Cyber Insurance Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity Specialist | Last updated: June 28, 2026 | Next scheduled update: Q4 2026 | License: CC BY 4.
Quick Answer:
The global cyber insurance market reached $15.3 billion in premiums in 2024, growing to an estimated $15–16 billion in 2025, according to Munich Re’s Global Cyber Risk and Insurance Survey 2026. The U.S. market contracted 7.1% in 2024 — its first-ever premium decline — to $9.14 billion in direct written premiums, while nearly 50,000 claims were filed, a 40% jump year-over-year, per the NAIC 2025 Cybersecurity Insurance Report. S&P Global Ratings forecasts a 15–20% premium increase in 2026, ending two years of softening rates.
Key Findings
- FBI-reported US cybercrime losses outpace all global insured cyber claims combined. The FBI IC3’s 2024 Annual Report recorded $16.6 billion in reported US cybercrime losses — 2.17 times the estimated $7.65 billion paid globally in cyber insurance claims that year. This is the CIPG™ (Cyber Insurance Protection Gap Index), an original Axis Intelligence Research metric that quantifies the structural underinsurance of cyber risk. The gap does not capture unreported incidents or losses outside the United States.
- The US market saw its first-ever premium decline in 2024 even as claims surged 40%. US direct written premiums fell 7.1% to $9.14 billion in 2024, per NAIC data — while nearly 50,000 claims were filed, up 40% from 2023. The combination of falling premiums and rising claims frequency is the defining tension the market enters 2026 with, and it is why S&P Global Ratings is forecasting premium increases of 15–20% this year.
- BEC and FTF drive 58% of claim volume; ransomware drives the worst losses. Coalition’s 2026 Cyber Claims Report — drawing on 100,000+ policyholders — found BEC and Funds Transfer Fraud together account for 58% of all cyber incidents, while ransomware averaged $269,000 per claim and initial ransom demands surged 47% in 2025. A record 86% of targeted businesses refused to pay.
- The US data breach now costs $10.22 million — the highest ever recorded, and rising. IBM’s Cost of a Data Breach Report 2025 found the global average breach fell 9% to $4.44 million, but the US average climbed to $10.22 million — a new all-time high — driven by regulatory fines, escalation costs, and a litigation environment unmatched globally.
- Only 47% of eligible organizations globally have cyber insurance — the protection gap is structural. Munich Re’s 2026 survey (9,500+ respondents, 20 countries) found nearly 9 in 10 C-level executives do not feel their company is adequately protected, and that less than 5% — possibly as little as 1% — of total cyber risks are currently insured.
CIPG™ — Cyber Insurance Protection Gap Index (Axis Intelligence Research Proprietary Metric)
CIPG™ = 2.17x (as of Q2 2026, reflecting 2024 data)
Axis Intelligence Research developed the CIPG™ to give CFOs, CISOs, policymakers, and journalists a single citable figure that quantifies how far behind cyber insurance coverage sits relative to realized cyber losses. Existing market reports name the protection gap in qualitative terms; the CIPG™ names it in a ratio.
| CIPG™ Input | Value | Source |
|---|---|---|
| FBI IC3-reported US cybercrime losses (2024) | $16.6 billion | FBI IC3 2024 Annual Report |
| Global cyber insurance premiums (2024) | $15.3 billion | Munich Re Cyber Insurance Risks & Trends 2025 |
| Estimated global loss ratio | ~50% | NAIC 2025 (US: 47%); global midpoint |
| Estimated global claims paid (2024) | ~$7.65 billion | Axis Intelligence Research calculation |
| CIPG™ = FBI IC3 losses / Global claims paid | 2.17x | Axis Intelligence Research |
Reading the ratio: For every $1 paid out by cyber insurers globally in 2024, $2.17 in cybercrime losses were reported to the FBI in the United States alone — before accounting for unreported incidents, non-US losses, or the gap between reported and actual damage. Munich Re estimates global cybercrime economic costs will reach $14 trillion by 2028. Against that backdrop, the CIPG™ of 2.17x is conservative.
What the CIPG™ does not measure: The ratio uses FBI IC3 data, which captures reported losses only. It does not include losses that go unreported, which the FBI itself acknowledges is the majority of cybercrime. The protection gap is almost certainly wider than 2.17x.
