← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

Cyber insurance market: prices, exclusions and insurer demands

Global cyber premiums reach $15bn and rates have fallen for 13 quarters. Data for Brazil and the US, key exclusions and the controls insurers now require.

2026-10-02

Cyber insurance has gone through a full cycle in a few years: soaring premiums, tougher underwriting and now a softer, more competitive market. But insurers want proof that declared controls exist, and exclusions have become sharper.

Market size

Munich Re estimates global cyber premiums at nearly $15 billion in 2025 and projects about $28 billion by 2030, though growth has slowed for three years (Munich Re). It also says most cyber risk remains uninsured, nearly nine in ten executives feel inadequately protected, and ransomware, data breaches, business email compromise and DDoS drive insured losses, mostly at micro and small firms (Munich Re).

Prices

Marsh reported on 21 October 2026 that global cyber rates fell 4% in Q3 2026, the thirteenth straight quarterly decline. US rates were flat after a long run of cuts; the UK, Latin America, the Pacific and Europe saw reductions (Marsh). Across all commercial lines, composite rates fell 5%. For buyers, the soft market is a chance to negotiate broader cover, but it has not loosened the evidence insurers expect at underwriting and at claim time.

Brazil

CNseg data cited by CQCS show Brazilian cyber premiums of about R$134.6 million in January–April 2026 (+71.1%) and claims paid of almost R$30 million (+253.1%). The regulator Susep issued a guidance manual on cybersecurity for supervised insurers.

Metric	Value	Source
Global premiums 2025	~$15bn	Munich Re
2030 projection	~$28bn	Munich Re
Global rate change Q3 2026	-4%	Marsh
US rate change Q3 2026	Flat	Marsh
Brazil premiums Jan–Apr 2026	R$134.6m (+71.1%)	CNseg

What insurers require

A September 2026 alert in the National Law Review lists MFA on remote access, email and privileged accounts (SMS seen as inadequate), EDR on every endpoint, immutable offline backups with tested restores, patch deadlines for critical flaws, privileged access management, evidenced training, tested incident response plans, DMARC/DKIM/SPF and segmentation. High-limit markets increasingly want independent evidence such as scans, penetration tests or SOC 2 reports.

It cites Travelers v. International Control Services (2022), where a US court allowed rescission because the application claimed enterprise-wide MFA for remote and administrative access but investigators found it only on the firewall. Courts may permit denial or rescission even for negligent or good-faith misstatements if they were material to the risk, and carriers attribute many non-payment outcomes to inadequate controls, misrepresentations and late notice.

Key exclusions

Since 31 March 2023, Lloyd's has required stand-alone cyber policies to carry a state-backed cyber-attack exclusion under bulletin Y5381, covering war and attacks that severely impair a state, with a robust attribution method (Kennedys). In the US, OFAC warns that insurers facilitating ransom payments to sanctioned parties face strict liability (OFAC).

Checklist

Answer applications precisely and by system, disclosing exceptions.
Keep dated evidence of MFA, EDR, backups and training.
Read war, state-act and infrastructure definitions.
Check sublimits for extortion, social engineering and business interruption.
Confirm claim-notice deadlines and the insurer's mandatory response-vendor panel.
Use the soft market to negotiate limits and retentions, not just price.