Cyber insurance at scale: what it means for brokers and clients

TL;DR: Coalition says its Activate Europe 2026 event highlighted how cyber insurance is moving toward global scale, AI-aware coverages, broker enablement and automated inbox defence, with 130,000+ policyholders, $1 billion in proforma GWP and 63,000+ presentations cited as evidence of the model’s reach. The operational shift is from static cover to faster risk intelligence, response and distribution.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “4 Key Takeaways from Activate Europe 2026”.

By the numbers:

• Coalition says business email compromise is the #1 reason businesses file cyber claims, with attack frequency jumping 15% year-over-year.

Key questions

Q: How should organisations use identity governance to strengthen cyber liability insurance readiness?

A: Organisations should treat identity governance as evidence of control, not just an IT process.

Q: Why do business email compromise attacks create such large claims exposure?

A: BEC exploits trusted business workflows, so the attacker can redirect payments, impersonate suppliers or intercept approvals without needing broad system compromise.

Q: What are the signs that an email account has crossed from normal use into compromise?

A: Common indicators include unusual login locations, impossible travel, new inbox rules, unexplained forwarding behaviour and active sessions that do not match the user’s normal pattern.

Practitioner guidance

• Align cyber coverage reviews to identity and session controls Use insurer conversations to confirm how mailbox access, inbox rules and active sessions are governed, monitored and revoked in practice.
• Treat AI endorsements as governance requirements, not wording changes Review where deepfake, synthetic content and AI output risk intersect with approval chains, authentication and fraud escalation paths.
• Validate BEC response against payment and email workflows Check whether suspicious logins, impossible travel and malicious inbox rules trigger containment before a payment, redirect or delegation step completes.

Bottom line: Cyber insurance is shifting toward live operational evidence, especially where email compromise, AI-enabled fraud and response speed affect claim outcomes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →