Risk Outlook '26 with Morgan O'Rourke and Hilary Tuttle

RIMScast

chevron_right

00:00

AWS Outage Lessons on Vendor Risk

Hilary reviews the 16-hour AWS outage, vendor concentration risk, economic impact, and insurer response.

Play episode from 05:16

chevron_right

Transcript

chevron_right

Transcript

Episode notes

Welcome to RIMScast. Your host is Justin Smulison, Business Content Manager at RIMS, the Risk and Insurance Management Society.

In this first episode of 2026, Justin interviews Morgan O'Rourke and Hilary Tuttle of RIMS Risk Management Magazine. They discuss major cyber events of 2025, court rulings on AI fair use, and what risk professionals should take away about AI training data and intellectual property. They discuss regulations about forever chemicals or PFAS and what to look for in 2026 and beyond as these regulations change. They discuss the U.S. government shutdown of October and its residual effects.

Listen for a call for content submissions for RIMS Risk Management Magazine.

Key Takeaways:

[:01] About RIMS and RIMScast.

[:17] About this episode of RIMScast. This is our first episode of 2026. We're going to look forward and back, and who better to do that with than Morgan O'Rourke and Hilary Tuttle of RIMS Risk Management Magazine?

[:44] We will discuss some of the top risk management stories of 2025 and what they might mean for 2026. There's so much to discuss, from forever chemicals to AI! But first…

[:55] RIMS-CRMP and Some Prep Courses. The next virtual prep course will be held on January 14th and 15th, 2026. These are virtual courses. Links to these courses can be found through the Certification page of RIMS.org and through this episode's show notes.

[1:12] RIMS Virtual Workshops are coming up. This is the last call for "Intro to ERM for Senior Leaders". It will be held on January 8th, led by Joe Mayo.

[1:24] On January 21st and 22nd, Chris Hansen returns to deliver the course, "Managing Worker Compensation, Employer's Liability and Employment Practices in the US".

[1:35] On February 4th and 5th, Ken Baker will return to deliver the course, "Applying and Integrating ERM".

[1:45] The full schedule of virtual workshops can be found on the RIMS.org/education and RIMS.org/education/online-learning pages. A link is also in this episode's notes.

[1:57] RIMS members always enjoy deep discounts on the virtual workshops.

[2:06] The RIMS-CRO Certificate Program in Advanced Enterprise Risk Management is hosted by the famous James Lam. This is a live virtual program that helps elevate your expertise and career in ERM.

[2:19] You can enroll now for the next cohort, which will be held over 12 weeks from April 14th through June 23rd. Links to registration and enrollment are in this episode's show notes.

[2:34] On with the show! The annual Year in Risk Review edition of RIMS Risk Management Magazine is now available. Visit RMMagazine.com for more information.

[2:47] We're going to pick up where we left off with Morgan O'Rouke and Hilary Tuttle of RIMS Risk Management Magazine and the RIMS Publication Department.

[2:54] Feel free to check out Episode 371 to get caught up as we discuss natural catastrophes and their impact on the landscape.

[3:04] In this episode, we're going to talk about AI, PFAS forever chemicals, and how you can contribute to RIMS Risk Management Magazine in 2026.

[3:14] Risk Management Magazine is an Azbee award winner, so you are hearing insights from the best in the business of risk management reporting. Let's get to it…

[3:24] Interview! Morgan O'Rourke and Hilary Tuttle, welcome back to RIMScast!

[4:01] The Year in Risk 2025 Edition of RIMS Risk Management Magazine has been on digital shelves for a few weeks now. We're going to look a little bit forward and backward.

[4:34] Data Privacy Day comes up on January 20th every year. All eyes turn to cyber. At RIMS, all eyes turn to Hilary because she is the cyber guru. Hilary thinks every day of the year is Data Privacy Day.

[5:15] Hilary says, in the Year in Risk edition, they talked about 2025's Amazon Web Services outage, which took about 70,000 companies offline. It's a solid example of third-party risk and vendor security risks.

[5:31] The economic impact of the outage was estimated to be in the billions of dollars, in terms of lost business and business interruption. Hilary said the AWS outage lasted about 16 hours.

[5:53] It's a good reminder of vendor concentration risk in cloud services. The cloud services market has three major vendors; Amazon has about 30% of the market. If Amazon goes down, that's a significant number of clients who are at risk.

