The State of Cyber Insurance in 2026
The cyber insurance market has undergone a significant maturation since the ransomware spike of 2020–2022. Premiums have moderated from the 40–100% annual increases of that period, but underwriting has become substantially more rigorous. Insurers are no longer offering broad coverage to organizations with weak security controls, and exclusions in policy language have expanded.
The result: cyber insurance is simultaneously more important (cyber incidents remain the top business risk by frequency and cost) and more conditional (you need adequate security controls to get the coverage you actually need). Understanding exactly what your policy covers — and doesn’t — is a prerequisite for treating it as genuine risk transfer.
Core Coverage Categories
First-Party Coverage (Your Own Losses)
- Incident Response Costs: Forensic investigation, legal counsel, crisis communications, IT recovery specialists. This is typically the first coverage deployed after an incident — your insurer dispatches an approved IR firm.
- Business Interruption: Revenue loss due to system downtime caused by a covered cyber event. Policy language varies significantly: some require a waiting period (12–48 hours of downtime before coverage triggers), some cap recovery at a defined period.
- Ransomware and Extortion: Ransom payment costs (where legally permissible), negotiation fees, and recovery costs. Note: paying ransomware to sanctioned entities creates regulatory exposure insurers won’t cover.
- Data Recovery: Costs to restore or recreate data lost or corrupted in a cyber event.
- Social Engineering/Fraud: Funds transferred based on fraudulent instructions (BEC). Often sublimited or requires endorsement — review carefully.
Third-Party Coverage (Your Liability to Others)
- Network Security Liability: Third-party claims arising from security failures — breach of customer data, transmission of malware, unauthorized access
- Privacy Liability: Regulatory investigations, fines, defense costs, and settlements related to data privacy violations (GDPR, CCPA, HIPAA)
- Media Liability: Defamation, copyright, and IP infringement claims arising from your digital content
- Errors & Omissions (Tech E&O): For technology companies — claims from clients alleging your software or service failure caused losses
What Most Policies DON’T Cover
Standard Exclusions
| Exclusion | What It Means | Risk Management Alternative |
|---|---|---|
| War and state-sponsored attacks | Nation-state cyber operations often excluded; definition is contested (Merck vs. Lloyd’s landmark case) | Clarify policy definition; request explicit override endorsement |
| Unencrypted data | Breaches of unencrypted sensitive data may be partially or fully excluded | Implement encryption at rest; document compliance |
| Known vulnerabilities | Incidents exploiting vulnerabilities for which patches were available and not applied | Formal patch management program with SLAs |
| Fraudulent transfer (base policy) | BEC fund transfers often excluded from base coverage | Request social engineering endorsement; implement verification controls |
| Insider threats (intentional acts) | Deliberate employee sabotage typically excluded; negligence usually covered | Insider threat program; user activity monitoring |
| Critical infrastructure | Some policies exclude industrial control systems/OT environments | Explicit OT/ICS coverage endorsement |
| Regulatory fines (some jurisdictions) | Insurability of regulatory fines varies by jurisdiction | Confirm regulatory fine coverage in policy; some are not insurable by law |
What Underwriters Actually Require in 2026
Underwriting questionnaires have expanded significantly. These are the controls with highest underwriting weight:
- Multi-Factor Authentication: Specifically FIDO2/passkeys for admin accounts; standard MFA for all users. Many insurers now exclude incidents involving compromised accounts without MFA.
- Endpoint Detection and Response (EDR): Required by most insurers. Specify which solution and coverage percentage (most require 95%+ of endpoints).
- Privileged Access Management (PAM): Credential vaulting, session recording, and just-in-time access for admin accounts.
- Immutable, tested backups: Offline or immutable backup copies with documented and tested restoration procedures. Annual restoration test minimum.
- Patch management program: Formal process with SLAs for critical patches. Insurers look for sub-30-day critical patch deployment.
- Email security: Advanced email filtering, anti-phishing controls, and DMARC/DKIM/SPF configuration.
- Incident response plan: Documented, tested IR plan with defined roles, communication protocols, and third-party IR retainer.
Coverage Limits and Sublimits
The aggregate policy limit is not the relevant number — sublimits on specific coverage types determine your actual protection:
- Ransomware payments: often sublimited (e.g., $1M sublimit on a $5M policy)
- Business interruption: often has waiting period and/or time limit
- Social engineering: frequently sublimited to $250K–$500K
- Regulatory fines: jurisdiction and sublimit specific
- System failure (non-malicious): often lower sublimit than malicious attack
Review sublimits against your specific risk profile: a ransomware-vulnerable organization needs adequate ransomware sublimits, not just aggregate coverage.
Claim Process Realities
- Notify quickly: Most policies require notification within 24–72 hours of a covered incident. Late notification is a basis for claim denial.
- Use panel vendors: Insurers have pre-approved IR firms, legal counsel, and forensic vendors. Using non-panel vendors without prior insurer approval often results in non-reimbursement.
- Document everything: Preserve all logs, communications, and timelines from incident inception. Claims are often partially denied for inadequate documentation.
- Report to regulators appropriately: Regulatory notification obligations (GDPR’s 72-hour rule, state breach notification) create coordination complexity with insurance notification obligations.
Right-Sizing Your Coverage
Coverage limit guidance by organization size:
- SMB (<$50M revenue): $1M–$5M, confirm BEC/social engineering and ransomware sublimits
- Mid-market ($50M–$500M): $5M–$25M, consider excess/umbrella layer, scrutinize BI sublimits
- Enterprise ($500M+): $25M+, tower structure with multiple insurers common, war exclusion negotiation critical
Conclusion
Cyber insurance in 2026 is a viable risk transfer mechanism only when paired with the security controls underwriters require and when policy language is reviewed for exclusions that could invalidate coverage during an actual incident. Buy the policy and address the controls — they reinforce each other. An organization that implements MFA, EDR, PAM, and immutable backups not only gets better coverage at lower premiums but also dramatically reduces the probability of triggering a claim in the first place. The security investment and the insurance investment are complements, not alternatives.
API Security in 2026: Protecting the Interface Layer That Runs Modern Business
APIs have become the backbone of modern business. Every mobile app, cloud service, third-party integration,…
Read More →
Incident Response Planning: The Playbook Every Business Needs Before an Attack
The question is no longer whether your organization will face a cyberattack. It’s whether you’ll…
Read More →-
By Guy Sheetrit
- Jul 9, 2026
By Guy Sheetrit
