Cyber Insurance and Cyber
Defenses 2024: Lessons fromIT and Cybersecurity Leaders
Real-world insights into cyber insurance adoption, claim payouts,
and the interplay between cyber defenses and insurance coverage.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Introduction

Executive summary

Cyber risk is inevitable. No business with internet-connected devices caneliminate cyber risk entirely; rather it’s a question of how to manage it. Two of the
primary approaches to cyber risk management are treatment by deploying cybercontrols and changing user behaviors, and transfer through cyber insurance.
Treatment and transfer are complementary elements of a balanced cyber risk
management program, and each organization needs to identify where theirequilibrium lies.

In the face of inevitable cyberattacks, adopting a holistic approach to cyber risk
management that takes advantage of the interplay between cyber defenses
and cyber insurance will enable organizations to lower their overall total cost ofownership (TCO) of cyber risk management while reducing their likelihood ofexperiencing a major incident.

Cyber risk treatment and transfer are also interconnected, with security controls
and behaviors having a direct impact on an organization’s ability to transfer risk
through insurance. Strong, effective cyber controls reduce cyber risk, making iteasier to access lower priced coverage. Conversely, organizations with weak risktreatment often struggle to get the policy they need at a price they can afford.
With cyber risk now a board-level consideration for many organizations, this reportshines light on cyber insurance adoption in mid-sized organizations, including
the factors driving the purchase. It provides new insights into the interplay
between defenses and insurance, illustrating the impact of investment in defense
improvements on insurability. It also explores payout on claims, including the
primary reasons for claims being denied.

Based on an independent survey of 5,000 leaders
The report is based on the findings of an independent, vendor-agnostic survey
commissioned by Sophos of 5,000 IT/cybersecurity leaders across 14 countries
in the Americas, EMEA, and Asia Pacific. All respondents represent organizations
with between 100 and 5,000 employees. The survey was conducted by research
specialist Vanson Bourne between January and February 2024, and participants
were asked to respond based on their experiences over the previous year.

A Sophos Whitepaper. June 2024

As the survey findings illustrate, cyber insurance acts as both a carrot and a stickfor security investments. By setting minimum security control requirements toattain coverage – the “stick” - the insurance industry is effectively forcing manyorganizations to elevate their cyber defenses. A common example is multi-factor
authentication (MFA), which is often a prerequisite for policy purchase.
In parallel, by recognizing and rewarding strong defenses through lower premiums,
higher policy limits and improved terms, cyber insurers are incentivizing risk
reduction through superior protection. An example of this “carrot” is the improved
access to coverage and lower policy costs that many insurance providers offer toorganizations using a managed detection and response (MDR) service.
The research also reveals that investing in cyber defenses to optimize yourinsurance position is a double win: organizations report both easier and cheaper
access to coverage as well as wider benefits such as improved protection, fewer
alerts, and freeing up IT time. This finding further emphasizes the importanceof considering cyber risk investments holistically, rather than as individualcomponents.
One area of concern highlighted by the survey is the potential for policy purchases
to be misaligned to business needs. Cyber insurance is an investment, andorganizations should be sure that their policy provides the coverage they needin the event of a major incident. All stakeholders, including the IT/cybersecurity
teams that will be at the frontline if an incident occurs, should be involved in theinsurance policy decisions to ensure that any investment meets the organization’s
needs.

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Cyber insurance adoption 2024

Adoption rates by industry

The survey confirms that adoption of cyber insurance is widespread withinorganizations with 100-5,000 employees, with 90% of organizations having someform of cyber coverage. 50% have a standalone policy while 40% have cyber as partof a wider business insurance policy, such as a general liability policy.

Energy, oil/gas, and utilities is the sector with the highest rate of insurance adoption(97%) and also the highest use of standalone cyber insurance policies (68%) totransfer risk. This likely reflects the high level of regulation in the sector and highpotential liability. It is also likely a result of the industry’s widespread use of legacy
technology and infrastructure controls, which make it harder to secure devices, limit
lateral movement, and prevent attacks from spreading.

