Survey: investments in cybersecurity needed for insurance

A recent survey conducted by Sophos has revealed critical insights into the intersection of cyber insurance and cybersecurity practices among companies. The survey, titled "Cyber Insurance and Cyber Defences 2024: Lessons from IT and Cybersecurity Leaders," found that an overwhelming 97% of organisations with a cyber insurance policy had invested in enhancing their cybersecurity defences to meet insurance requirements.

According to the report, 76% of respondents stated that these investments enabled them to qualify for cyber insurance coverage, 67% said it led to better pricing, and 30% reported securing improved policy terms. However, despite these improvements, recovery costs from cyberattacks are still outpacing insurance coverage.

The survey found that only 1% of those who made a claim were reimbursed fully by their insurers, with the primary reason for coverage shortfall being that the total costs exceeded policy limits. A connected survey, "The State of Ransomware 2024," indicated that recovery costs following a ransomware incident have surged by 50% in the last year, averaging USD $2.73 million.

Chester Wisniewski, global Field CTO at Sophos, commented on the findings, highlighting the common root causes of cyber incidents. "The Sophos Active Adversary report has repeatedly shown that many of the cyber incidents companies face are the result of a failure to implement basic cybersecurity best practices, such as patching in a timely manner. In our most recent report, for example, compromised credentials were the number one root cause of attacks, yet 43% of companies didn't have multi-factor authentication enabled," he said.

Wisniewski emphasised the role of cyber insurance in driving improvements but warned that insurance alone is insufficient. "The fact that 76% of companies invested in cyber defences to qualify for cyber insurance shows that insurance is forcing organisations to implement some of these essential security measures. It's making a difference, and it's having a broader, more positive impact on companies overall. However, while cyber insurance is beneficial for companies, it is just one part of an effective risk mitigation strategy. Companies still need to work on hardening their defences. A cyberattack can have profound impacts for a company from both an operational and a reputational standpoint, and having cyber insurance doesn't change that," he added.

The survey included 5,000 IT and cybersecurity leaders from 14 countries across the Americas, EMEA, and Asia Pacific. The organisations surveyed varied in size from 100 to 5,000 employees and had revenues ranging from less than USD $10 million to more than USD $5 billion.

An important finding from the survey was that 99% of the companies that improved their defences for insurance purposes also reported broader security benefits. These included enhanced protection, freed IT resources, and fewer security alerts, suggesting that the investments in cybersecurity had broader positive implications beyond merely qualifying for insurance.

Wisniewski concluded by noting the potential long-term benefits of cyber insurance adoption, saying, "Investments in cyber defences appear to have a ripple effect in terms of benefits, unlocking insurance savings that organisations can be diverted into other defences to more broadly improve their security posture. As cyber insurance adoption continues, hopefully, companies' security will continue to improve. Cyber insurance won't make ransomware attacks disappear, but it could very well be part of the solution."

The data for the "Cyber Insurance and Cyber Defences 2024: Lessons from IT and Cybersecurity Leaders" report were gathered through a vendor-agnostic survey conducted between January and February 2024. The comprehensive report offers global findings and sector-specific data, available on the Sophos website.