Methodology: FBI IC3 2024 losses ($16.6B) from FBI.gov (published April 2025). Global premiums ($15.3B) and loss ratio inputs from Munich Re and NAIC 2025. CIPG™ = $16.6B ÷ ($15.3B × 0.50) = $16.6B ÷ $7.65B = 2.17x.
CC BY 4.0. Cite as: “Axis Intelligence Research, CIPG™ (Cyber Insurance Protection Gap Index), June 2026.”
Cyber Insurance Market Size Statistics 2026
The $15.3 billion that Munich Re confirmed for the global market in 2024 sounds like a big number — and it is, in absolute terms. In relative terms it is less impressive. Against a global property and casualty insurance market of roughly $2 trillion, cyber insurance represents less than 1% of total P&C premiums. Munich Re’s Jürgen Reinhart, Chief Underwriter Cyber, put it clearly in the 2026 annual report: “The lion’s share of cyber risks is still uninsured, even though they are insurable.”
Global Cyber Insurance Market Size by Year
| Year | Global Premiums (est.) | YoY Growth | Key Event |
|---|---|---|---|
| 2017 | ~$2.5B | — | Baseline: WannaCry, NotPetya reshape underwriting |
| 2018 | ~$3.1B | +24% | Rapid expansion; limited exclusion language |
| 2019 | ~$3.9B | +26% | RaaS (Ransomware-as-a-Service) emerges commercially |
| 2020 | ~$5.0B | +28% | COVID-19 accelerates remote work; attack surface widens |
| 2021 | ~$7.0B | +40% | Colonial Pipeline; Kaseya; premiums harden rapidly |
| 2022 | ~$9.0B | +29% | Peak hard market; Lloyd’s updates war exclusion language |
| 2023 | $16.66B | +85%* | Full-year; market softens; new carriers enter |
| 2024 | $15.3B | -8%* | Premiums moderate; US DWP declines first time ever |
| 2025 (est.) | ~$15–16B | +5–7% | Soft market continues; claims frequency rises |
| 2026 (proj.) | $16.4–17B | +8–15% | S&P forecasts hardening begins; rates turning upward |
| 2030 (proj.) | ~$28–30B | 10%+ CAGR | Munich Re; market doubles from current scale |
*Note: 2023 global figure ($16.66B) from NAIC U.S. cyber insurance report methodology (59% US share calculation); 2024 reflects Munich Re’s standalone cyber figure of $15.3B. The two methodologies differ on scope of packaged versus standalone policies.
Source: Munich Re Cyber Insurance Risks & Trends 2025; NAIC 2025 Cybersecurity Insurance Report; Swiss Re; Axis Intelligence Research synthesis.
US Cyber Insurance Market Size Statistics
The United States is — by a significant margin — the world’s largest individual cyber insurance market. According to the NAIC 2025 Cybersecurity Insurance Report, US direct written premiums totaled $9.14 billion in 2024, with US domiciled insurers writing $7.08 billion. The US accounts for 59–69% of global premiums, depending on methodology.
That 2024 figure matters because it is a decline — the first in the market’s recorded history. US DWP fell from $9.84 billion in 2023, a 7.1% drop. This happened not because organizations stopped buying coverage (policies in force held essentially flat at 4,368,614, a 0.03% decrease), but because competitive market dynamics drove rates down 22% cumulatively from the 2022 peak.
Marcus Chen’s read here: the timing of that decline is exactly wrong. Premiums fell in the same year the FBI recorded its largest-ever cybercrime loss figure — $16.6 billion — and the same year NAIC documented a 40% jump in claims. That combination is what produces the CIPG™ of 2.17x, and it is what S&P Global Ratings is reacting to with their 15–20% premium forecast for 2026. The soft market of 2023–2025 was a pricing aberration driven by insurer profitability and competitive entry. The threat environment never softened.