Organizational revenue has little impact on propensity to have cyber coverage:Ì 92% of those with less than $50M annual revenue have coverage (n=664)
Ì 93% of those with $1B+ annual revenue have coverage (n=1,907)
Similarly, when we look at the data based on the number of employees, there are justfive percentage points difference between the highest adoption rate (93%, 100-250
employees) and the lowest (88%, 1,001-3,000 employees).

Central/federal government reports the lowest adoption rate together with
IT, technology, and telecoms (both 81%). However, with more than four in fiveorganizations in all sectors having coverage, it’s clear that cyber insurance is verymuch the norm.

Cyber insurance adoption by industry
47%

39%

30%

64%
54%

Business andpro. Services
(n=257)

29%
37%

33%

40%

41%

36%

47%

52%

47%

48%

43%

44%

40%

42%

58%
51%

Education(higher)

Education(lower)(n=300)(n=300)

Energy, oil/gas, utilities(n=275)(n=250)

54%

38%

44%

46%

52%

Financialservices(n=592)

Healthcare(n=402)IT,
Manufacturing
Media,
technology
andleisure andand telecoms production entertainment(n=262)Standalone cyber insurance policy(n=585)Retail(n=577)(n=253)Cyber insurance included in a wider business insurance policy

Does your organization have cyber insurance? Yes, we have a standalone cyber insurance policy; Yes, we have cyber insurance as part of a wider business insurance policy(e.g. a general liability policy). Base numbers in chart.

A Sophos Whitepaper. June 2024

41%

68%

40%

Central/Construction Distribution
federaland property
and(n=257)governmenttransport(n=257)39%

State/local
government(n=270)Other(n=170)Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Adoption rates by country
Cyber insurance is widely used to transfer cyber risk in all countries surveyed.
Respondents in Singapore reported the highest adoption rate (96%), and those in
Brazil the lowest (83%). Singapore also has the highest percentage of organizations
with standalone cyber policies (68%), while France has the greatest coveragethrough business policies that include cyber (48%).
Cyber insurance adoption by country

44%

24%

33%

48%

43%

36%

28%
45%

42%

44%

35%

44%

35%

39%

68%
61%

57%
50%

43%

52%

50%
40%

42%

43%

54%

52%

55%

41%

Australia

Austria

BrazilFranceGermany

India

Italy

Japan

Singapore

South Africa

Spain

Switzerland

Uk

US(n=330)(n=165)(n=330)(n=250)(n=500)(n=500)(n=330)(n=500)(n=165)(n=330)(n=250)(n=165)(n=330)(n=170)Standalone cyber insurance policy

Cyber insurance included in a wider business insurance policy

Does your organization have cyber insurance? Yes, we have a standalone cyber insurance policy; Yes, we have cyber insurance as part of a wider business insurance policy(e.g. a general liability policy). Base numbers in chart.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Factors driving cyber insurance adoption
While multiple factors motivate organizations to adopt cyber insurance, generalawareness of the business impact of cyberattacks/cyber crime is the most common
reason behind the purchase, cited by 48% of respondents. Approaching half (45%) of
respondents said that cyber insurance is part of their cyber risk mitigation strategy.
In third position is to enable us to work with clients/business partners who require it(42%). Cyber insurance is increasingly a condition of doing business as organizations
look to mitigate the risk of supply chain attacks by ensuring their commercial
partners have insurance coverage. We will explore this at an industry level on thenext page.
Board or senior management request is a contributing factor to more than a third(38%) of purchases, illustrating the business-critical impact of the effects of a cyberincident. While regulatory requirement is the least common purchase driver overall(34%), there is considerable variation by sector, reflecting their different complianceneeds.

