Cyber Insurance Market (2026-2036)

The growth of this market is mainly driven by supervisory direction that obliges insurers to state clearly whether each policy covers or excludes cyber losses and therefore converts unpriced exposure inside general policies into explicitly underwritten premium, by a requirement to price policies on the effectiveness of an insured controls which has made the questionnaire a specification that buyers invest to satisfy, by systemic risk and stress testing obligations that have led carriers to cap aggregation and so to create demand for additional limit across multiple markets, by regulatory defence and notification costs that have become the largest component of a privacy claim, and by the arrival of underwriters that assess risk from external telemetry rather than from a questionnaire alone. Premium in this market reflects what a supervisor requires insurers to affirm or exclude rather than what buyers choose to insure.

However, factors such as capacity discipline under which carriers limit the aggregate exposure they will write to any correlated event and thereby cap premium growth independently of demand, exclusions for state-backed and war-related cyber events that narrow what the product covers and weaken the case for buying it, control requirements at underwriting that exclude organisations unable to evidence multifactor authentication, privileged access management and backup isolation, and a recommendation against ransom payments that limits the indemnity most directly associated with the peril buyers fear are expected to restrain the growth of this market to some extent. Cyber insurance is sold on the condition that the buyer has already reduced the risk, which excludes the segment that would value it most.

Cyber insurance transfers the financial consequences of a cyber event from an organisation to a carrier, through first-party cover for the costs the organisation itself incurs and third-party liability cover for claims made against it, and the market is measured in gross written premium rather than in product value. The supervisory instrument that shaped its present form is New York Insurance Circular Letter No. 2 of 4 February 2021, the Cyber Insurance Risk Framework, which applies to all authorized property and casualty insurers that write cyber insurance and which directs those insurers to adopt a formal cyber insurance risk strategy approved by senior management and the board with clear qualitative and quantitative goals reported to them regularly, to identify cyber exposure in non-cyber policies such as errors and omissions, general liability and theft coverage and over time to state clearly whether each policy covers or excludes cyber losses while reducing existing exposure in the meantime, and to require insurers that do not write cyber insurance at all to assess their exposure to silent risk. Requiring an insurer to say explicitly whether a general liability, errors and omissions or theft policy covers a cyber loss is what moved exposure out of policies that were never priced for it and into policies that are, and that transfer rather than new buying is the largest single source of recorded premium growth in this market.

The same framework sets out how the risk is to be underwritten. Under the same framework directs insurers to evaluate systemic risk by identifying the critical third-party vendors their insureds depend on, modelling catastrophic events such as self-propagating malware and supply chain attacks and running internal stress tests covering both silent and affirmative exposure, to measure insured risk rigorously through a data-driven assessment of each insured cybersecurity programme using questionnaires, interviews, third-party evaluations and past claims data, to educate insureds and producers and to price policies on the effectiveness of an insured controls, to obtain cybersecurity expertise through hiring, training and the use of consultants, and to require cyber policies to oblige a victim to notify law enforcement. Pricing on the effectiveness of an insured controls is the provision with the widest commercial consequence, because it turned the renewal questionnaire into a specification that organisations spend against, and because it made multifactor authentication, privileged access management, endpoint detection coverage and backup isolation conditions of insurability rather than recommendations. The obligation to require a victim to notify law enforcement has altered policy wording across the market, and the systemic risk provisions are why carriers now model correlated events and limit what they will write against them.

Payment of extortion demands sits outside what the market is willing to encourage. Under the same circular letter states that the Department of Financial Services recommends against making ransom payments, on the grounds that such payments fund further attacks, may violate sanctions administered by the Office of Foreign Assets Control and do not guarantee data recovery, and it notes that notifying law enforcement may be a mitigating factor in that sanctions context. The consequence is that the indemnity buyers most closely associate with the peril is the one carriers are discouraged from funding, which shifts the value of a policy toward incident response, forensics, business interruption and data restoration and away from extortion payment. It also aligns the insurance position with the sanctions position, so an organisation cannot treat cover as a route to paying and has to treat it as a route to recovering.