Global Market by Region
| Region | Share of Global Premiums | 2024 Est. Premium | Key Driver |
|---|---|---|---|
| North America | 69% | $10.6B | Mature market; SEC disclosure mandates; litigation culture |
| Europe | 21% | $3.2B | NIS2 directive (late 2024 enforcement); GDPR penalties |
| Asia-Pacific | ~7% | ~$1.1B | Fastest-growing; lowest penetration (<5% of eligible businesses) |
| Latin America / Other | ~3% | ~$0.5B | High growth from low base; regulation-driven adoption |
Source: Munich Re Cyber Insurance Risks & Trends 2025; Axis Intelligence Research.
Europe’s 28% year-over-year growth in 2025 reflects NIS2’s full enforcement, which extended mandatory cybersecurity and incident reporting requirements to a dramatically wider set of organizations than its predecessor. The directive now covers approximately 160,000 EU entities across 18 sectors. Munich Re’s 2026 cyber report identifies Europe as the next major growth frontier.
Cyber Insurance Premium Statistics: The 2022–2026 Pricing Cycle
Understanding where premiums are in 2026 requires understanding the cycle that produced the current moment. It is not a stable market — it is a market that went through one of the sharpest pricing swings in insurance history, and is now reversing.
From 2017 to 2022, global cyber insurance premiums grew by more than 30% annually. The inflection point was 2020–2021, when ransomware attacks on critical infrastructure revealed that the industry had been underpricing catastrophic risk. Premiums doubled at some renewals. Some businesses couldn’t buy coverage at all.
Then the hard market produced something counterintuitive: insurers became extremely profitable. The Fitch-reported US combined loss ratio fell to ~47% in 2024 — the third consecutive year of strong underwriting results. That profitability attracted new entrants, fragmented the market, and triggered competitive pricing that pushed rates down 22–27% cumulatively from the 2022 peak.
This is the soft market that CFOs have been enjoying through 2025. It is ending.
US Cyber Insurance Premium Rate Changes by Year
| Year | Rate Change | Context |
|---|---|---|
| 2020 | +28% | Pre-ransomware escalation |
| 2021 | +74% | Colonial Pipeline; Kaseya REvil attack |
| 2022 | +50% | Peak hard market; Lloyd’s war exclusion update |
| 2023 | -7% | Profitability drives competition |
| 2024 | -6% | Marsh Global Insurance Market Index: -6% globally |
| 2025 | Flat to -3% | Beazley: -6.8% cyber-specific rate change, H1 2025 |
| 2026 (forecast) | +15–20% | S&P Global Ratings; rising claim severity |
Source: Marsh Global Insurance Market Index; NAIC 2025; Beazley Investor Disclosures; S&P Global Ratings (2026 Cyber Insurance Market Outlook).
Premium Statistics by Business Size and Sector
Cyber insurance pricing in 2026 is not a single number — it is a function of company size, industry, security posture, and whether a business can demonstrate specific controls at the time of underwriting (not just at application).
For businesses with fewer than 250 employees, the median annual cyber insurance premium sits at $1,740 in 2026, according to Coalition’s 2026 Cyber Claims Report. That is down from $2,100 in 2024, reflecting the soft market. The American Academy of Actuaries confirmed in its February 2026 report that 60–70% of large corporations with revenue above $1 billion purchase cyber insurance, but only 40–50% of mid-market firms ($100M–$1B revenue) have it — and the figure drops sharply for smaller organizations.
Healthcare organizations pay a 42% premium above the cross-industry median, according to Gallagher, reflecting IBM’s finding that healthcare breaches averaged $7.42 million in 2025 — the highest of any sector for the 14th consecutive year.
The most impactful single control on premium pricing: multi-factor authentication. Companies that deploy MFA across all critical systems receive premium discounts averaging 18–22% from most major carriers, per Coalition data.
Cyber Insurance Claims Statistics 2026
Claims Volume and Frequency
The NAIC’s 2025 Cybersecurity Insurance Report documents nearly 50,000 US cyber insurance claims in 2024 — a 40% increase from 33,561 in 2023. This is the single most important number for underwriters entering 2026: frequency jumped dramatically in the same year premiums fell.
Coalition’s 2026 Cyber Claims Report, based on data from 100,000+ policyholders across five countries, provides the most granular public view of what claims look like at the individual-incident level. Overall claims frequency across Coalition’s book rose 3% year-on-year in 2025, but average severity decreased 19%, with the average claim loss falling to $116,000. This divergence — more incidents, less severe on average — reflects two simultaneous trends: better detection and containment by larger organizations, and attackers shifting toward volume-based tactics like BEC that generate more frequent but smaller individual losses.