Factors driving cyber insurance purchases

General awareness ofthe business impact ofcyberattacks/ cyber crime

48%

Part of our cyber risk
mitigation strategy

45%

To enable us to work withclients/ business partners
who require it

42%

To keep pace withbest practice39%

Requested by the board orsenior management38%

We experienced
a cyberattack37%

Ì Highest 48% of respondents in IT, technology and telecoms
 40% of respondents in energy oil/gas and utilities
Ì Lowest
 25% of respondents in local government
 26% of respondents in construction and property

Regulatory requirement

34%

What main factor(s) drove the decision for your organization to purchasecyber insurance? n=4,498 organizations with cyber insurance.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Insurance as a condition of businessConversely, media, leisure and entertainment is the sector least likely to be
motivated by this purchase driver (31%), followed by distribution and transport(36%). This result in the logistics sector is surprising given that, if a distribution
provider is paralyzed by an attack, the ramifications for the customers whose goods
cannot be delivered is very high.

Across all sectors, the need to enable us to work with clients/business partners who
require it contributed to 42% of insurance purchases. When we dive deeper, we seethat there is considerable variation by industry.
Energy, oil/gas and utilities has the highest proportion of respondents that citedbusiness requirement as a purchase driver (49%), closely followed by construction
and property (48%). It is likely that the high impact of attacks on the energy/utilities
sector together with their legacy technology challenges is driving a high need for risk
mitigation through insurance in their clients and business partners.
Insurance as a condition of business by industry

44%

46%

49%

48%
43%

41%

41%

44%

42%

44%

41%

44%
38%

36%
31%

Business andpro. Services
(n=257)

Central/Construction Distribution
federaland property
and(n=257)governmenttransport(n=257)

Education(higher

Education(lower(n=300)(n=300)

Energy, oil/gas, utilities(n=275)

Financialservices

Healthcare(n=402)(n=592)(n=250)What main factor(s) drove the decision for your organization to purchase cyber insurance? To enable us to work withclients/ business partners who require it. n=4,498 organizations with cyber insurance.

A Sophos Whitepaper. June 2024

IT,
Manufacturing
Media,
technology
andleisure andand telecoms production entertainment(n=262)(n=585)(n=253)Retail(n=577)

State/local
government(n=270)Other(n=170)Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Policy coverage
Respondents were asked what their policy would cover in the event of a cyberincident, revealing widespread uncertainty as to what assistance they would receive
if they made a claim.
Illustrating this point, 40% of respondents whose organization has a cyber insurance
policy think it covers ransom payments, but are not certain, and 41% think but are
not sure that their policy covers income loss.
These findings are cause for concern on several fronts:
1. Organizations risk not getting the coverage they need. It is essential that all
parties within the business are clear on what they require in their policy andthese needs inform the insurance purchase.
2. Organizations risk not getting the support they expect in the event of aclaim. Dealing with a major cyber incident is a stressful and pressured time
for all involved. To discover in the heat of an attack that expected support is
not included in the insurance policy adds further complexity, delay, and cost to
remediation.

The lack of visibility into policy coverage likely results, at least in part, froma disconnect between those purchasing the policy (typically finance and/or
compliance teams) and those on the frontline should a major incident occur(typically IT and cybersecurity functions). Organizations should be sure to involve
all stakeholders in the purchase decision, and to ensure that all parties are awareof what the policy does and does not cover. This will enable teams to put in placealternative options to address any gaps.
Ransomware is one of the biggest cyberthreats facing businesses today and thefinancial impact on victims can be severe. The average (median) ransom payment is
now $2M, and the overall recovery cost excluding any ransom payment comes in at$2.73M (source: The State of Ransomware 2024, Sophos). It is therefore surprising
to see that one in ten organizations has invested in insurance that does not cover
many of the costs incurred with a ransomware attack, including ransom payments,
breach notification, breach negotiations and income loss.

