Cyber insurance premiums are dropping, but that’s not the whole story
Cyber insurance premiums are down across the board, 11% on average, based on Lockton’s latest data. That’s meaningful. It means companies are paying less to protect themselves from more cyberattacks. That shouldn’t make sense, but it does, if you understand the full context.
Right now, the market is flooded with players. Insurers have added capacity, broadened their risk appetite, and upgraded their underwriting models. Competition is strong, which forces premiums down. We’re in a buyer’s market where even with more frequent and more complex incidents, pricing continues to drop.
From a strategic point of view, this environment gives CFOs and CIOs solid room to optimize budgets. You’re paying less per dollar of coverage. That difference can be redirected into improving systems or scaling your cloud architecture securely. But make no mistake, more risk, less premium may not be sustainable. Claims haven’t caught up yet. The market hasn’t priced in the exposure that’s likely to surface from cyber breaches in prior years. Those flood in slowly, especially in high-litigation regions like the U.S.
So yes, premiums are down. That’s positive short term. But leadership teams need to remain aware of what could happen when delayed claims emerge over the next 24 to 36 months. Insurance pricing is a feedback loop tied to real-world incidents, not projections.
The market will remain buyer-friendly through 2026, use it
If you’re a first-time buyer, or even just reviewing your cyber policy, the window between now and 2026 gives you control. That’s rare in insurance markets, but right now, across the cyber risk space, that pattern is holding.
Insurers are holding rates low. They’re competing for business by offering broader terms, multiple coverage options, and more flexibility in how policies are structured. The increase in available capacity means more negotiating power is in the hands of the buyer. In risk-based conversations with your insurer, you now have leverage, if you can demonstrate where your risk is under control.
At the same time, coverage has improved. You’re not just getting a good rate, you’re getting more relevant protection. This directly reflects smarter underwriting and better understanding of digital risk. If your company has invested in resilience, network segmentation, strong access controls, a clear incident response plan, then you’re going to be treated as a better risk, and the market reflects that in what it’s offering.
Carlo Ramadoro, Head of Cyber and Technology at Lockton, put it clearly: insurers are offering historically competitive rates across 2025 and 2026, even as incidents grow in scale and severity. That runs opposite to what people might assume, more threat should mean more cost. But because the market is saturated with insurers and underwriters moving fast to capture business, pricing is resilient, for now.
The smart move here is to treat this as an opportunity to revisit limits, adjust deductibles, and modernize policy features. Don’t get comfortable, optimize. The point isn’t just to insure against risk. It’s to structure the policy in a way that material risk is understood, prioritized, and matched to a response framework. That’s executive business continuity thinking. Make use of the margin this market is giving you, it won’t last forever.
Claims are catching up, expect pressure on premiums by 2027
Right now, premiums are low, and coverage is broad. That’s good, but it’s not the full picture. Claims from past policy years are developing, and that’s going to matter. Insurance isn’t just about what’s happening today. It’s also about how yesterday’s losses show up over time. For cyber insurance, that lag is real.
Many losses from incidents in 2023 and 2024 haven’t fully materialized yet. These claims are complex. They often involve long legal processes, regulatory fines, or extended business interruption. And most of that takes time to resolve. This means insurers are still processing exactly how much these earlier underwriting years will cost. That’s especially true in the U.S., where litigation and regulatory scrutiny amplify the financial fallout.
Carlo Ramadoro, Head of Cyber and Technology at Lockton, made it clear, the current market stability may not hold. He pointed to accumulating losses from prior years, especially in U.S. markets, as a key risk factor. When those losses are tallied, profitability could take a hit. If that happens, premiums will adjust, possibly sharply, but Ramadoro also suggested any correction won’t likely be a repeat of the 2020 spike.
For executive teams, this is a signal. Today’s low premiums can’t be assumed to last beyond 2026. Strategic procurement teams should be factoring in the likelihood of a market correction around 2027. Getting multi-year agreements, evaluating long-term budget planning for cyber resilience, and testing internal risk exposure models are all steps worth taking now, before old claims start pushing new premiums up.
