdam (13 August 2026). The dangerous space between accident and attack.

Operational denial without destruction, hybrid stress test is highly recommended.

In this oil sector hybrid stress test, the adversary does not destroy refineries, pipelines or terminals. It may be sufficient to create circumstances in which the operator, harbour authority, government or insurer concludes that normal operations cannot safely continue.

Possible triggers include drone presence, navigation interference, fabricated intelligence, bomb threat, suspicious vessel, compromised safety telemetry, false leak report.

The operator then suspends operations voluntarily. From an economic standpoint, the result can resemble a successful kinetic attack.

Rotterdam (13 August 2026), an explosion occurred at Gunvor's petroleum storage facility, killing one person and injuring six. Authorities said there was no immediate evidence of sabotage.

At approximately the same time, there were power disturbances affecting the wider port area, including an interruption affecting ExxonMobil's refinery. Authorities stated that there was no immediate evidence that the power problems were related to the explosion.

Even if events are genuinely unrelated, the authorities could perceive correlation (false event correlation). This could lead to precautionary shutdown, political escalation, market manipulation, economic consequences.

Operational denial with or without destruction, these hybrid stress tests are highly recommended.

12/08/2026

“Hybride Einflussmaßnahmen sind häufig nicht per se illegal, aber durchaus illegitim.” (Hybrid influence measures are often not unlawful per se, but may nevertheless be illegitimate).

That is legally fascinating. It expressly recognizes the problem we repeatedly encounter with hybrid activity. The individual components do not have to constitute unlawful acts. The significance can arise from orchestration and cumulative effect.

The agencies must understand the background and effects of hybrid influence activities and trace their methods and dissemination channels.

Adresse

Dammstrasse 16
Horgen
8810

Öffnungszeiten

Montag	09:00 - 17:00
Dienstag	09:00 - 17:00
Mittwoch	09:00 - 17:00
Donnerstag	09:00 - 17:00
Freitag	09:00 - 17:00

Website

https://www.cyber-risk-gmbh.com/

Benachrichtigungen

Erfahren Sie als Erste/r von Neuigkeiten und Aktionen: Wir schicken Ihnen eine E-Mail, wenn Cyber Risk GmbH etwas veröffentlicht. Ihre E-Mail-Adresse wird für keinen anderen Zweck verwendet, und Sie können sich jederzeit abmelden.