In an interesting twist, new data hints that organizations with cyber insurance may be relying on it too much, instead of shoring up security to ensure attacks never succeed.

Cyber insurance should be seen as an absolute last resort and shouldn’t be seen as a sure thing (in terms of a claim payout). But according to Barracuda’s 2023 Ransomware Insights report, this may not be the attitude organizations are taking, using the rate of successful ransomware attack as the measure:

• 73% of organizations reported at least one successful ransomware attack in the past 12 months
• 77% of organizations with cyber insurance were hit by at least one successful ransomware attack
• 65% of organizations without cyber insurance were hit by at least one successful ransomware attack

This strange data point may indicate that there is too much reliance on a cyber insurance policy; that is, organizations think, “eh, the insurance policy will cover an attack” and proper cybersecurity precautions aren’t put in place.

Regardless of whether cyber insurance is prevalent, according to Barracuda, 27% of organizations say they’re not fully prepared for an attack. This is concerning, as 95% of organizations hit by ransomware said their data was, in fact, encrypted. And, to carry the “not fully prepared” theme a bit farther, as organizations experienced multiple ransomware attacks, the percentage of them that were willing to pay the ransom increased.

Source: Barracuda

In essence, rather than learn from the first attack and shore up cybersecurity efforts, the organizations did little-to-nothing and reaped the consequences in the form of paying a ransom – potentially multiple times.

There is no guarantee that your cyber insurance will actually pay, as the attack specifics need to fit the policy to the letter. It makes more sense to both have a policy and put the necessary precautions in place - that include Security Awareness Training – to lower the risk of successful ransomware attack.