[6:10] Hilary says insurers are not at real risk for this outage. A lot of cyber coverage has provisions for outages with waiting periods of eight to 12 hours. Your insurer might come in for the end of that situation, but most of it is on the insured.

[6:38] For insurers and reinsurers, it was a pretty mild event. It's not going to cause huge changes in capacity or rates. It is a reminder that a lot of the risk is going to be on you, depending on the factors that are involved and the vendors that you pick.

[6:58] There was also the Marks & Spencer ransomware incident that impacted their stores and online services. They sell about four million Great British pounds a day of products online. Their website was down for three months because of the ransomware event and recovery process.

[7:29] Marks & Spencer had to go to pen and paper for in-store sales, and they operate hundreds of stores. It also caused inventory problems. It was a huge increase in waste because they didn't have ways of tracking or selling all of their inventory of food and other goods.

[7:45] The cost to Marks & Spencer was estimated to be about three hundred million Great British pounds.

[7:53] 2025 was a big year for cyber. Some other British retailers had some issues that have had retailers around the world taking note.

[8:04] Morgan was interested in the Jaguar Land Rover case. Since Morgan was a child, he wanted a Jaguar for the hood ornament. If they're taken offline, how is Morgan ever going to get himself a Jaguar?

[8:35] Hilary says, You and a lot of other customers, because they had to take all of their very automated production offline for a while. Parts and Sales were interrupted. They saw quarterly revenues drop around 24%, year-over-year, a difference of several hundred million pounds.

[8:58] Morgan says it becomes a little bit the same. It doesn't mean that it's not important. It's one of those things we encounter with perpetual risks, whether it's disasters or cyber.

[9:12] When they're always happening, they tend to get overlooked until some marquee event like an Amazon Web Services outage takes down a lot of people, or a company is taken offline for months and has to go back to pen and paper. That's not easy at large volumes.

[9:38] The underlying current of the risks you have to deal with still needs to be a part of your day-to-day mitigation exercises.

[9:59] Hilary says The more things change, the more things stay the same.

[10:18] Morgan says There is a broader perspective to everything. A risk is not just going to affect you; it's going to affect people down the line who are connected to your business. A cybersecurity event that happens over here is bound to have an impact on you, in some way.

[10:35] Hilary says concentration risk is an increasing issue, and dependency is an issue. We have allowed some of the market players to become so large that the impact, if anything happens to them, is astounding.

[10:50] There are advantages in having a large company as your vendor, but there's also a certain amount of instability in the lack of control you have in what's going on upstream. There's a lot that can happen downstream, to you.

[11:26] Hilarity may attend a Black Hat conference this year. From that, she may see what is coming several years down the pike.

[12:00] Justin says that AI is omnipresent. Regarding AI, in 2025, courts ruled on Fair Use. Multiple lawsuits were filed, and major settlements were reached. One lawsuit about scrubbing user data came from violating the Terms of Use, rather than copyright infringement.

[12:44] Morgan says companies that use AI or are creating an AI should be looking at the emerging liabilities and governance challenges of AI.

[12:55] There were a lot of cases. Two cases discussed in the Year in Risk 2025 were about Anthropic and Meta being sued by groups of authors. The courts ruled in both cases that if the AI made substantial changes to the material, they could use it under Fair Use.

[13:32] The cases weren't definitive that you have an open free-for-all. Anthropic was guilty of using pirated materials from the authors to train its AI. Anthopic settled by paying $1.5 billion to the authors. The ruling was that you can use material that you get legally, by paying for it.

[14:14] There are ways that the AI companies may be held accountable. There are 40 to 50 cases from every manner of media that may be adjudicated differently. It may come down to the sense of the case. There is some precedent set by one case.

[14:36] Morgan says, from a content creator perspective, it's heartening that copyright is protected. Hilary says it's disheartening that larger companies like Disney have more negotiating power in what they allow AI to use, but smaller companies may not have as much power.

[15:52] Morgan says the New York Times has licensed individual pieces for AI to use.

[16:06] If the company creating AI doesn't have an agreement with a content creator, in a lot of court cases, the settlement ends up being a licensing agreement to use the content.

[16:19] There's somewhat of an inevitability to the use of AI. You can't do anything about it, so you might as well get on board and get your piece. AI will take a little getting used to.

[16:56] Morgan says their future coverage of AI will be less about the promise of AI and more about how to use AI responsibly in your business. What are the risks of AI in your business?

