Sophos, a leading global provider of innovative security solutions designed to neutralise cyberattacks, has unveiled the results of a new independent study to quantify the financial impact of various cyber security controls on cyber insurance claims. The study reveals the different impact that endpoint solutions, EDR/XDR technologies and MDR services have on claims resulting from an attack, providing valuable insights for insurers and organisations.
Bruno Durand, Vice President of Sales for Southern Europe at Sophos, said: ‘Every year, organisations spend huge amounts of money on their cybersecurity. By quantifying the impact of controls on the outcome of cyberattacks, this study enables them to focus their investments on the most cost-effective options. At the same time, insurers have a major influence on cybersecurity spending through the controls they require of organisations wishing to be covered and the discounts they offer when a given scheme is in place. This study enables them to encourage investments that can make a real difference to incident outcomes and the resulting claim amounts.’
The study reveals that the average (median) amount of compensation claimed by organisations using MDR services is 97.5% lower than that of organisations using endpoint solutions. The median claim for MDR services users is just $75,000, compared with $3 million for organizations using endpoint security alone. In other words, when they are the victims of an attack, endpoint-only users’ generally claim 40 times more than MDR service users. The lower claims of MDR customers are likely due to the ability of MDR services to quickly detect and block malicious activity, and repel attackers before they can cause serious damage.
There is also an advantage to using an EDR or XDR tool alongside an endpoint solution. The average claim for users of EDR/XDR tools is only one-sixth of that for users of endpoint solutions ($500,000 versus $3 million).
MDR users have the most predictable claims
The predictability of claims is a key indicator of the consistency and reliability of cybersecurity controls in reducing the impact of cyberattacks. The study reveals that claims from users of MDR services are the most predictable, while those from users of EDR/XDR tools are the least predictable.
These results reflect the consistency and speed with which MDR providers detect and neutralise threats. By providing 24/7 monitoring, investigation and response by security experts, MDR services enable organisations to act quickly at any time of the day or night.
In contrast, the unpredictability of claims from users of EDR/XDR tools demonstrates that the ability of these technologies to effectively stop cyberattacks before major damage is done depends entirely on the skills and responsiveness of users.
MDR users have the most predictable recovery time after a ransomware incident
Recovery times vary depending on the solution used by organisations: users of endpoint solutions are positioned ‘in the middle of the table’, with an expected recovery time of 40 days. Users of EDR/XDR tools are the slowest to recover, with an expected recovery time of 55 days.
MDR service users are the fastest to recover from a ransomware incident, with an expected recovery time of just three days. These results demonstrate the ability of an MDR service to significantly reduce the impact of cyberattacks on organisations. They also reveal the highly unpredictable recovery times experienced by users of EDR/XDR tools. Nevertheless, it’s important to remember that EDR/XDR solutions are tools and, as such, their effectiveness and impact depend on how they are used.
Sally Adam, Senior Director, Solution Marketing at Sophos, concludes: ‘The research confirms what many people instinctively know: the type of security solution used has a significant impact on cyber insurance claims. Cyberattacks are inevitable, but defences are not. These results are a useful tool for organisations wishing to optimise their cyber defence and their return on investment in cybersecurity. They will also be useful for insurers looking to reduce their exposure and offer suitable policies to their customers.’
About the survey
The survey was conducted by Vanson Bourne on behalf of Sophos during the second half of 2024. It looked at claims resulting from cyberattacks that had occurred in the previous 12 months.
Specifically, the study was conducted on 282 claims reported by 232 organisations with between 50 and 3,000 employees. Respondents used cybersecurity solutions from a wide range of vendors, including 19 endpoint protection vendors and 14 MDR vendors. All organisations were using Multi-Factor Authentication (MFA) at the time of the cyber-attacks that led to the claims.
All results were subject to rigorous and robust statistical validation using multivariate regression models.
