Sophos’ MDR Dramatically Cuts Insurance Payouts

Sophos has unveiled the results of a new independent study to quantify the financial impact of various cyber security controls on cyber insurance claims. The study reveals the different impact that endpoint solutions, EDR/XDR technologies and MDR services have on claims resulting from an attack, providing valuable insights for insurers and organizations.

‘Every year, organizations spend huge amounts of money on their cybersecurity. By quantifying the impact of controls on the outcome of cyberattacks, this study enables them to focus their investments on the most cost-effective options. At the same time, insurers have a major influence on cybersecurity spending through the controls they require of organizations wishing to be covered and the discounts they offer when a given scheme is in place. This study enables them to encourage investments that can make a real difference to incident outcomes and the resulting claim amounts.’ Says Bruno Durand, Vice President of Sales for Southern Europe at Sophos.

The study reveals that the average [median] amount of compensation claimed by organizations using MDR services is 97.5% lower than that of organizations using endpoint solutions. The median claim for MDR service users is just $75,000, compared with $3 million for organizations using endpoint security alone. In other words, when they are the victims of an attack, endpoint-only users generally claim 40 times more than MDR service users. The lower claims of MDR customers are likely due to the ability of MDR services to quickly detect and block malicious activity, and repel attackers before they can cause serious damage.

There is also an advantage to using an EDR or XDR tool alongside an endpoint solution. The average claim for users of EDR/XDR tools is only one-sixth of that for users of endpoint solutions [$500,000 versus $3 million].

MDR Users Have the Most Predictable Claims

The predictability of claims is a key indicator of the consistency and reliability of cybersecurity controls in reducing the impact of cyberattacks. The study reveals that claims from users of MDR services are the most predictable, while those from users of EDR/XDR tools are the least predictable.

These results reflect the consistency and speed with which MDR providers detect and neutralize threats. By providing 24/7 monitoring, investigation, and response by security experts, MDR services enable organizations to act quickly at any time of the day or night.

In contrast, the unpredictability of claims from users of EDR/XDR tools demonstrates that the ability of these technologies to effectively stop cyberattacks before major damage is done depends entirely on the skills and responsiveness of users.

MDR Users Have the Most Predictable Recovery Time After a Ransomware Incident

Recovery times vary depending on the solution used by organizations: users of endpoint solutions are positioned ‘in the middle of the table’, with an expected recovery time of 40 days. Users of EDR/XDR tools are the slowest to recover, with an expected recovery time of 55 days.

MDR service users are the fastest to recover from a ransomware incident, with an expected recovery time of just three days. These results demonstrate the ability of an MDR service to significantly reduce the impact of cyberattacks on organizations. They also reveal the highly unpredictable recovery times experienced by users of EDR/XDR tools. Nevertheless, it’s important to remember that EDR/XDR solutions are tools and, as such, their effectiveness and impact depend on how they are used.

‘The research confirms what many people instinctively know: the type of security solution used has a significant impact on cyber insurance claims. Cyberattacks are inevitable, but defenses are not. These results are a useful tool for organizations wishing to optimize their cyber defense and their return on investment in cybersecurity. They will also be useful for insurers looking to reduce their exposure and offer suitable policies to their customers.’ Concludes Sally Adam, Senior Director, of Solution Marketing at Sophos.

Read Also: Infopercept Launches Real MDR Solution For Instant Detection