Importantly, 74% of US cyber insurance claims in 2024 closed without any payment — the ratio of closed-without-payment to paid claims exceeds 20-to-1 by NAIC count — a figure that underscores how many reported incidents fall outside policy coverage, deductibles, or exclusion language.
Claims by Type: What Actually Gets Filed
| Claim Type | Share of Claims (Volume) | Avg Loss Per Claim | YoY Change (2025) | Source |
|---|---|---|---|---|
| Business Email Compromise (BEC) | 31% | $27,000 | Freq +15%, Severity -28% | Coalition 2026 Cyber Claims |
| Funds Transfer Fraud (FTF) | 27% | $141,000 | Freq -18%, Severity -14% | Coalition 2026 Cyber Claims |
| Ransomware | 21% | $269,000 | Demands +47%; 86% refused payment | Coalition 2026 Cyber Claims |
| Data Breach / Privacy | ~11% | Varies | Supply chain breaches growing | NAIC 2025 |
| System Failure / Business Interruption | ~10% | Varies | Non-malicious incidents rising | Munich Re 2026 |
The headline here is what Coalition’s Global Head of Claims Rob Jones said when the 2026 report published: “BEC and FTF are still powered by social engineering, which targets the individual, and those attacks can be just as damaging to businesses.” That statement deserves weight because it cuts against the narrative that ransomware is the dominant cyber insurance story. By volume, it is not. BEC alone accounts for nearly a third of all claims and drives 52% of funds transfer fraud cases.
The ransomware data in 2025 tells a more encouraging story than the headline numbers suggest. Initial ransom demands surged 47%, but a record 86% of targeted businesses refused to pay — the highest refusal rate Coalition has ever documented. Coalition attributes this to better backup infrastructure, tested incident response plans, and insurer-supported negotiation. The economics of ransomware are shifting: threat actors are demanding more, but fewer organizations are capitulating.
Dual-extortion ransomware — where attackers simultaneously encrypt systems and exfiltrate data — accounted for 70% of all ransomware claims in 2025. Data-theft incidents were more than twice as expensive as encryption-only events, because they add breach notification, regulatory investigation, third-party liability, and potential class actions on top of technical recovery.
Claims Denial Statistics
Approximately 21% of cyber insurance claims were denied or partially denied in 2025, up from 15% in 2023, according to Deloitte’s Global Insurance Outlook. The most common denial reason — failure to maintain the security controls declared in the insurance application — accounted for 34% of all denials. War and nation-state exclusion clauses were invoked in 16% of denied claims, per Lloyd’s Market Association data, a number rising as attribution of attacks to state actors becomes more common.
Cyber Insurance Adoption Statistics: The Protection Gap by Segment
The protection gap is not evenly distributed. It is concentrated precisely where organizations are most vulnerable.
Adoption by Organization Size
| Organization Size | US Cyber Insurance Adoption Rate | Source |
|---|---|---|
| Large enterprises (>$1B revenue) | 60–70% | American Academy of Actuaries, Feb 2026 |
| Mid-market ($100M–$1B revenue) | 40–50% | American Academy of Actuaries, Feb 2026 |
| Small-to-medium ($10M–$100M) | 17–23% | Coalition / Deepstrike 2025 |
| Micro-business (<$10M) | 5–10% | Swiss Re / Munich Re 2025 |
| Global average (all eligible organizations) | ~47% | Munich Re Global Cyber Survey 2026 |
Source: American Academy of Actuaries, Cyber Insurance Nears an Inflection Point (February 2026); Munich Re Global Cyber Risk and Insurance Survey 2026; Coalition 2026.
The Swiss Re estimate — that only about 10% of SMBs carry cyber insurance globally — is the figure underwriters and reinsurers keep returning to when they talk about long-term market growth. SMEs and micro-firms make up approximately 90% of companies globally but account for only about 30% of cyber premiums. Closing that gap is the largest single lever for future market expansion.
