As cyber activity increasingly spills across borders during geopolitical tensions, insurers face a growing challenge in understanding where exposure sits across their portfolios. When conflicts escalate, cyber risk rarely stays contained to the region where the crisis begins, with attacks, disruption and digital dependencies creating far-reaching consequences.
The recent escalation involving the United States, Iran and Israel illustrates how quickly cyber risk can evolve. Beyond the physical theatre of conflict, cyber operations, hacktivist campaigns and attacks on critical infrastructure have become an additional front, affecting organisations far beyond the immediate region. For insurers, these developments highlight the growing complexity of monitoring and managing exposure in real time.
KYND analysis highlights hidden portfolio risk
According to KYND, the cyber risk intelligence platform, even limited digital infrastructure presence in conflict-affected regions can create potential exposure for insurers. The firm analysed approximately 9,000 North American organisations to map their technographic footprint. While most infrastructure was concentrated in the United States, roughly 300 organisations — about 3% — had digital assets located in the Middle East.
Although a relatively small proportion, KYND emphasised that these connections could represent meaningful cyber risk during periods of geopolitical tension. The findings underline that portfolio exposure is not always obvious and cannot simply be inferred from geography alone.
Cyber activity extends beyond Iran
The analysis also illustrated how cyber incidents linked to the escalation spread beyond Iran. Early reports suggested that Israel conducted one of its largest cyber operations against Iran, causing major internet disruptions. Network monitoring group NetBlocks confirmed that connectivity across Iran dropped to approximately 4% of normal traffic, signalling an almost complete nationwide outage.
Reports further indicated that hacktivist activity surged during late February and early March, with up to 149 distributed denial-of-service (DDoS) attacks claimed, targeting 110 organisations across 16 countries. This demonstrates that cyber activity associated with geopolitical tensions is rarely localised and can impact organisations far from the immediate conflict zone.
Physical infrastructure and insurer alerts
The escalation also affected physical infrastructure. Amazon Web Services confirmed that drone debris struck three of its facilities in the United Arab Emirates and Bahrain during the early days of the conflict.
KYND alerted its customers to organisations within their portfolios that may have had digital infrastructure exposure in the Middle East. These alerts enabled insurers to monitor potential risk as events unfolded, providing actionable insight rather than relying solely on static assumptions about exposure.
Visibility matters as much as security
KYND stressed that in a geopolitical context, portfolio exposure cannot be inferred from geography alone. Organisations may have infrastructure, services, customers or supply chain dependencies linked to regions affected by conflict. Local disruptions can cascade internationally, and cyber activity can propagate across borders.
The firm concluded that in a world where cyber risk increasingly intersects with geopolitical developments, having clear visibility across portfolios is just as crucial as robust security measures.
Read the full blog from KYND here.
Copyright © 2026 FinTech Global