Policy coverages
RANSOM
PAYMENTSDATA RECOVERYSERVICES

BREACHNOTIFICATIONSPR SUPPORT/REPUTATIONMANAGEMENT

INCIDENTRESPONSESUPPORT

BREACHNEGOTIATIONSINCOME LOSSCOMPUTERSYSTEMRESTORATION

I know it covers this

50%

58%

47%

47%

54%

48%

49%

55%

I think it covers this, but it might not

40%

35%

43%

42%

38%

42%

41%

38%

I know it doesn’t cover this

10%

7%

9%

11%

8%

10%

10%

7%

Don’t know

0%

0%

0%

1%

0%

1%

0%

0%

What does your organization’s cyber insurance policy cover in the event of a cyber incident? n=4,498 organizations with cyber insurance.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Cyber insurance and cyber defense
investments
97% of organizations that purchased a cyber insurance policy last year said that they
invested in improving their defenses to optimize their insurance position. Almost two
thirds (63%) said they made major investments in their cyber defenses while 34%
made minor investments.

Invested in improving
cyber defenses

While almost all organizations across all sectors that purchased a policy invested in
improving their defenses to improve their insurance position, some sectors reporthigher levels of major investment than others.
Energy, oil/gas and utilities had the highest percentage of respondents that said
they had made major investments in their cyber defenses in order to optimize theirinsurance position (73%). This likely reflects the cybersecurity struggles the industry
has faced due to high levels of legacy technology as well as the high impact of
critical infrastructure outages.
Higher education reported the second highest level of major investment (70%). This
sector has also been challenged by previous under-investment in cyber defenses,
increasing exposure to attack.

97%
Major investment

Minor investment

63%

34%

If your organization has purchased a cyber insurance policy in the last year, did you invest
in improving your cyber defenses to optimize your cyber insurance position? n=4,498.

A Sophos Whitepaper. June 2024

Cyber insurance and cyber defense investments by industry

The two government sectors are least likely to have made major investments in theirdefenses (54% in central/federal government, 55% in state/local government). It
may be that strained government budgets have reduced available funding for theseindustries.

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Cyber insurance and cyber defense investments by industry
1%
32%

4%

42%

2%

2%

2%

4%

37%

33%

27%

33%

26%
34%

65%

2%

36%

30%

61%

(n=257)

2%

2%

1%

33%

35%

43%

35%

65%

Education(higher)

Education(lower)(n=300)(n=300)

Energy, oil/gas, utilities(n=275)

Financialservices

Healthcare(n=592)(n=250)(n=402)Major investments

Minor investments

55%

IT,
Manufacturing
Media,
technology
andleisure andand telecoms production entertainment(n=262)(n=585)

63%

63%

57%

Central/Construction Distribution
federaland property
and(n=257)governmenttransport(n=257)

39%

1%

61%

54%

Business andpro. Services

4%

68%
63%

61%

2%

73%

70%

67%

5%

1%

Retail(n=577)

State/local
government

Other(n=170)(n=270)(n=253)

No Investments

If your organization has purchased a cyber insurance policy in the last year, did you invest in improving your cyber defenses to optimize your cyber insurance position? Base numbers in chart.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Impact of cyber defense investments on
cyber insurance position
The good news for any organization considering spending in this area is that almost
every company that invested in improving their cyber defenses said it had a positive
impact on their cyber insurance position (99.6%, 4,351 of 4,370 respondents).
Substantiating the role of cyber insurance as a “stick” to drive better defenses, overthree-quarters (76%) of respondents said that their investment enabled them to getinsurance coverage that they would not have been able to secure otherwise.
The “carrot” is that two thirds of organizations were able to access better priced
coverage (e.g., cheaper premiums or lower deductible/excess) as a result of theirinvestments in their cyber defenses, while 30% said their improved protection
enabled them to get better terms (e.g., higher coverage limits).
These figures make clear the importance of considering the overall total cost ofownership (TCO) of cyber risk reduction. Investments in elevated defenses unlock
cyber insurance savings while also reducing the likelihood of experiencing a major
cyber incident.

