Report: Cyber Insurance Market Heats Up as Scale and Cost of Attacks Rise

A new study from Recast Software and Ponemon Institute found that 41% of organizations had experienced an increase in the number of cybersecurity incidents, leading many to seek protection in the form of cybersecurity insurance

Minneapolis, Minnesota (January 25th, 2024) Recast Software, a leader in endpoint management, announces the results of a study on cybersecurity insurance. A key takeaway from the study, sponsored by Recast Software and conducted by Ponemon Institute in the Fall of 2023, is that the severity and sophistication of cyberattacks has increased along with the financial consequences, prompting many companies to invest in cybersecurity insurance.

Enterprise cyberattacks on the rise

Among the 631 IT and security pros surveyed by Ponemon Institute for this study, 41 percent said their organization had experienced an increase in the number of cybersecurity incidents in 2023, 61 percent said the total cost of these attacks had averaged $21 million, and 75 percent said their cybersecurity exposure would increase or at best stay the same in the coming year.

Meanwhile, less than half (49 percent) rated their security posture, in terms of its effectiveness at mitigating risks, vulnerabilities and attacks, as very effective, with 34 percent blaming their security technologies and 31 percent singling out the complexity of their IT environment.

Cybersecurity insurance market heats up

Almost half (49 percent) of respondents said that following the purchase of cybersecurity insurance their cybersecurity posture had improved greatly or significantly. However, 48 percent said they had changed insurance companies due to policy cancellation (25 percent), cost (21 percent), or finding a company that offered better coverage and pricing (18 percent). 

Sixty-five percent of respondents said they were purchasing premiums of a minimum of $6 million to more than $100 million. The top steps taken to determine adequate coverage were the maximum available from the insurance market (35 percent) and an informal or ad hoc risk of assessments (31 percent). Only 27 percent said they were doing a formal risk assessment by in-house staff and only 25 percent said the insurer or broker conducted a formal assessment.

When asked about the types of incidents most often covered by cybersecurity insurance, respondents said external attacks by cyber criminals, including ransomware (49 percent), malicious or criminal insiders (45 percent) and incidents affecting business partners, vendors or other third parties that have access to their company’s assets (41 percent of respondents).

Determining the value of cybersecurity insurance

Forty-three percent of respondents said their cyber insurance coverage was sufficient with respect to coverage terms and conditions, exclusions, retentions, limits and insurance carrier financial security. Sixty-seven percent of respondents said they were extremely satisfied (23 percent), very satisfied (21 percent) or satisfied (23 percent) with their coverage.

Fifty-three percent of respondents said their organizations had filed a claim following a cybersecurity incident and an average of 46 percent of the losses were covered. When asked how satisfied their organizations were with the insurance company’s response to the claim, less than half (46 percent of respondents) said they were very or highly satisfied with the response.

Insurers are requiring organizations to have certain policies and technologies in place

Fifty percent of respondents said it was difficult or very difficult to comply with insurer’s requirements. More than half (51 percent) of respondents said their insurance company requires regular scanning for vulnerabilities that need to be patched. Forty-three percent of respondents said they are required to scan more than once per day (13 percent), daily (17 percent) or between two and three times per week (13 percent).

Notably, 55 percent of respondents said they were required to have certain security practices and technologies in place. Adequate staff to support cybersecurity programs and policies (49 percent) and multi-factor authentication (48 percent) were the top practices and tech required.

“The goal of this study is to help IT and security leaders assess their cyber insurance needs as well as the limitations and value of these policies,” said Will Teevan, CEO of Recast Software. “We know from talking to our customers that they are more concerned than ever about the scale and cost of cyber attacks. We think this research will guide their decision-making in terms of adding or expanding insurance coverage to account for these challenges.”

“The cost of a single data breach, ransomware attack or other security incident can adversely impact the most solid financial balance sheet,” said Dr. Larry Ponemon, chairman and founder of Ponemon Institute. “The growing threat from sophisticated cybercriminals targeting organizations of all sizes has elevated cybersecurity insurance from an IT security concern to a critical business priority, demanding the attention of senior leadership and boards of directors.” 

The complete State of Cybersecurity Insurance Adoption report can be found here.

About Recast Software

Recast Software exists to simplify the work of IT teams and enable them to create highly secure and compliant environments. Our software does this by seamlessly integrating with existing IT infrastructure to enable quick visualization of endpoints in any environment and remove the manual process of third-party application management. We do all of this while ensuring you get the most out of your endpoint management platform investments. Recast Software is trusted by tens of thousands of organizations, impacting over 60 million devices (and people) worldwide. More information at www.recastsoftware.com. 

###

Contact:

Kevin Wolf

kevin@tgprllc.com