A recent Sophos survey, “Cyber Insurance and Cyber Defenses 2024,” has revealed a growing trend of companies prioritizing cybersecurity to qualify for cyber insurance. It also highlights a gap between insurance coverage and the rising costs of cyberattacks.
Though the Sophos report suggests that cyber insurance may inadvertently improve overall security posture by encouraging better security practices, as adoption rates rise, companies can potentially leverage cost savings to further strengthen their defenses.
“While cyber insurance isn’t a magic bullet against ransomware, it can be a crucial part of a comprehensive risk mitigation strategy,” it noted.
Key Findings:
- Cybersecurity for Insurance:
- 97% of companies with cyber insurance policies have invested in improving their cyber defenses.
- Of these, 76% say these improvements were specifically to qualify for insurance, with the remaining aiming for better pricing (67%) and improved policy terms (30%).
- Insurance Coverage Gaps:
- Only 1% of companies that made a claim received full coverage for their recovery costs.
- The most common reason for incomplete coverage was exceeding policy limits.
- The State of Ransomware 2024 survey by Sophos reveals a 50% increase in average ransomware recovery costs, reaching a staggering $2.73 million.
- The Positive Impact of Cyber Insurance:
- Despite coverage limitations, 99% of companies that improved defenses for insurance reported broader security benefits, including:
- Enhanced protection
- Reduced workload for IT staff
- Fewer security alerts
- Despite coverage limitations, 99% of companies that improved defenses for insurance reported broader security benefits, including:
Meanwhile, Chester Wisniewski, Director of Global Field CTO at Sophos, commenting on the report emphasizes the positive impact of cyber insurance in driving companies to implement basic security measures. He, however, cautioned against relying solely on insurance.
“Cyberattacks can have devastating operational and reputational consequences. While insurance is valuable, it’s just one piece of the puzzle. Companies must prioritize fortifying their defenses,” he said.