Cyber insurance claims: what brokers and buyers get wrong

TL;DR: The belief that cyber insurance does not pay claims is usually driven by misunderstood claims data, policy terms, and fabricated statistics, even as insurers pay billions and Coalition paid more than $315 million in claims in 2025 alone, according to Coalition. The real issue is not whether coverage exists, but how retentions, limits, and response services shape whether a loss becomes a payout.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Dispelling the Myth That ‘Cyber Insurance Doesn't Pay Claims’”.

By the numbers:

• Coalition paid more than $315 million in claims in 2025 alone.
• Just 26% of cyber insurance claims in 2025 were closed with indemnity payments, according to the National Association of Insurance Commissioners research cited by Coalition.

Key questions

Q: How should organisations evaluate cyber insurance if many claims close without an indemnity payment?

A: They should judge the policy on the full response it enables, not only on cash indemnity.

Q: Why do payout percentages in cyber insurance reports often look lower than buyers expect?

A: Because payout percentages mix together different retentions, limits, incident severities, and open claims.

Q: What signs show that a cyber claims statistic is misleading?

A: Watch for a figure with no primary source, no methodology, or no clear definition of what counts as a paid claim.

Practitioner guidance

• Scrutinise claims data provenance Require primary sources, methodology, and date context before accepting any cyber claims statistic in broker conversations or board papers.
• Separate indemnity from response value Assess whether a policy can fund containment, forensics, and legal support even when a loss does not exceed the retention.
• Recalculate retention and limit assumptions Review whether your current retention reflects deliberate risk transfer or an accidental underinsurance position based on incident severity.

Bottom line: The article argues that cyber insurance scepticism is often driven by misread claims data, not by a simple absence of payment.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →