‘76 per cent of companies improve cyber defence, insurance deals’

Cybersecurity solutions firm, Sophos, in its ‘Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders’ survey, said 76 per cent of companies improved their cyber defence as they battled attacks from hackers.

Sophos said 97 per cent of firms have a cyber policy while 67 per cent get better pricing and 30 per cent secured improved policy terms, which are targeted at improving security.

But the survey revealed that recovery costs from cyberattacks are outpacing insurance coverage. It noted that only one per cent of those who made a claim said that their carrier funded 100 per cent of the costs incurred while remediating the incident.

The report noted that the most common reason for the policy not paying for the costs in full was because the total bill exceeded the policy limit.

According to The State of Ransomware 2024 survey, recovery costs following a ransomware incident increased by 50 per cent over the last year, reaching $2.73 million on average.

Director, Global Field CTO, Chester Wisniewski, said: “The Sophos Active Adversary report has repeatedly shown that many of the cyber incidents companies face are the result of a failure to implement basic cybersecurity best practices, such as patching promptly. In our most recent report, for example, compromised credentials were the number one root cause of attacks, yet 43 per cent of companies didn’t have multi-factor authentication enabled.

“The fact that 76 per cent of companies invested in cyber defenses to qualify for cyber insurance shows that insurance is forcing organisations to implement some of these essential security measures. It’s making a difference, and it’s having a broader, more positive impact on companies overall. However, while cyber insurance is beneficial for companies, it is just one part of an effective risk mitigation strategy. Companies still need to work on hardening their defenses. A cyberattack can have profound impacts for a company from both an operational and a reputational standpoint, and having cyber insurance doesn’t change that.”

Across the 5,000 IT and cybersecurity leaders surveyed, 99 per cent of companies that improved their defenses for insurance purposes said they had also gained broader security benefits beyond insurance coverage due to their investments, including improved protection, freed IT resources and fewer alerts.