Hiscox’s 2025 Underinsurance Report adds a specific reason why SMBs stay uninsured that the aggregate numbers miss: 39% of uninsured small businesses thought they did not need insurance because their systems are secure, and 30% believed they were too small to be targeted. These are the exact assumptions that cybercriminals exploit. Verizon’s 2025 DBIR found ransomware appeared in 88% of SMB breaches, versus 39% for large organizations.
Adoption by Sector
Healthcare leads at approximately 82% adoption among large institutions, driven by HIPAA enforcement and a history of catastrophic breach costs. Financial services are close behind, shaped by both regulatory mandates and the sector’s inherent value as a target. The technology sector runs between 68–75% adoption.
The sectors with the lowest coverage penetration — and among the highest breach costs per incident — are manufacturing, education, and government, where legacy IT infrastructure, budget constraints, and fragmented procurement create coverage gaps that cybercriminals have learned to exploit systematically.
Cyber Insurance Underwriting Requirements: What Insurers Now Demand
This is the section that actually determines whether a business can buy coverage and at what price. The era of the simple questionnaire is over.
The eight security controls that carriers now consistently underwrite against — and that determine premium, deductibles, and whether coverage is available at all:
1. Multi-Factor Authentication (MFA) — enforced across email, VPN, remote access, cloud platforms, and privileged administrative accounts. 99% of cyber insurance applications now include specific MFA questions, per Marsh data. Carriers that find MFA absent may decline the policy outright.
2. Endpoint Detection and Response (EDR) — active behavioral monitoring across all endpoints. Coalition’s data shows that VPNs were the primary technology targeted in 59% of ransomware incidents where forensic investigators confirmed a specific entry point. EDR detects lateral movement that signature-based antivirus misses.
3. Offline and Immutable Backups — tested, isolated, and recent. In 72% of ransomware incidents, attackers specifically targeted backups before triggering encryption. Insurers now require proof that backups cannot be reached from a compromised environment.
4. Privileged Access Management (PAM) — controlling who can access what, with logging. This is the control that closes the gap the NAIC’s 2025 report identified: BEC losses exceeded $2.77 billion in 2024, and the most common initial path was credential abuse.
5. Incident Response Plan (IRP) — documented, assigned, and tested. Carriers want to see tabletop exercise records. Allianz Commercial found that a ransomware attack detected and contained at the initial-access stage costs up to 1,000 times less than one that progresses to full encryption and data exfiltration. The IRP is what enables that early containment.
6. Vulnerability Management — documented patch cadence for OS, software, and firmware across all critical assets. Edge devices remain the most exploited category; Verizon’s 2025 DBIR found edge device/VPN exploitation rose from 3% to 22% of vulnerability-exploit breaches in a single year.
7. Email Security — advanced filtering, DMARC enforcement, and phishing simulation programs. BEC accounted for $2.77 billion in FBI-reported US losses in 2024 alone. Phishing overtook stolen credentials as the most common initial attack vector in IBM’s 2025 breach analysis.
8. Security Awareness Training — documented, regular, with phishing simulation metrics. Underwriters treat training records as a proxy for organizational culture around security, not just a compliance checkbox.
Cyber Threat Statistics Driving Insurance Costs in 2026
Ransomware Statistics
Ransomware is the dominant driver of large cyber insurance payouts, even though it represents only 21% of claims by volume. The economics are straightforward: average ransomware loss ($269,000 per Coalition 2026) exceeds BEC average ($27,000) by nearly 10x.
Global ransomware incidents reached 5,414 reported attacks in 2025, an 11% increase over 2024, according to Cyberint data. The FBI IC3 documented 3,156 ransomware complaints in 2024, a 9% increase from 2023, but noted that this figure dramatically undercounts actual incidents because many victims report directly to FBI field offices rather than IC3, and many do not report at all.
The FBI IC3 2024 report identified the five most reported ransomware variants of 2024 as Akira, LockBit, RansomHub, FOG, and PLAY — and recognized 67 new variants in 2024 alone. Healthcare, manufacturing, and critical infrastructure were the most frequently targeted sectors.
BEC and Financial Fraud Statistics
Business Email Compromise generated $2.77 billion in FBI-reported adjusted losses in 2024, making it the second-largest category of cybercrime by financial impact. The FBI IC3 2024 Annual Report received 21,442 BEC complaints — essentially flat year-over-year — but losses are underreported because many victims don’t file IC3 complaints.