[17:37] Everybody's doing it anyway, and risk depends on the level of fact-checking or information verification you are doing when you're putting together anything from an email to an RFP for a new vendor. You don't lose sight of the ball just because it's been around a few years.

[17:58] Quick Break! RISKWORLD 2026 will be held from May 3rd through the 6th in Philadelphia, Pennsylvania. RISKWORLD attracts more than 10,000 risk professionals from across the globe. It's time to Connect, Cultivate, and Collaborate with them. Booth sales are open now!

[18:20] General registration and speaker registration are also open right now! Marketplace and Hospitality badges will be available starting on March 3rd. Links are in this episode's show notes.

[18:35] Let's Return to Our Interview with Morgan O'Rourke and Hilary Tuttle!

[18:52] Justin brings up forever chemicals. They're in a lot of the things he drinks. The foods that he eats have consumed the same water. Executives in Italy were sentenced for not doing enough about them. In the U.S., the Trump administration started regulatory rollbacks.

[19:47] Justin mentions the RIMS webinars about forever chemicals, showing that if we don't work to curtail PFAS, they will have a lasting, harmful effect.

[20:21] Morgan says environmental liability for PFAS has been a topic of discussion for a few years.

[20:52] The discussions are around how PFAS will be regulated from a business standpoint, and what that means for my company. How do I need to report them? How do I need to mitigate it and clean up the systems I am responsible for?

[21:05] Morgan reports that in Italy, 11 executives were sentenced to a total of 141 years in prison for polluting the groundwater in an area of Italy. Studies showed that over time, there were thousands more cancers and cases of cardiovascular disease because of this pollution.

[21:35] Morgan says, That's the extreme side of it. It's what everyone wants to prevent. A lot of other countries and U.S. states are passing regulations banning or restricting PFAS. In 2025, in the U.S., some regulations were softened or paused.

[21:59] Hilary says there were various efforts to soften different regulations. Morgan explains that it was mainly for the costs to businesses. From the business standpoint, it's going to cost money to mitigate or report whatever the requirement is.

[22:14] Morgan says, It's not that restrictions were taken off the table, but it's concerning from a public health standpoint that they are slow-walking PFAS regulations. Morgan would like to think that just because a regulation is paused doesn't mean it won't be put into effect soon.

[22:56] Hilary says when she was in Calgary, in the fall, there was a session specifically on PFAS litigation, because Canada has also passed some measures on this. It's a solid reminder that other countries are starting to pick up on this regulation.

[23:17] In terms of compliance with what can or can't be used in product development, it's good to keep in mind some of these emerging regulations and the direction they are going. Remediation is definitely a component of it.

[23:33] In product development and new product releases, and product reformulations, it is often more expensive to figure out how to use substances that are not the PFAS that have been used for a long time, but that is the direction in which some businesses need to be looking.

[23:49] Morgan says, We did it with asbestos, years ago. PFAS started as a health concern, but it is a business concern. If you're responsible for injuring people, as we saw in Italy, you could go to jail. It doesn't mean that will happen in every country, but it doesn't mean it won't.

[24:19] Hilary thinks it will be interesting to see what moves the needle in different countries, as there are different business climates in different parts of the world. The United States is a lot more litigious than a lot of other cultures. Some of the regulations are being driven by lawsuits.

[24:30] Other places are focused more on compliance, where there's more of a sense of social good, like the Nordics, or parts of Western Europe, Hilary says, where some regulations coming from the government will be enough to move the needle.

[24:58] Multinational companies will need to be aware of the regulations in different countries and decide if they will make products for a specific country, restrict sales in that country, or reformulate their offerings.

[25:12] Morgan says the idea that there is an acceptable level of PFAS in the water is what bothers him the most. Hilary says there are risks more direct than water. You're cooking your food in PFAS. You have fire blankets to keep your children safe in the wake of wildfires.

[25:38] Things that you take for granted, that are serving a function, have the forever chemicals because they serve the function. Waterproof shoes, for example. You're relying on the benefit, but you're not necessarily thinking about the risks that you're introducing.

[25:54] Morgan says that it's all about the concentration of things. PFAS are in whatever you consume. At a certain point, it becomes harmful. Hilary says, You might buy one pair of waterproof shoes, but what if everyone does, and they all end up in landfills and cause runoff?

