Cybersecurity company Sophos released findings from its survey: Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders.
According to the report, 97 percent of those with a cyber policy invested in improving their defenses to help with insurance, noting it allowed them to qualify for coverage (76 percent), get better pricing (67 percent) or secure better policy terms (30 percent).
The survey also revealed that recovery costs from cyberattacks are outpacing insurance coverage, with just one percent of those making a claim indicating that their carrier funded 100 percent of remediation costs. The most common reason for the policy not paying in-full for cost was the bill exceeding policy limits.
According to Sophos’ The State of Ransomware 2024 survey, recovery costs following a ransomware incident increased by 50 percent over the last year, reaching $2.73
million on average.
“The Sophos Active Adversary report has repeatedly shown that many of the cyber incidents companies face are the result of a failure to implement basic cybersecurity best practices, such as patching in a timely manner,” said Sophos director, global field CTO, Chester Wisniewski. “In our most recent report, for example, compromised credentials were the number one root cause of attacks, yet 43 percent of companies didn’t have multi-factor authentication enabled. The fact that 76 percent of companies invested in cyber defenses to qualify for cyber insurance shows that insurance is forcing organizations to implement some of these essential security measures. It’s making a difference, and it’s having a broader, more positive impact on companies overall. However, while cyber
insurance is beneficial for companies, it is just one part of an effective risk mitigation strategy. Companies still need to work on hardening their defenses. A cyberattack can have profound impacts for a company from both an operational and a reputational standpoint, and having cyber insurance doesn’t change that.”
Across the 5,000 IT and cybersecurity leaders surveyed, 99 percent of companies that improved their defenses for insurance purposes indicated that they also gained broader security benefits, beyond insurance coverage, due to investments such as improved protection, freed IT resources and fewer alerts.
“Investments in cyber defenses appear to have a ripple effect in terms of benefits, unlocking insurance savings that organizations can be diverted into other defenses to more broadly improve their security posture,” said Wisniewski. “As cyber insurance adoption continues, hopefully, companies’ security will continue to improve. Cyber insurance won’t make ransomware attacks disappear, but it could very well be part of the solution.”
Sophos’ vendor-agnostic survey included responses from 5,000 cybersecurity and IT leaders, conducted January-February 2024. Respondents were based in 14 countries across the Americas, EMEA and Asia Pacific. Organizations surveyed had between 100 and 5,000 employees, and revenue ranged from below $10 million to over $5 billion.
Read the full report here. For Sophos’ partner program, click here.
