Tackling cybersecurity through a securitised lens

Rising costs and prevalence of cyber attacks

In recent years, cybersecurity attacks have become prevalent, while the costs of such breaches has increased. IBM reported that the global average cost of a data breach had increased by 10% in 2024 compared to 2023, the largest jump since the pandemic; while breaches with longer lifecycles have been observed to lead to higher costs. According to research from Cyber Rescue UK, there are a host of different impacts that affect businesses hit by data breaches.

Figure 1 & 2: Far-reaching impacts from data breaches

Source: Cyber Rescue UK, Blancco, June 2025. Survey of 2,000 IT and sustainability leaders.

At the time of writing, Microsoft is in the midst a major cyber security breach and has released software updates for on-premises and self-managed Sharepoint servers. Other high-profile incidents have affected the UK National Health Service (NHS), Disney and insurer, UnitedHealth. Phishing (deceiving people to reveal sensitive information) and stolen credentials appear to be the most common attack methods.

While large institutions have been making headlines, the securitised world isn’t any different. Smaller firms are particularly affected with attacks usually through third-party data feeds. Often, companies have to resort to shutting down their entire systems and going offline until there is a resolution.

Australia has been particularly targeted due to its advanced digital infrastructure and key role in global finance, trade, and critical industries, which make it an attractive target for cybercriminals. We are aware of at least two Australian non-bank lenders, both of which finance in securitisation markets, that have recently experienced material cyber attacks. The companies suffered impacts, including a temporary pause in asset originations and a spike in arrears data as collections activity was disrupted. This highlights that beyond governance risk, there is fundamental credit risk with such breaches given the operational disruption, associated costs and reputational damage. This is relevant to us as securitised investors given our direct exposure to the underlying loans.

Assess cybersecurity risk

Initially, we engaged with issuers to try to understand systems and governance, but responses were limited and often indigestible. We realised that understanding the complex and fast-changing landscape of information security infrastructure requires experts. So we enlisted our internal Information Security Team to learn about their own due diligence process and collaborated with them for over a year to devise our cybersecurity assessment framework.

Identifying engagement focus

While still in the early stages of deploying this framework, responses have been positive; with issuers showing strong interest and willingness to take part in the survey. The below shows the wide range of responses received:

Figure 3 & 4: Cybersecurity response to JHI survey by company type and jurisdiction

Source: Janus Henderson, as at 23 July 2025.

Many issuers have noted that we are the first investor to proactively engage on cybersecurity, highlighting the uniqueness and relevance of our approach. Our process involves a detailed review of survey responses and technical reports, followed by iterative engagement. We then circle back with targeted follow-up questions where vulnerabilities or governance gaps are identified. To ensure depth and accuracy, we continue to collaborate closely with our internal Information Security Team, leveraging their technical expertise to guide our focus and interpret complex findings.

In light of the escalating frequency and cost of cyberattacks, robust cybersecurity practices are no longer optional, they are essential. This applies not only to issuers but also to investors, who must understand and manage cyber risk as part of their fiduciary duty. We believe the development of this cybersecurity assessment framework represents a significant step forward. By integrating cyber risk evaluation into our governance and credit analysis, we are enhancing due diligence, setting a precedent for industry best practices, and contributing to a more resilient investment landscape.