As cyber threats like ransomware and data breaches escalate, the cyber insurance market is trending toward greater discipline. While premiums are stabilizing for businesses with robust cybersecurity controls, experts say higher-risk organizations continue to face higher costs and stricter coverage terms.
David Colter/ Contributed
David Colter, owner of DJ Colter Agency Inc. in North Dakota, part of American Family Insurance, says coverage has become more carefully structured. Greater scrutiny is given to areas such as ransomware, social engineering, business interruption and vendor-related risk, often through sublimits or more specific policy language, he said.
“On the underwriting side, insurers now expect businesses to have stronger baseline controls in place — things like multi-factor authentication, endpoint protection, patch management, employee training, secure backups and incident response planning,” he said. “Overall, cyber insurance today is much less about simply buying a policy and much more about proving an organization has the right risk management discipline in place.”According to Verizon’s
2026 Data Breach Investigations Report
, “exploitation of vulnerabilities is the most common initial access vector for breaches.” Ransomware grew to 48% of all breaches, up from 44% the previous year. The median amount of ransom paid was $139,875, down from $150,000 the previous year, the report says.The federal government’s
Cybersecurity & Infrastructure Security Agency (CISA)
, recommends four practices that all businesses and government organizations that own, operate or support critical infrastructure should be taking: teach employees to avoid phishing scams, require strong passwords, require multifactor authentication and update software.Jamie Burnett, regional vice president, cyber and tech E&O for the Upper Midwest at Marsh McLennan Agency, said from 2020 to mid-2022, there was uncertainty and volatility in the cyber insurance space, which created a capacity-constrained market.
Jamie Burnett/ Contributed
“During this period, premiums increased dramatically while coverage was restricted,” he said. “Since then, the cyber market has shifted to a buyer-friendly ‘soft-market,’ in large part driven by plenty of capacity due to new entrants in the market.”The most common incidents businesses nationwide are centered around phishing, business email compromise and social engineering-type losses. Other incidents include data breaches involving customer or employee information and network security failures that interrupt operations.“They’re also increasingly focused on coverage for cyber extortion, social engineering and fraudulent funds transfer; incident response costs such as legal counsel, forensic investigation, notification, and credit monitoring, as well as business interruption and contingent business interruption tied to vendor or cloud service outages,” Colter said.
Organizations are looking for protection not only for direct attacks on their own systems, but for the financial and operational fallout that comes from third-party relationships, privacy obligations and the growing sophistication of cybercrime.“The cyber landscape is changing quickly, and with that, policy language is constantly evolving to fit the current needs of insureds. What was once a product designed primarily to respond to data breaches and ransomware has now morphed into a broader financial and operational resilience instrument,” Burnett said. “Insurers are no longer performing a simple ‘check the box’ exercise when it comes to underwriting. They are taking a more holistic approach to ensure that cyber-security governance and hygiene are core components of the businesses broader risk management strategy.”Insurers increasingly require organizations to demonstrate strong cybersecurity baseline controls — such as multi-factor authentication, endpoint detection, prompt patching, email security and tested backups — before offering coverage or favorable rates, Colter explained. Key priorities include privileged access management, employee phishing training, remote access protection and third-party risk oversight. Ultimately, insurers expect cybersecurity to be managed as an ongoing operational discipline backed by clear governance, preparedness and a tested incident response plan.Many businesses mistakenly view cyber insurance as a catch-all policy, but coverage varies based on specific terms, sub-limits and exclusions, the experts say. Cyber insurance does not automatically cover all ransomware payments, wire fraud, outages or regulatory fines without explicit conditions or separate limits.“Policy language is not standardized across different carriers, so it’s important to note that two policies will not read the same,” Burnett warns. “Another misconception is thinking that because your policy has a $5 million aggregate limit, that all coverages offered within the policy carry the $5 million limit. It is common to see sublimits for certain coverages such as social engineering, financial fraud and dependent business interruption type losses. If and when a cyber event occurs, insurers often have pre-negotiated panel vendors, inclusive of breach counsel, forensic firms, notification vendors, etc. It’s important that there’s open communication and cooperation between the insured and insurer when engaging outside third parties, and to avoid making any unilateral decisions when hiring vendors.”For a small or mid-size business that’s considering cyber insurance for the first time, its leadership should evaluate several factors when determining how much coverage is needed, including evaluating the organization’s overall cyber exposure. Burnett says when it comes to coverage limit adequacy, finding the right amount is more of an art than a science.“A prospective buyer should be evaluating multiple data points at once, including but not limited to their own balance sheet tolerance, peer benchmarking, contractual requirements or obligations and third-party vendor risk,” he said.
“Leadership should also assess how quickly the business would need to recover from an outage, what incident response costs could look like, and whether third-party vendors create contingent business interruption or privacy risks,” Colter added. “Just as importantly, they should review policy structure — not only the overall limit, but also retentions, sublimits, exclusions, waiting periods and whether the policy meaningfully addresses the business’s most likely loss scenarios. In short, the right amount of coverage should reflect the company’s operational dependence on technology, data exposure, financial resilience and risk tolerance.”
window.fbAsyncInit = function() {
FB.init({
appId : ‘343492237148533’,
xfbml : true,
version : ‘v2.9’
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
——————————————————-
Click Here For The Original Source.