[26:39] It's a personal risk vs. a collective risk issue. It's a short-term risk vs. a long-tail risk issue. Hilary and Morgan discuss tapwater. Ignorance is bliss. It's a long-term risk.

[27:11] A Final Break! The Spencer Educational Foundation's goal to help build a talent pipeline of risk management and insurance professionals is achieved, in part, by its collaboration with risk management and insurance educators across the U.S. and Canada.

[27:30] Spencer awards undergraduate, graduate, Ph.D., and Pre-Instructor of Practice Scholarships to students enrolled at an accredited college or university in the U.S. and Canada, and physically studying in either location. No remote coursework eligibility from other locations.

[27:47] Including part-time, graduate scholarships to risk management and insurance professionals continuing their education.

[27:53] Since 1980, Spencer has invested more than $11.1 million in the scholarship program with awards to over 1,700 students. More than 85% of Spencer's scholarship recipients remain in the industry to this day.

[28:09] They've got undergraduate scholarships, full-time Master's scholarships, part-time Master's scholarships, pre-dissertation Ph.D. candidates, doctoral candidates, and pre-instructor of practice scholarships all open now. The application deadline is January 31st, 2026.

[28:30] Visit SpencerEd.org/scholarships. You'll find the different application buttons. See the link in this episode's show notes for more information.

[28:42] Let's Return to the Conclusion of Our Interview with Morgan O'Rourke and Hilary Tuttle!

[28:59] RIMS Risk Management Magazine is looking for risk managers, business professionals, and legal professionals to contribute by way of articles and share their knowledge.

[29:21] Morgan says We're looking for articles talking not just about the risk, but about what a risk manager can do about the risk. The actionable part of the article describes the risk management. We're trying to help our risk manager readers do their jobs better.

[29:44] If you're looking to contribute something, share your knowledge. How did you deal with this risk that you are encountering? What are the steps that you recommend people take to mitigate that risk?

[29:58] That ends up being the most successful article. It accomplishes our mission most clearly.

[30:06] Hilary adds, if there is something that has come up at work that surprises you, as a seasoned risk professional, it may be new, emerging, or surprising to someone else.

[30:18] Sharing your expertise with your colleagues is something we are always looking to do, and we're happy to help you figure out how to do it.

[30:34] Justin says When we attend a RIMS event, we have a chance to mingle with our members and the attendees. People have come up to me and said they listen to the show, and they would love it if I would do an episode on "this."

[30:54] One that stood out to Justin is amusement park ride safety risk. He plans to do an episode on that in the summer.

[31:13] Hilary says, We love a novelty risk. They have done articles on water parks and ski resorts. Morgan says everybody's got a risk they're facing. Hilary wrote a blog post years ago about bouncy houses. Justin did an episode on hot air balloons.

[31:35] Morgan recalls doing an article on microbreweries, and a brewery sent them a six-pack. He'd like to do pizza risks next, maybe do a full spread!

[32:07] Justin says, We do want to give you a forum to share your knowledge, experience, and recommendations on how to mitigate a risk or tackle it head-on, or a new idea for a strategy on an emerging risk.

[32:25] Margan says some of those things may start as an article and later become a podcast episode. It's key to provide content that RIMS may be looking for, in general. It all starts with reaching out to Morgan or Hilary with an idea.

[32:44] Hilary says if you've put together a PowerPoint for a presentation, you probably have a pitch. Morgan says, You've basically got an article or a conversation started. If it's worthwhile to share with a conference audience, it's worthwhile to share with everybody.

[33:01] When Hilary meets a risk manager, her favorite questions to ask are What is the most unexpected risk that you've dealt with? What is the number one risk that you've dealt with? What did you not think that you'd be spending your days on?

[33:17] Hilary met a risk manager who worked for a group of public universities. He said the biggest unexpected problem that he deals with is kids riding motorized scooters on sidewalks or leaving them for people to trip over. Ebikes catch on fire. 100 kids a year get hurt from them.

[33:56] Hilary says, If you have a situation like that, if there's a risk that you never expected, if nothing else, we'd be really interested to hear about it.

[34:05] There are so many topics from 2025 to check out in the Q4 edition of RIMS Risk Management Magazine at RMMagazine.com now.

[34:26] In October, the longest U.S. Government shutdown in history occurred. This led to a 10% cut in air traffic capacity and a lapse in the NFIP, which is one of RIMS's top legislative priorities. Once the government reopened, the NFIP was reauthorized until the end of January.

