Recovery costs from cyberattacks outpace insurance coverage

Almost all (97%) of companies with a cyber policy invested in improving their defences to help with insurance, a report from Sophos shows.

Among such firms, 76% say improved defences enabled them to qualify for coverage, 67% said they did so to get better pricing and 30% to secure improved policy terms.

These are based on a a vendor-agnostic survey of 5,000 cybersecurity/IT leaders conducted between January and February 2024. Respondents were based in 14 countries across the Americas; Europe, the Middle East and Africa; and the Asia-Pacific.

The survey also revealed that recovery costs from cyberattacks are outpacing insurance coverage. Only one percent of those that made a claim said that their carrier funded 100% of the costs incurred while remediating the incident. The most common reason for the policy not paying for the costs in full was because the total bill exceeded the policy limit. 

According to The State of Ransomware 2024 survey, recovery costs following a ransomware incident increased by 50% over the last year, reaching $2.73 million on average.

“The Sophos Active Adversary report has repeatedly shown that many of the cyber incidents companies face are the result of a failure to implement basic cybersecurity best practices, such as patching in a timely manner. In our most recent report, for example, compromised credentials were the number one root cause of attacks, yet 43% of companies didn’t have multi-factor authentication enabled,” said Chester Wisniewski, director, global Field CTO.

Wisniewski said the numbers show that insurance is forcing organizations to implement some of these essential security measures. It’s making a difference, and it’s having a broader, more positive impact on companies overall. 

“However, while cyber insurance is beneficial for companies, it is just one part of an effective risk mitigation strategy. Companies still need to work on hardening their defences,” he said. “A cyberattack can have profound impacts for a company from both an operational and a reputational standpoint, and having cyber insurance doesn’t change that.”

Across the 5,000 IT and cybersecurity leaders surveyed, 99% of companies that improved their defences for insurance purposes said they had also gained broader security benefits beyond insurance coverage due to their investments, including improved protection, freed IT resources and fewer alerts.

“Investments in cyber defences appear to have a ripple effect in terms of benefits, unlocking insurance savings that organisations can be diverted into other defences to more broadly improve their security posture. As cyber insurance adoption continues, hopefully, companies’ security will continue to improve. Cyber insurance won’t make ransomware attacks disappear, but it could very well be part of the solution,” said Wisniewski.