The United Kingdom supervisory position is constructed on the same concern and reaches firms differently. Under Supervisory Statement SS4/17 of the Prudential Regulation Authority on cyber insurance underwriting risk, first published and effective on 5 July 2017 with the current version published on 15 November 2024 and effective from 31 December 2024, which applies to all United Kingdom non-life insurance and reinsurance firms and groups within the scope of Solvency II including Lloyd and its managing agents, and which defines cyber insurance underwriting risk as the prudential risk arising from insurance contracts exposed to cyber-related losses from malicious acts such as cyber attacks and from non-malicious acts such as data loss or accidental acts, covering both tangible and intangible assets, and that statement addresses non-affirmative or silent cyber risk, meaning cyber exposure within policies that do not explicitly address cyber cover, alongside cyber risk strategy and risk appetite and the cyber expertise a firm is expected to hold, and it follows a cross-industry review conducted between October 2015 and June 2016 whose findings were set out in a letter to firms in November 2016. Defining the risk to include non-malicious acts such as data loss and accidental acts, and to cover tangible as well as intangible assets, widens what a firm has to identify well beyond attack scenarios, and the application of the statement to Lloyd and its managing agents is what gives the position market-wide effect in the largest specialty market. The practical result across both jurisdictions is that silent cover has been progressively converted into affirmative cover or removed, and the standalone policy has become the normal form in which cyber risk is transferred.

A period of rapid premium growth with comparatively loose underwriting was followed by sharp loss deterioration driven by extortion and business interruption, which produced large rate increases, reduced limits, higher retentions and the introduction of control requirements as a condition of cover. Rates then softened as loss experience improved and capacity returned, without the control requirements being withdrawn. The market therefore now operates with pre-pandemic style pricing and post-loss underwriting discipline at the same time, which compresses premium per policy while raising the number of organisations able to qualify.

Buying structure differs from most insurance lines because the decision is technical as well as financial. The risk manager or finance function owns the policy, but the answers that determine whether cover is available and at what price are supplied by the security function, and the broker sits between them. A renewal therefore requires an internal exercise in evidencing controls before it requires a market exercise in placing risk, and organisations that cannot produce that evidence are declined regardless of their willingness to pay. This is why broker share is high and durable in this line and why the broker role extends into readiness advice that other lines do not require.

Capacity rather than demand sets the ceiling on premium in this market. A cyber event can affect thousands of insureds simultaneously through a shared cloud service, a widely deployed software product or a common managed provider, which makes the exposure correlated in a way that property and liability catastrophe exposure is not geographically bounded. Carriers obliged to model such events and stress test against them respond by limiting the aggregate they will write, so an organisation seeking a large limit assembles it across several carriers in layers. That structure increases the number of participating markets per placement and is the reason total premium growth has lagged the growth in insured organisations.

Reinsurance determines how much primary capacity exists and is the channel through which systemic concern reaches the direct market. Primary carriers cede a substantial share of cyber premium, and the availability and cost of that cession governs how much they can write and on what terms, so a tightening in reinsurance appears in direct policy wording within a renewal cycle. Insurance-linked securities and catastrophe bonds covering cyber have begun to supplement traditional reinsurance capacity, and the development matters because the constraint in this market is capital allocated against correlated loss rather than appetite among buyers.

Pricing is assembled from exposure, controls and claims rather than from exposure alone. Revenue, industry, data volume and jurisdiction establish the base exposure, the assessment of controls adjusts it in both directions, and prior claims and the sector loss experience complete it. Because the control adjustment is large, two organisations of the same size in the same sector can face materially different premiums, which is precisely the effect the supervisory direction on controls-based pricing intended. The structure also creates a measurable return on security spending that organisations can present internally, and that link is why security programmes are increasingly justified against insurance outcomes.

North America holds the majority of global premium on notification statutes that create a quantifiable first-party cost, on litigation exposure that gives third-party cover real value, on the earliest supervisory intervention and on the deepest broker market. Europe follows on data protection enforcement that converts a breach into a reportable event with a financial consequence and on supervisory expectations addressed to insurers themselves. Asia-Pacific grows fastest from a low base, on notification regimes introduced more recently, on rising large-enterprise take-up in Japan, Australia, Singapore and India and on local carriers entering a line they had previously reinsured away entirely.