Security controls now drive pricing, use that to your advantage
Cyber insurance is about how you operate. Underwriters now look deep into cybersecurity controls before assigning a rate or offering terms. That includes specific controls like multi-factor authentication, endpoint monitoring, incident response playbooks, and identity and access management protocols.
Insurers want to see strong architecture. The upside is that mature cyber hygiene doesn’t just lower breach risk, it also reduces your insurance costs and opens the door for better policy conditions. That could include lower deductibles, wider coverage clauses, or higher loss limits. Right now, strong security postures are being rewarded on the insurance side, which gives CISOs and CTOs concrete ROI for those operational investments.
According to Lockton’s market analysis, insurers are directly connecting the quality of cyber controls to policy terms. They’re not just pricing against company revenues or industry exposure, they’re actively prioritizing demonstrated security practices. It’s a shift from general underwriting to technical examination, and that gives control back to well-prepared organizations.
Carlo Ramadoro, Head of Cyber and Technology at Lockton, emphasized that now is the right time for both new and renewing buyers to secure favorable terms. Strong controls can translate into stronger negotiation outcomes. For executives, the implication is simple: security isn’t just a line item, it’s a lever in your risk transfer strategy. Invest in it with purpose.
Insurer appetite will shift, legacy claims are the trigger
Cyber insurance pricing doesn’t stay low unless underwriting results remain healthy. Right now, insurers are maintaining competitive rates because their near-term books look solid. But as claims from older policies develop, particularly from 2023 and 2024, that picture could change. The loss environment is still evolving, and it’s unclear how much impact those older incidents will have as they work their way through settlement, litigation, or regulatory action.
Insurers are closely watching those developments. If actual losses exceed expectations, profitability declines. That affects risk appetite. Some carriers may raise rates. Others could limit capacity or tighten coverage terms. Either way, what we’re seeing today, a market full of options, competition, and pricing leverage for buyers, only holds if the numbers stay favorable for underwriters.
Renewal cycles over the next two years will become the testing ground. Carriers will assess how much risk they’re willing to retain at current rates and whether claims behavior aligns with their modeling. If those models break down due to unexpected losses or escalation in older claims, the market trend reverses. That applies even more when you consider the concentration of risks in high-exposure markets like the U.S., where claim costs tend to run higher, driven by legal fees and regulatory penalties.
Carlo Ramadoro, Head of Cyber and Technology at Lockton, highlighted this emerging tension. He noted that while the market remains stable for now, accumulated losses from prior underwriting years could pressure insurer results, and that would likely shift pricing dynamics starting in 2027.
Executive teams need to treat this as more than just a forecast. It’s a strategic early warning. Leadership should evaluate existing cyber policies, measure exposure under possible rate changes, and build flexibility into procurement and budgeting. Planning ahead now keeps control in your hands later, before pricing structure, capacity, and underwriting appetite start to move.
Key executive takeaways
- Falling premiums signal short-term market gains: Cyber insurance premiums have dropped by 11% amid increased insurer competition and capacity. Leaders should leverage this pricing window to secure cost-effective coverage while it lasts.
- Favorable conditions through 2026 offer leverage: The market remains highly competitive through 2026, offering strong negotiating power. Executives should take advantage by reassessing limits, deductibles, and policy terms to better align with evolving risk exposure.
- 2027 may bring pricing volatility from legacy claims: Accumulated claims from prior underwriting years, especially in the U.S., could undermine insurer profitability and reshape pricing. CFOs and risk leaders should plan for potential rate increases starting in 2027.
- Strong cybersecurity posture improves insurance terms: Insurers increasingly tie pricing and coverage to technical controls like MFA and incident response plans. Invest in advanced cyber hygiene to gain more favorable policy conditions and lower premiums.
- Future pricing hinges on claim development: Insurer appetite and rate stability depend on how legacy claims unfold in the next one to two years. Executives should monitor insurer performance at renewal and maintain flexibility in budget and coverage strategies.
