The Sophos report, Cyber Insurance and Cyber Defences 2024: Lessons from IT and Cybersecurity Leaders, reveals that 97% of those with a cyber policy invested in improving their defences to help with insurance, with 76% saying it enabled them to qualify for coverage, 67% to get better pricing, and 30% to secure improved policy terms.
The survey also revealed that recovery costs from cyberattacks are outpacing insurance coverage. Only 1% of those who made a claim said that their carrier funded 100% of the costs incurred while remediating the incident.
The most common reason for the policy not paying for the costs in full was because the total bill exceeded the policy limit. According to The State of Ransomware 2024 survey, recovery costs following a ransomware incident increased by 50% over the last year, reaching $2.73 million on average.
Chester Wisniewski, director and global Field CTO at Sophos, commented that the fact that 76% of companies invested in cyber defences to qualify for cyber insurance shows that insurance is forcing organisations to implement some of these essential security measures. It's making a difference, and it's having a broader, more positive impact on companies overall.
“However, while cyber insurance is beneficial for companies, it is just one part of an effective risk mitigation strategy. Companies still need to work on hardening their defences," he added.
Across the 5,000 IT and cybersecurity leaders surveyed, 99% of companies that improved their defences for insurance purposes said they had also gained broader security benefits beyond insurance coverage due to their investments, including improved protection, freed IT resources, and fewer alerts.
As cyber insurance adoption continues, hopefully, companies' security will continue to improve. Cyber insurance won't make ransomware attacks disappear, but it could very well be part of the solution.