Businesses are compelled to enhance their cybersecurity measures not only to protect their assets but also to qualify for cyber insurance. A recent survey by Sophos, titled “Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders,” reveals that a significant number of companies have improved their cyber defenses to meet insurance requirements. Despite these efforts, the rising costs of recovery from cyberattacks continue to challenge the adequacy of insurance coverage.
The Sophos survey highlights several critical insights into the current landscape of cyber insurance and cybersecurity defenses:
- Investment in Cybersecurity: A staggering 97% of respondents with a cyber insurance policy reported investing in better cyber defenses to help with their insurance needs. This investment was pivotal for 76% of these companies, enabling them to qualify for coverage. Additionally, 67% of respondents noted that their enhanced defenses allowed them to secure better pricing on their policies, while 30% were able to obtain improved policy terms.
- Inadequate Coverage for Recovery Costs: Despite the high level of investment in cybersecurity, the survey reveals a significant gap in coverage when it comes to recovery costs. Only 1% of companies that filed a claim reported that their insurance carrier funded 100% of the costs incurred during remediation. The primary reason for this shortfall was that the total bill often exceeded the policy limit.
- Escalating Recovery Costs: According to “The State of Ransomware 2024” survey, the financial burden of recovering from ransomware attacks has surged dramatically. Over the past year, recovery costs have increased by 50%, reaching an average of $2.73 million per incident. This escalation in costs underscores the growing complexity and impact of cyberattacks on businesses.
The findings from the Sophos survey underscore the critical need for businesses to not only invest in robust cybersecurity measures but also to carefully evaluate their cyber insurance policies. While enhancing cyber defenses is essential for qualifying for insurance and potentially lowering premiums, companies must also ensure that their policies provide adequate coverage for the full spectrum of potential recovery costs.