Coalition’s 2026 Cyber Claims Report identifies the gateway dynamic: 52% of FTF claims in 2025 originated from a BEC event. The attack sequence is email compromise first, fund redirect second. Coalition recovered $21.8 million in stolen funds for policyholders in 2025, with an average recovery of $202,000 per incident — but recoveries are only possible if organizations report suspicious activity quickly.
Data Breach Cost Statistics
IBM’s Cost of a Data Breach Report 2025 — the 20th edition of the definitive annual study, covering 600 organizations in 17 industries and 16 countries — found:
- Global average breach cost: $4.44 million (down 9% from $4.88 million in 2024 — first decline in five years)
- US average breach cost: $10.22 million (up 9% — new all-time high)
- Healthcare: $7.42 million (highest of any sector, 14th consecutive year at #1)
- Financial services: $5.56 million
- Mean time to identify and contain: 241 days (lowest in nine years)
- Shadow AI incidents added $670,000 to average breach cost; 63% of breached organizations lacked AI governance policies
The US figure — $10.22 million — is the number that matters most for cyber insurance underwriters and policyholders in North America. It is 2.3x the global average, driven by SEC disclosure requirements, state-by-state notification laws, and a litigation environment that turns breaches into class-action events in ways that don’t happen in most other jurisdictions.
Cybercrime Loss Statistics (FBI IC3 2024)
The FBI’s IC3 published its 2024 Annual Report in April 2025. The numbers are the foundation of the CIPG™ and deserve to be read against the cyber insurance market data:
- Total reported losses: $16.6 billion (+33% from $12.5 billion in 2023)
- Complaints received: 859,532 (+33% in losses, slight decline in complaint count from 880,418 in 2023)
- Investment fraud / cryptocurrency: $6.5 billion (largest single category by loss)
- BEC losses: $2.77 billion
- Ransomware complaints: 3,156 (+9% YoY)
- Over 4,800 critical infrastructure organizations reported being affected by cyber threats
- Cyber-enabled fraud: 83% of all losses ($13.7 billion of $16.6 billion total)
The FBI’s own note on these figures: they represent reported losses only. The agency explicitly acknowledges that the majority of cybercrime goes unreported. The IC3 has received more than 9 million complaints since its founding in 2000.
Cyber Insurance Exclusions and Coverage Gaps
The War Exclusion Problem
The 2017 NotPetya attack — attributed to Russian military intelligence — caused over $10 billion in global damage. When Merck and Mondelez sought combined payouts of over $1.4 billion from their insurers, carriers invoked war exclusions to deny or limit coverage. The litigation that followed reshaped the industry.
By 2025, Lloyd’s of London has formally updated its market requirements to exclude losses from state-backed cyberattacks in many standalone policies. The war exclusion has evolved from a rarely-invoked clause to an active underwriting consideration — particularly for businesses in critical infrastructure, financial services, defense supply chains, and organizations with significant foreign government counterparty exposure.
Nation-state exclusions were invoked in 16% of denied claims in 2025, per Lloyd’s Market Association data. As geopolitical attribution becomes more common and more contested — and as Munich Re notes that “the line between state-sponsored actors, tolerated criminal groups, and profit-driven attackers is blurring” — this exclusion will generate more disputes.
SMB Coverage Gaps
Organizations under $25 million in revenue filed 64% of all claims in 2024, with an average severity of $79,000, according to Coalition. An uninsured SMB facing the average cyber incident cost — or a catastrophic breach exceeding $1 million — has no financial recovery mechanism. Recovery from a significant breach frequently exceeds the company’s annual IT budget, and for the smallest organizations it can be existential.
The practical access barrier for SMBs is not premium cost alone. The 51% of small businesses that report having no cybersecurity measures in place at all — per Deepstrike’s 2025 analysis — are frequently uninsurable in the standard admitted market. Carriers that require MFA, EDR, and offline backups as conditions of coverage simply cannot write policies for organizations that don’t have them. This creates an adverse selection dynamic: the businesses most in need of coverage are the least likely to qualify for it.
