Impact of cyber insurance coverage on ransomware outcomes - By Sridhar Khambhampati

The goal of insurance is to reduce the impact of perils on an organization. With this in mind, the findings from the Sophos State of Ransomware 2024 study were analyzed to identify whether there is any correlation between insurance position and outcomes, focusing on five core milestones of the victim journey:

• Propensity to be hit by ransomware

• Propensity to have data encrypted

• Ransom payment amount

• Propensity to pay the ransom to recover encrypted data

• Overall recovery costs (excluding the ransom payment)

One important caveat to preface this analysis is that we do not know whether the victim’s current insurance policy was purchased before or after their ransomware attack, i.e. if the purchase decision was influenced by their prior ransomware experience or whether it was already in place. However, with cyber insurance adoption by State of Ransomware participants remaining stable over the last two years (90% in the 2024 study, 91% in the 2023 study) the analysis provides a reasonable indicative starting point to facilitate further research in this area.

Propensity to be hit by ransomware

The data shows very little difference in the ransomware attack rate based on cyber insurance adoption, with all three groups reporting very similar propensity to have been hit in the last year:

• 62% with a standalone policy were hit by ransomware in the last year (n=2,523)

• 57% with cyber as part of a wider policy were hit by ransomware in the last year (n=1,975)

• 58% without a cyber policy were hit by ransomware in the last year (n=489)

Ransom payment amount

Organizations with cyber policies report lower average ransom payment amounts than those without coverage. The median payment by those without cyber coverage came in at $3.41 million, considerably above the $2 million for those with a standalone policy and $1.53 million for those with cyber as part of a wider business policy.