Cyber insurance was once the quiet line item in a company’s risk budget, bought cheaply and rarely discussed. It is quiet no longer. As ransomware attacks and data-theft extortion have kept claims climbing, insurers have raised premiums, cut limits and started interrogating applicants about their security controls with an enthusiasm once reserved for fire risks in timber warehouses.
The hardening market is reshaping behaviour well beyond the insurance office, as we noted on our home page. Companies that cannot evidence basic protections — multi-factor authentication, tested backups, prompt patching — increasingly find cover expensive, restricted or unavailable, whatever their willingness to pay.
Why insurers turned strict
The mathematics changed when attacks industrialised. Ransomware groups professionalised, initial access became a traded commodity, and a single compromised supplier could trigger claims across hundreds of policyholders at once. Insurers discovered their portfolios were correlated in ways their models had not priced: one bad week could mean claims from an entire sector simultaneously.
Loss data published through industry channels and summarised by Reuters show the response: higher deductibles, sub-limits for ransomware events, and exclusions for war-like state attacks that have been tested in court. The market is not collapsing; it is repricing a risk it admits it misunderstood, and transferring more of it back to the companies best placed to reduce it.
Security as an underwriting question
The most consequential change is underwriting discipline. Applications that once asked a handful of yes-or-no questions now trigger scans of a company’s internet-facing systems, reviews of privileged access and, for larger risks, calls with security staff. Brokers report that the questionnaire has become a de facto security standard for mid-sized firms that never had one, a theme running through our world news coverage of the issue.
That creates a virtuous pressure, but also a fairness problem. Small firms with thin IT resources can be priced out of cover for weaknesses they cannot afford to fix quickly, even though they face the same attackers. Some insurers now bundle incident-response services and security tooling with policies, betting that helping customers harden is cheaper than paying their claims.
The limits of insurance as an answer
Insurance can spread financial pain; it cannot restore a reputation, un-leak stolen data or resurrect a business whose customers leave during a month of downtime. Regulators in several jurisdictions are warning boards against treating a policy as a substitute for resilience, and some are restricting ransom payments themselves, arguing that reimbursement fuels the criminal economy insurers are trying to price.
The debate is unresolved, but the direction of travel is clear. Cover will keep being written, at prices reflecting genuine risk, for organisations that can demonstrate they take that risk seriously. The International Monetary Fund has flagged cyber incidents as a financial-stability concern, which suggests the scrutiny now applied to individual firms will increasingly be applied to the system as a whole.
Incident response is where the new discipline is felt first. Policies increasingly require policyholders to use the insurer’s approved response firms, whose phone numbers now sit in boardroom drawers like those of corporate lawyers. The arrangement favours speed and cost control for the insurer, and guaranteed expertise for the client, though companies with their own trusted advisers sometimes chafe at being told who may help them in their worst week.
In a strange way, the hard market is doing what years of awareness campaigns could not: making basic cyber hygiene a board-level financial question. Companies may resent the premiums, but many will emerge with better backups, tighter access controls and a clearer sense of their own exposure — which was rather the point of insurance all along.