A Sophos Whitepaper. June 2024

Impact of cyber defense investments

Enabledorganization
to qualify forcoverage

Enabledorganization
to get better
priced coverage

Enabledorganization
to get better
priced policy
terms

76%

67%

30%

How did investing in improving your cyber defenses positively impact yourinsurance position? n=4,370 organizations that invested in improving
their cyber defenses to optimize their cyber insurance position

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Impact of cyber defense investments by industry
Across all sectors, the insurance benefits of cyber defense investments are
considerable. While there are no losers, central/federal government is thenamed sector with the highest percentage of respondents reporting that theirimprovements enabled them to qualify for coverage (84%) and is also the sector thatmost benefited from better priced coverage (76%). Energy, oil/gas and utilities has
the highest percentage of respondents able to access better coverage terms as aresult of their investments (44%).
Impact of cyber defense investments by industry
84%
76%
68%

81%

79%

81%

78%

79%

72%

71%

72% 72%

68% 57%

68%

67%

70%

44%

Business andpro. Services
(n=257)

40%
35%

34%

33%

15%

11%

Education(higher)

Education(lower)(n=300)(n=300)

Energy, oil/gas, utilities(n=275)

Financialservices

Healthcare(n=402)(n=592)(n=250)IT,
Manufacturing
Media,
technology
andleisure andand telecoms production entertainment(n=262)

Enabled access to coverage

Enabled better priced coverage

How did investing in improving your cyber defenses positively impact your insurance position? Base numbers in chart

A Sophos Whitepaper. June 2024

65%

25%

23%
18%

Central/Construction Distribution
federaland property
and(n=257)governmenttransport(n=257)

73%
66%

66%

41%
33%

29%
22%

73%

71%

67%

57%

55%

22%

67%

85%

82%

78%

(n=585)(n=253)

Enabled better coverage terms

Retail(n=577)

State/local
government(n=270)Other(n=170)Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Broader impact on defense investments

Percentage of costs covered by insurance

Not only do organizations that invest in improving their cyber defenses see
insurance benefits, 99% also report wider benefits to their organization, such as
improved protection, fewer alerts, freeing up IT time, etc. Diving deeper, we see that
70% have seen a lot of wider benefits from their improved cyber defenses, while 29%
have seen a few wider benefits.

Cyber insurance enables organizations to transfer cyber risk, providing peace ofmind that they will not be exposed to the full costs of the incident should the worst
happen.

99%

Organizations that have invested in a cyber policy will be encouraged to learn
that insurers almost always pay out in some capacity on a claim. Overall, only one
respondent said that their carrier did not pay out at all on their claim.
At the same time, insurers rarely cover the full incident cost, with 1% saying thecarrier funded 100% of their costs incurred. Overall, insurers typically paid 63% of thetotal incident cost, with the modal payout rate coming in at 71-80%.

enjoyed non-insurance
benefits from cyberdefense investments

Percentage of total incident costs covered

70%

29%

a lot of wider benefits

a few wider benefits

19%

13%

Did investing in improved cyber defenses for cyber insurance purposes positively
impact your organization in other ways? n=4,370 organizations that made investments
in improving their defenses to optimize their cyber insurance position.

All industries reported high levels of wider benefits from their investments, howeverenergy, oil/gas and utilities was most likely to report seeing a lot of wider benefits(82%). Conversely, manufacturing and production had the lowest percentage
reporting wider benefits – although even here nearly two thirds (63%) saw aconsiderable positive impact.
These wider benefits are the icing on the cake for organizations that make cyberdefense improvements: not only do they benefit from easier and cheaper access tocoverage, they also enjoy reduced cybersecurity impact.

