BRIGHTON, England — Everyone in a company and people throughout the supply chain are responsible for managing cyber threats, panelists said Wednesday at a Marsh Inc. conference.

While many perceive cyber attacks to be an information technology issue, in fact it is people who pose the threat and are the agents of such attacks, Andy Hodgson, global chief information security officer at Farnborough, England-based research and technology firm Qinetiq Group P.L.C., told delegates at Marsh's “Digital Threats 2013 Conference.”

Risk managers and others need to constantly monitor the changing cyber threats their company faces and to raise awareness within their organizations, he said during Wednesday's conference held in Brighton, England.

To mitigate the effects of a security breach, risk managers and others must understand their organizations, said Stuart Rye, consulting director at IT company Fujitsu U.K. in London.

“If you understand the risk you are carrying, then you know how to react,” he said.

Companies must constantly update and “future proof” their policies for preventing and managing cyber attacks as much as possible, said Christian Bartsch, a partner at law firm Bird & Bird L.L.P. in London.

As well as monitoring risks at their companies, risk managers must engage in “counterparty risk management” of their supply chain, said Eddie McLaughlin, head of enterprise risk management and modeling at Marsh Risk Consulting in London.

%%BREAK%%

A snapshot survey of 41 delegates found that the risk manager is responsible for cyber risk in the companies of just 15% of respondents. Thirty-four percent said the IT department is responsible for cyber risk; 20%, the board; 2%, the finance director; and 29%, other.

More than half, 54%, of respondents said their company had been subject to a cyber attack in the past three years, compared with 29% who said their company had not been attacked and 17% who did not know.

Seventy-six percent said their company does not currently buy specific cyber insurance coverage, while 12% said their companies do buy such policies and 12% said they did not know.