[35:06] The NFIP has been kicked down the road for a shorter period than anyone really wants. This was one of the few times it has been allowed to fully lapse. It leaves claims up in the air.

[35:46] Homeowners, buyers, and developers in high-risk areas can't get federally-backed mortgages without flood insurance. The lapse put a lot of property purchases in peril or on hold. Morgan says there wasn't a big run on claims in the last 40 days, but there could have been.

[36:28] Hilary points out that real estate developers couldn't sell homes in that period in areas where flood insurance is required. There are business impacts that are not storm-related.

[37:01] The shutdown had an enormous human toll with people losing jobs or being furloughed and going without money, not being able to pay rent, mortgage, or childcare. SNAP was cut for a significant period.

[37:30] Ernst & Young estimated the hit to the GDP as 1 to 1.5%, or a loss of $7 to $14 billion of economic output that would not be made back up after the government reopened. It was a disruption with long-term implications.

[37:57] Morgan says We're coming up on another fight as the reopening of the government only lasts until the end of January. If there is debate, as there always has been, we'll go through this process again. How long will that take? Have we learned from our mistake two months ago?

[38:22] Morgan says uncertainty is never good for the economy or for our mental well-being.

[38:31] Justin says, we're going to cap the conversation for now, and invites Morgan and Hilary back in about five months for the 2026 Mid-year Risk in Review.

[38:42] It's been such a pleasure to be rejoined by you here on RIMScast. Everyone can go to RMMagazine.com, and you're already hard at work on Q1 2026, right? Morgan says we put up new articles every week. There's always something new. The digital issues come up every quarter. Check your email inboxes for Editor's Picks, which we will send out once a month!

[38:22] Morgan says those are ways to check us out or be reminded that we're out there providing you with information that you can use.

[39:30] Morgan says, for RIMS members, there is the RIMS Now newsletter we send out to members quarterly with RIMS-centric news.

[39:52] Justin says, It's been a pleasure, and I look forward to seeing you both, hopefully at RISKWORLD in Philadelphia!

[40:13] Special thanks again to Morgan O'Rourke and Hilary Tuttle of RIMS Risk Management Magazine and the RIMS Publications Department for joining us here on RIMScast. Remember to listen to Part 1 of this interview, via the link in this episode's show notes.

[40:19] Visit RMMagazine.com to check out the Year in Risk feature and the Q4 edition of RIMS Risk Management Magazine. This is reporting from the best in the profession. You can't get any better than RIMS Risk Management Magazine.

[40:37] Morgan and Hilary will return for the Mid-year in Risk episode of RIMScast, so subscribe to RIMScast today, don't miss it!

[40:44] Plug Time! You can sponsor a RIMScast episode for this, our weekly show, or a dedicated episode. Links to sponsored episodes are in the show notes.

[41:11] RIMScast has a global audience of risk and insurance professionals, legal professionals, students, business leaders, C-Suite executives, and more. Let's collaborate and help you reach them! Contact pd@rims.org for more information.

[41:29] Become a RIMS member and get access to the tools, thought leadership, and network you need to succeed. Visit RIMS.org/membership or email membershipdept@RIMS.org for more information.

[41:46] Risk Knowledge is the RIMS searchable content library that provides relevant information for today's risk professionals. Materials include RIMS executive reports, survey findings, contributed articles, industry research, benchmarking data, and more.

[42:01] For the best reporting on the profession of risk management, read Risk Management Magazine at RMMagazine.com. It is written and published by the best minds in risk management.

[42:15] Justin Smulison is the Business Content Manager at RIMS. Please remember to subscribe to RIMScast on your favorite podcasting app. You can email us at Content@RIMS.org.

[42:27] Practice good risk management, stay safe, and thank you again for your continuous support!

Links:

RIMS Risk Management Magazine: Year In Risk Edition | Feature Article

RIMS-CRO Certificate Program In Advanced Enterprise Risk Management | April‒June 2026 Cohort | Led by James Lam

RISKWORLD 2026 Registration — Open for exhibitors, members, and non-members!

Reserve your booth at RISKWORLD 2026!

The Strategic and Enterprise Risk Center

RIMS Diversity Equity Inclusion Council

RIMS Risk Management Magazine | Contribute

RIMS Now

Spencer Educational Foundation Scholarships | Submission Deadline Jan. 31, 2026

RISK PAC | RIMS Advocacy