MALVERN, Pa., April 02, 2026–(BUSINESS WIRE)–The Insurance Information Institute (Triple-I), in partnership with Fenix24, today published Cybersecurity for Insurers: Squaring Safety with Service, a report examining how insurance companies are managing their own cybersecurity risks and where critical vulnerabilities remain.
The report found that while property/casualty insurers have made impactful cybersecurity investments, gaps remain in areas including patching cadence, authentication practices, and recovery testing, which are all weaknesses that could complicate responses to today’s threat environment. The report draws on a series of conversations with insurance industry executives, with questions aligned to best practices, regulatory requirements and security controls commonly required in cyber insurance underwriting.
“Insurers occupy a paradoxical position in the cybersecurity landscape,” said Sean Kevelighan, CEO, Triple-I. “They assess cyber risk for policyholders and establish security requirements as conditions of coverage, yet they also need to demonstrate their own cybersecurity practices meet or exceed evolving standards.”
“Most organizations have tested their recovery plans for natural disasters or standard IT outages, but not for ransomware attacks,” said Mark Grazman, CEO of Fenix24. “Understanding what actually happens in a ransomware scenario is critical to architecting true resiliency. It’s not just backups at risk, attackers systematically target and destroy infrastructure including Active Directory, identity systems, virtual machines, hypervisors, and even core communications like email. Resiliency planning requires understanding backup survivability, architecture for rehydration, and integrity, along with comprehensive asset intelligence, prioritization of business-critical applications and their associated dependencies. Resiliency is achievable if you know what to architect and that is the power of Fenix24’s insights.”
A Growing Market Facing Evolving Threats
The cyber insurance market reached $15.3 billion in net premiums written in 2024 and is projected to grow to $16.3 billion in 2025, according to Munich Re. While ransomware remains a major driver of insured cyber losses, it accounted for only 19% of cyber claims in 2023. Business email compromise and funds transfer fraud represented a far larger share, generating 56% of reported claims. Business interruption accounts for roughly half of the $1 million average cost associated with ransomware incidents, according to NetDiligence.
