• A survey by Sophos reveals how well companies improved their cyber insurance by improving their defences.
• As many as 74 percent of respondents improved their coverage simply by improving their defences.
• The survey reveals that the majority of local respondents have cyber insurance.

Unlike traditional insurance which has evolved to the point where one can get coverage online in a matter of clicks in some instances, cyber insurance is still a complex sector that requires careful consideration on the side of insurers.

This is because cybercrime is so pervasive and the risks so diverse that insurance needs to be tailored to a specific company. This will also include consideration of how well guarded a particular company is, as taking on unnecessary risk is misguided.

The good news is that according to survey results from Sophos, local companies are increasingly becoming aware of how their cybersecurity affects their cyber insurance, especially as the coverage becomes more of a requirement than an “nice to have”.

This is largely down to the cost of a data breach. In 2023, IBM Security reported that on average, a data breach costs a local company R49.45 million. If the breach was made possible because of lax security, then fines could add to that figure, land executives in jail or both.

“Cyber insurance is no longer just an optional extra; it’s a critical component of comprehensive risk management strategies, providing a financial safety net and helping to mitigate the impacts of cyber incidents,” said Pieter Nel, Regional head for SADC at Sophos.

“Our findings show a strong correlation between the quality of organisations’ cyber defences and their ability to secure favourable insurance terms. A significant 98% of respondents improved their cyber defences to better their insurance positions, with 74% achieving coverage they wouldn’t have otherwise obtained,” he adds.

The plate is hot, don’t touch it

For its survey, Sophos engaged with 311 IT and cybersecurity professionals from across South Africa. Importantly, the cybersecurity firm surveyed respondents where their organisation had some form of cyber insurance coverage already. The survey was conducted between January and February of this year.

The figure that jumps out at us is that 53 percent of respondents picked up cyber insurance due to their understanding of the impacts a breach or another form of attack would have on the business. Concerningly, 45 percent only obtained coverage after an attack had been experienced. This is the equivalent of touching a hot plate and burning yourself to make sure the restaurant staff aren’t lying to you. For years businesses have been warned that it’s not a matter of if you will fall prey to cybercrime, but when.

The good news is that at least the majority of respondents have cybersecurity-related insurance.

In even better news, Sophos reports that 68 percent of respondents obtained more cost-effective coverage after enhancing their defences. Furthermore, 45 percent achieved better policy terms, such as improved coverage limits and conditions.

“The evolution of the cyber insurance market and the growing sophistication of cyber threats necessitate a robust and proactive approach. Organisations must view cyber insurance as a part of a broader cyber resilience strategy, not only for financial protection but as an incentive to maintain and improve cyber defenses,” says Nel.

This survey highlights that not only is cyber insurance becoming more common among local businesses, decision makers are acutely aware of the threats they face. Long may this awareness last.

[Image – Mohamed Hassan from Pixabay]