Security solutions provider Sophos has unveiled the results of a study to quantify the financial impact of various cyber security controls on cyber insurance claims. The study reveals the different impact that endpoint solutions, Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR) technologies and Managed Detection and Response (MDR) services have on claims resulting from an attack.

Amongst the finding is that the average (median) amount of compensation claimed by organisations using MDR services is 97.5% lower than that of organisations using endpoint solutions. The median claim for MDR services users is just $75 000, compared with $3 million for organisations using endpoint security alone. In other words, when they are the victims of an attack, endpoint-only users’ generally claim 40 times more than MDR service users. Sophos believes the lower claims of MDR customers are likely due to the ability of MDR services to quickly detect and block malicious activity, repelling attackers before they can cause serious damage.

The company also mentions there is an advantage to using an EDR or XDR tool alongside an endpoint solution. The average claim for users of EDR/XDR tools is only one-sixth of that for users of endpoint solutions ($500 000 versus $3 million).

The study reveals that claims from users of MDR services are the most predictable, while those from users of EDR/XDR tools are the least predictable. The predictability of claims is a key indicator of the consistency and reliability of cybersecurity controls in reducing the impact of cyberattacks.

Sophos notes these results reflect the consistency and speed with which MDR providers detect and neutralise threats. By providing 24/7 monitoring, investigation and response by security experts, MDR services enable organisations to act quickly at any time of the day or night.

In contrast, the unpredictability of claims from users of EDR/XDR tools demonstrates that the ability of these technologies to effectively stop cyberattacks before major damage is done depends entirely on the skills and responsiveness of users.

MDR users have the most predictable recovery time after a ransomware incident

Recovery times from a cyberattack vary depending on the solution used by organisations. Users of endpoint solutions are positioned ‘in the middle of the table’, with an expected recovery time of 40 days. Users of EDR/XDR tools are the slowest to recover, with an expected recovery time of 55 days.

On the lower end of the spectrum, MDR service users are the fastest to recover from a ransomware incident, with an expected recovery time of just three days. These results demonstrate the ability of an MDR service to significantly reduce the impact of cyberattacks on organisations. They also reveal the highly unpredictable recovery times experienced by users of EDR/XDR tools. Nevertheless, Sophos believes it's important to remember that EDR/XDR solutions are tools and, as such, their effectiveness and impact depend on how they are used.

The survey was conducted by Vanson Bourne on behalf of Sophos during the second half of 2024. It looked at claims resulting from cyberattacks that had occurred in the previous 12 months.

Specifically, the study was conducted on 282 claims reported by 232 organisations with between 50 and 3,000 employees. Respondents used cybersecurity solutions from a wide range of vendors, including 19 endpoint protection vendors and 14 MDR vendors. All organisations were using Multi-Factor Authentication (MFA) at the time of the cyber-attacks that led to the claims.

Bruno Durand, VP of Sales for Southern Europe at Sophos, said: “Every year, organisations spend huge amounts of money on their cybersecurity. By quantifying the impact of controls on the outcome of cyberattacks, this study enables them to focus their investments on the most cost-effective options. At the same time, insurers have a major influence on cybersecurity spending through the controls they require of organisations wishing to be covered and the discounts they offer when a given scheme is in place. This study enables them to encourage investments that can make a real difference to incident outcomes and the resulting claim amounts.”