A Sophos Whitepaper. June 2024

20%

8%

14%

8%

6%

5%

3%
0%
0%

1%

1%

1-10% 11-20% 21-30% 31-40% 41-50% 51-60% 61-70% 71-80% 81-90% 91-99%

100%

Percentage of total cost covered by insurance

If you made a claim on your organization’s cyber insurance policy in the last year,
what percentage of the total incident cost did the insurance cover? n=3,945

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Reasons for costs not being fully covered
The reasons why the total incident cost was not covered by the insurance provider
shine important light that can help inform future policy purchases.
The most common reason for the recovery bill to not be paid in full is that the
total costs exceeded the policy limit (63%). With the average cost to remediatea ransomware attack now $2.73M, organizations should ensure that their policy
provides sufficient coverage should they experience a major incident.
In second position is costs were incurred without the insurer’s permission, cited in
58% of cases. Organizations are advised to be aware of the requirements of theirpolicies and the processes they need to follow in order for claims to be allowed.
45% of respondents said that they had costs/losses that weren’t covered by the
insurance policy. With nearly one in two cyber-attack victims reporting it, thissuggests that mis-alignment of policy and needs is widespread.
14% of denied claims (one in seven) were due to the organization not having therequired cyber defenses for the claim to be honored. Insurance providers stipulaterequired security controls as a condition of coverage, for example, regularly
patching vulnerabilities, not running end-of-life software, or deploying an endpoint
detection and response (EDR) solution. Not adhering to these requirements exposesorganizations to the risk that they will not see full return on their insurance purchase.

A Sophos Whitepaper. June 2024

Reasons why cyber insurance did not cover the full incident cost

The total costs exceeded
the policy limit

63%

Costs were incurred without
the insurer's permission

58%

Some costs/lossed weren't
covered by the insurance policy

My organization did not havethe required cyber defenses forthe claim to be honored

45%

14%

Why didn’t your organization’s cyber insurance cover the total incident cost? n=3,886
organizations that did not have their full claim covered by the insurance provider

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Impact of cyber insurance coverage on
ransomware outcomes
The goal of insurance is to reduce the impact of perils on an organization. With thisin mind, we analyzed the findings from the Sophos State of Ransomware 2024
study to identify whether there is any correlation between insurance position andoutcomes, focusing on five core milestones of the victim journey:Ì Propensity to be hit by ransomware
Ì Propensity to have data encryptedÌ Ransom payment amountÌ Propensity to pay the ransom to recover encrypted dataÌ Overall recovery costs (excluding the ransom payment)
One important caveat to preface this analysis is that we do not know whether thevictim’s current insurance policy was purchased before or after their ransomware
attack, i.e. if the purchase decision was influenced by their prior ransomware
experience or whether it was already in place. However, with cyber insurance
adoption by State of Ransomware participants remaining stable over the last
two years (90% in the 2024 study, 91% in the 2023 study) the analysis provides areasonable indicative starting point to facilitate further research in this area.

Propensity to have data encrypted
Organizations with coverage are more likely to have data encrypted than those
without a policy, however they are less likely to also have data exfiltrated as part of
the attack:Ì 74% with a standalone policy had data encrypted, withdata exfiltrated in 23% of cases (n=1,560)
Ì 68% with cyber as part of a wider policy had data encrypted,
with data exfiltrated in 41% of cases (n=1,127)
Ì 52% without a cyber policy had data encrypted, withdata exfiltrated in 61% of cases (n=284)

Ransom payment amount
Organizations with cyber policies report lower average ransom payment amounts
than those without coverage. The median payment by those without cybercoverage came in at $3.41 million, considerably above the $2 million for those with astandalone policy and $1.53 million for those with cyber as part of a wider business
policy.
Average ransom payment$3.41M