Methodology
Data Collection
Axis Intelligence Research compiled statistics from seven primary sources for this report. Cybercrime loss data from the FBI IC3 2024 Annual Report (published April 2025, official US government). Market size and global premium data from Munich Re’s Cyber Insurance Risks and Trends 2025 and Global Cyber Risk and Insurance Survey 2026. US market data and claims frequency from the NAIC 2025 Cybersecurity Insurance Report. Claims granularity from Coalition’s 2026 Cyber Claims Report (March 2026). Breach cost data from IBM’s Cost of a Data Breach Report 2025. Actuarial market analysis from the American Academy of Actuaries, February 2026. Premium rate data from the Marsh Global Insurance Market Index and Beazley investor disclosures.
CIPG™ Calculation
See the CIPG™ section above. Primary inputs: FBI IC3 2024 Annual Report ($16.6B in US losses) and Munich Re global premium data ($15.3B) with NAIC-reported approximate loss ratio (~47–50%). CIPG™ = $16.6B ÷ ($15.3B × 0.50) = 2.17x.
Limitations
Global cyber insurance market figures use different methodologies across sources; figures from Munich Re, NAIC, and Swiss Re are not directly comparable and reflect different scope definitions (standalone vs. packaged policies, US domiciled vs. all writers). The CIPG™ uses FBI IC3 data that represents reported US losses only. FBI IC3 data represents approximately 20–30% of actual cybercrime losses by FBI’s own analysis. The CIPG™ is therefore a floor, not a ceiling, on the protection gap. Market adoption rates vary significantly by study methodology and survey sample.
About This Dataset
Dataset title: Cyber Insurance Statistics 2026
Compiled by: Axis Intelligence Research & Marcus Chen, June 28, 2026
Primary sources: FBI IC3 2024 Annual Report (April 2025); Munich Re Cyber Insurance Risks & Trends 2025; Munich Re Global Cyber Risk and Insurance Survey 2026; NAIC 2025 Cybersecurity Insurance Report; Coalition 2026 Cyber Claims Report (March 2026); IBM Cost of a Data Breach Report 2025; American Academy of Actuaries (February 2026); Beazley investor disclosures; Marsh Global Insurance Market Index; S&P Global Ratings (2026 Cyber Insurance Market Outlook)
Proprietary metric: CIPG™ (Cyber Insurance Protection Gap Index), CC BY 4.0
Update cadence: Quarterly; next scheduled update: Q4 2026
Coverage: Global, with primary depth on U.S. market
Cite This Research
APA:
Axis Intelligence Research & Chen, M. (2026, June 28). Cyber insurance statistics 2026: Market size, claims, premiums & the protection gap. Axis Intelligence. https://axis-intelligence.com/cyber-insurance-statistics/
MLA:
Axis Intelligence Research and Marcus Chen. “Cyber Insurance Statistics 2026: Market Size, Claims, Premiums & the Protection Gap.” Axis Intelligence, 28 June 2026, axis-intelligence.com/cyber-insurance-statistics/.
Chicago:
Axis Intelligence Research and Marcus Chen. “Cyber Insurance Statistics 2026: Market Size, Claims, Premiums & the Protection Gap.” Axis Intelligence. June 28, 2026. https://axis-intelligence.com/cyber-insurance-statistics/.
Embed This Research
<figure style="border:1px solid #21262D;padding:16px;border-radius:4px;font-family:sans-serif;">
<blockquote style="margin:0 0 8px;font-size:1rem;line-height:1.5;">
"FBI-reported US cybercrime losses in 2024 equaled 2.17 times the total estimated
cyber claims paid globally by insurers — the CIPG™ (Cyber Insurance Protection Gap Index)
calculated by Axis Intelligence Research from FBI IC3 and Munich Re 2025 data."
</blockquote>
<figcaption>
— <a href="https://axis-intelligence.com/cyber-insurance-statistics/"
rel="dofollow">Cyber Insurance Statistics 2026</a>,
Axis Intelligence Research (CC BY 4.0)
</figcaption>
</figure>
Frequently Asked Questions
What is the global cyber insurance market size in 2026?
