Cybersecurity firm offers users reimbursement for ransomware infections

Security firm SentinelOne is confident it can beat any of today’s ransomware — and is willing to put money behind that claim.

The company is offering a new service that will cover up to US$1 million in damages for any customers infected by ransomware.

SentinelOne is calling it the “Cyber Threat Guarantee” and treating it like an extended warranty that customers can buy starting Tuesday.

However, the company is convinced it won’t have to make any pay outs, said Jeremiah Grossman, its chief of security strategy. SentinelOne’s failure rate in stopping ransomware attacks is “way less than 1 percent,” he said in an interview.

During the times its security did fail, the client’s computer hadn’t been running the latest version of SentinelOne’s software, he added.

Grossman hopes the guarantee will bring some accountability to the cybersecurity industry, and let customers “navigate around outlandish marketing claims.”

“When security vendors sell products they are not giving a guarantee, which is completely different from any other space, whether it be electronics or cars,” he added.

[ ALSO ON CSO:The history of ransomware ]

SentinelOne’s guarantee works like this: for individual computers infected with ransomware, the company will pay up to $1,000 to free the system. The number of computers it will cover is up to 1,000 systems.

The policy has been designed this way because most ransomware attackers ask for around $250 or more to decrypt any data held hostage, Grossman said.

Customers who opt-in to the guarantee will pay an additional $5 fee for each Windows PC or server protected on top of their existing service. The coverage will last a year before it can be renewed again.

Grossman joined SentinelOne last month after designing a similar guarantee program for his previous company, Whitehat Security. Under that program, WhiteHat would refund customers if their websites ever got hacked with a vulnerability that the company failed to detect.

In today’s market, clients can also buy cyber insurance to cover any damages they face from hacking attacks. But Grossman said it’s time for security vendors to also offer better product assurance, especially when customers are spending millions each year to protect their IT systems.

The offer from SentinelOne might be unique. Jane Wright, a security analyst with Technology Business Research, said she wasn’t aware of other vendors offering this kind of reimbursement.

“SentinelOne’s offering could set a new standard that changes customers’ expectations of the efficacy of ransomware protection,” she added. As a result, other companies could end up following suit.

Whether that guarantee makes SentinelOne a target of hackers remains to be seen. Grossman said he doesn’t think that will happen. Hackers don’t typically pick their victims based on who insures them, he added.

Instead, he hopes that the company’s guarantee will help customers discern between legitimate security firms and “snake oil vendors” offering shoddy products.

“I’m ready for all the other vendors to guarantee what they do,” he said. “I think that’s far superior than us competing for customers with billboard presentations.”