Propensity to be hit by ransomware
The data shows very little difference in the ransomware attack rate based on cyber
insurance adoption, with all three groups reporting very similar propensity to havebeen hit in the last year:$2.0M$1.53MÌ 62% with a standalone policy were hit by ransomware in the last year (n=2,523)
Ì 57% with cyber as part of a wider policy were hit byransomware in the last year (n=1,975)
Ì 58% without a cyber policy were hit by ransomware in the last year (n=489)

Standalone
PolicyCyber as part ofa wider policy

No cybercoverage(n=699)(n=356)(n=42)How much was the ransom payment that was paid to theattackers? n=1,097 Base numbers in chart

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Propensity to pay the ransom to recover encrypted data
The data indicates that having insurance coverage correlates with higher propensity
to pay the ransom to get data back. Standalone policy holders report the highest
rate of ransom payment, and were more than twice as likely to pay the ransom thanthose without cyber coverage (64% vs. 28%). They are also the only group that is justas likely to pay the ransom than use backups to recover encrypted data.
Paid the ransom and got data back

2024

80%
74%

72%
62%

72%

58%

64%
49%

36%

64%

49%

28%

with astandalone
policywith cyber aspart of a wider
policywithout a cyberpolicy(n=744)(n=375)(n=42)All three groups reported a greater likelihood of paying the ransom in our 2024
survey vs. 2023, and those with a standalone policy or no cyber coverage also
reported increased use of backups to recover encrypted data over the last year.

A Sophos Whitepaper. June 2024

2023

28%
15%

Standalone policy: Use backups

Wider business policy: Pay ransom

No cyber coverage: Use backups

No cyber coverage: Pay ransom

Standalone policy: Use backups

Wider business policy: Pay ransom

Did your organization get any data back? Yes, we paid the ransom and got data back; Yes,
we used backups to restore the data. n=2,072 (2024), 1,497 (2023). Note: respondents
could select both options if they deployed multiple methods to recover their data.

While the data may appear to suggest that cyber insurance — and in particular
standalone policies — is driving the payment of ransom, it’s important to rememberthat we do not know whether the insurance policy purchase was before or after the
ransom was paid. It may be that the organization chose to purchase a standalone
policy after experiencing the financial pain of a ransom payment. Alternatively,
insurance policies may be making it more viable for organizations to pay bycontributing to the funding.

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

Overall recovery costs

Conclusion

The ransom payment is just one element of the recovery cost. Independent of
whether a ransom was paid, multiple factors contribute to the overall financial
impact, including data notification costs, the opportunity cost from being unable totransact, people time, and more.

Cyber insurance is now an established pillar in most cyber risk mitigation
strategies. It’s time to move from siloed solutions to a holistic approach to cyberrisk management that takes advantage of the interplay between cyber defenses
and cyber insurance. By making smart investments in elevated cyber defenses,
businesses can unlock considerable cyber insurance savings while also enjoying
wider operational benefits and reduced likelihood of experiencing an attack.

Across all respondents, the mean estimated cost to recover from the ransomware
attack was $2.73M. The data shows that, while all organizations experience a
considerable financial hit from the attack, those without insurance coverage incur
the biggest bill.
Overall ransomware recovery costs (excluding ransom payment)$3.48M$2.94M$2.26M

Standalone
PolicyCyber as part ofa wider policy

No cybercoverage(n=1,555)(n=1,127)(n=282)

What was the approximate cost to your organization to rectify the impacts of themost signiificant ransomware attack (considering downtime, people time, device
cost, network cost, lost opportunity etc.)? n=2,964 Base numbers in chart

As stated, this analysis should be considered a starting point for further explorationof this area of research. With ransomware experience and cyber insurance coveragecommon to many organizations, it would be helpful to dive deeper into how having
insurance impacts ransomware experiences.

A Sophos Whitepaper. June 2024

Cyber Insurance and Cyber Defenses 2024: Lessons from IT and Cybersecurity Leaders

To discuss your cyber defense requirement, speak with a
Sophos adviser today or visit www.sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-06-27 (WP-DD)