The global cyber insurance market reached $15.3 billion in 2024 and approximately $15–16 billion in 2025, according to Munich Re’s Global Cyber Risk and Insurance Survey 2026. Munich Re projects the market will grow to approximately $28 billion by 2030, at a compound annual growth rate of more than 10%. Some analysts, including Howden, project the market could exceed $50 billion by 2030 if SMB penetration accelerates.
How much does cyber insurance cost for a small business in 2026?
For businesses with fewer than 250 employees, the median annual cyber insurance premium sits at $1,740 in 2026, down from $2,100 in 2024, reflecting two years of competitive rate softening, per Coalition’s 2026 Cyber Claims Report. Premiums are expected to rise 15–20% in 2026 per S&P Global Ratings, which would return the median SMB premium toward $2,000–$2,100. Healthcare and financial services businesses pay significantly more — up to 42% above the cross-industry median (Gallagher).
What percentage of businesses have cyber insurance?
Globally, approximately 47% of eligible organizations carry a cyber insurance policy, according to Munich Re’s 2026 Global Cyber Risk and Insurance Survey. The figure varies sharply by size: 60–70% of large corporations (revenue above $1 billion) have coverage, versus 40–50% of mid-market firms, and as few as 10–20% of small businesses, per the American Academy of Actuaries’ February 2026 analysis.
What does cyber insurance typically cover?
A standard standalone cyber policy covers first-party costs (incident response, forensics, business interruption, data restoration, ransom negotiation) and third-party liability (regulatory defense, customer notification, privacy liability). What it frequently does not cover: losses from state-sponsored attacks (war exclusion), incidents caused by failure to maintain the security controls declared in the application, pre-existing conditions, and — depending on policy wording — BEC losses unless specific social engineering endorsements are purchased.
What is the most common type of cyber insurance claim?
By volume, Business Email Compromise (BEC) is the most common, accounting for 31% of all claims in Coalition’s 2026 data. By financial severity, ransomware is the most expensive, averaging $269,000 per incident. BEC and FTF together account for 58% of claim frequency. Ransomware accounts for the largest share of high-value claims.
Why are cyber insurance premiums expected to rise in 2026?
S&P Global Ratings forecasts 15–20% premium increases in 2026, citing rising claims severity (successful attacks are more costly per incident than in 2024), a 40% jump in claims frequency documented by NAIC in 2024, and the 47% surge in initial ransomware demands in 2025. The two-year soft market (2023–2025) was driven by insurer profitability and competitive entry — not by any reduction in threat levels. NAIC documented claims rising 40% in the same year premiums fell 7.1%, which is not a sustainable ratio.
What is the CIPG™?
The CIPG™ (Cyber Insurance Protection Gap Index) is an original Axis Intelligence Research metric that quantifies how large the structural gap is between realized cybercrime losses and cyber insurance payouts. CIPG™ = 2.17x as of Q2 2026, meaning FBI-reported US cybercrime losses ($16.6 billion in 2024) equaled 2.17 times the estimated $7.65 billion paid globally by cyber insurers that year. The ratio is necessarily conservative — it uses only reported US losses and does not include unreported incidents or non-US losses.
How often are cyber insurance claims denied?
Approximately 21% of cyber insurance claims were denied or partially denied in 2025, up from 15% in 2023, per Deloitte’s Global Insurance Outlook. The leading denial reason — accounting for 34% of denials — is failure to maintain the security controls declared in the insurance application. War and nation-state exclusions accounted for 16% of denials.
Does cyber insurance cover ransomware?
Most standalone cyber policies cover ransomware, but coverage is conditional. Insurers require evidence of specific controls — particularly tested offline backups and an incident response plan — and will deny claims if the organization failed to maintain the controls it attested to in the application. Some policies sub-limit or exclude ransomware payments specifically. Coalition found that 86% of businesses targeted by ransomware in 2025 refused to pay, suggesting coverage for ransom payment is increasingly less relevant than coverage for recovery and business interruption.
What security controls do cyber insurers require in 2026?
The eight controls that most major carriers now require: MFA across all critical systems, EDR deployment, immutable offline backups, privileged access management, a documented and tested incident response plan, a vulnerability management program with documented patch cadence, email security with DMARC enforcement, and documented security awareness training with phishing simulation records. Absence of MFA alone is sufficient grounds for policy denial at most carriers.