2026 Report on the Cybersecurity Insurance Market
Market Analysis and Threat Landscape Narrative
What the latest data says about the U.S. cyber insurance market and why it matters for businesses, policymakers, security leaders, consumers, and state insurance regulators.
The report is intended to provide market intelligence and context. It should not be viewed as a forecast, policy recommendation, or assessment of any individual insurer, policyholder, or cybersecurity program.
Understanding the Cyber Insurance Market
-
Market Growth The U.S. cyber insurance market continued to grow in 2025, with more organizations purchasing coverage and insurers writing nearly $9.5 billion in premium.
-
Claims and Emerging Risks The report finds that claims are increasing, large losses are becoming more expensive, and emerging risks such as artificial intelligence, cloud outages, and third-party vendor dependencies are reshaping the market.
-
Insights for Stakeholders The report provides insights for policymakers, business leaders, security professionals, journalists, and state insurance regulators seeking to better understand trends affecting cyber risk, insurance coverage, and market performance.
Key Findings
-
The market grew, but at a measured pace. The U.S. cyber insurance direct written business (including alien surplus lines) reached approximately $9.46 billion in 2025, up 3.5% from 2024.
-
Demand has increased. Since 2020, domestic direct written business have grown from $2.75 billion to $7.46 billion, a compound annual growth rate of 22%.
-
Coverage became more widespread. Domestic insurers reported 5.84 million policies in force, a 33% increase.
-
Claims continued to climb. Insurers reported 56,323 claims in 2025, 20% more than in 2024.
-
Insurers paid more in claims relative to premiums. The industry-wide loss ratio rose to 53 from 48.7 while cyber insurance prices continued to decline.
-
Most cyber losses remain uninsured. Only about 1% of global economic cyber losses are covered by insurance, and many small and medium-sized businesses remain without coverage.
Why It Matters
Cyber insurance is growing in importance as businesses and the public rely more heavily on interconnected digital systems. Still, many businesses do not have coverage. The market remains sizable and supported by significant insurer and reinsurance capacity, but the risk is changing quickly.
More expensive large losses, lower prices, and the chance that one cloud outage, software flaw, or vendor incident could affect many organizations at once make sound cybersecurity, understandable coverage, informed business decisions, and effective public policy increasingly important. State insurance regulators contribute through oversight of this market through insurer financial condition, market practices, rates, and policy language.
Data-Driven Insights
Explore insights into cyber insurance data. More is available in the full report.
Direct Written Premium Showing Percent Change (Includes Alien Surplus Lines)-
Policies in Force Showing Percent Change
Frequently Asked Questions
Cyber insurance is coverage designed to help an organization respond to certain technology- and data-related losses. Depending on the policy, coverage may include data breach response, business interruption, cyber extortion, network recovery, liability, and other costs. Policies vary, so buyers should review coverage, limits, exclusions, and related crime policies carefully.
U.S. cyber insurance premiums totaled approximately $9.46 billion in 2025. Domestic insurers wrote about $7.46 billion, and non-U.S. insurers eligible to write U.S. surplus lines coverage reported about $2 billion.
State insurance regulators oversee insurance in their states and territories. They monitor insurer financial strength and market practices, review rates and policy language under state law, and protect policyholders. Through the NAIC, regulators share data, expertise, and tools. The NAIC supports this work but is not itself an insurance regulator.
A primary policy is the first layer of dedicated cyber coverage. Excess insurance can provide additional limits after the primary limit is reached. An endorsement adds cyber coverage to another business insurance policy. Endorsements often provide narrower protection or lower limits than a stand-alone cyber policy.
Large organizations can face greater business interruption costs, more complex recovery work, larger amounts of sensitive data, and more litigation after an incident. The report finds that fewer large-account claims occurred in 2025, but the average cost of those claims rose sharply.
AI can help attackers find vulnerabilities, create convincing phishing messages, manipulate documents, and produce deepfakes more quickly. It can also help defenders detect threats and help insurers assess risk. Strong security basics, payment verification, and clear governance remain important as these tools evolve.
Accumulation risk is the possibility that one cyber event triggers losses for many organizations at the same time. For example, a major cloud outage, widely used software vulnerability, or vendor breach could lead to claims across many policyholders and several types of insurance. This is also called systemic or correlated risk.
No. Insurance can help an organization recover financially from certain covered events, but it cannot prevent an attack. Effective cybersecurity requires people, processes, and technology, including employee training, access controls, software updates, backups, vendor management, and a tested response plan.
Businesses should ask which events are covered, which are excluded, how much the policy will pay, whether separate limits apply to specific losses, what security practices are required, how quickly an incident must be reported, and how the cyber policy works with crime, property, liability, and other coverage.
How Should I Read This Report?
Different audiences may find different sections most relevant:
-
Policymakers Policymakers can use the report to better understand market trends, coverage gaps, and emerging risks.
-
Business Leaders Business leaders can use it to assess cyber risk, insurance purchasing decisions, and potential financial exposures.
-
Security Professionals Security professionals can use it to understand the threat trends influencing underwriting, claims, and insurance availability.
-
Journalists and Researchers Journalists and researchers can use it as a source of market data and context on the evolving cyber insurance landscape.
-
State insurance regulators State insurance regulators can use it alongside other supervisory tools and market information to monitor trends affecting insurers and policyholders.