Cyber insurance statistics are scattered across regulators, trade bodies, brokers and insurers, and each one sees a different slice of the market: filed premiums, its own book of claims, its own clients' renewals or a national survey of buyers. This page gathers the current figures from the publishers' own pages: the NAIC report on the US cybersecurity insurance market for 2025, the Association of British Insurers (ABI) UK claims figures, the UK government Cyber Security Breaches Survey 2025/2026, Coalition's 2026 Cyber Claims Report, the Marsh Global Insurance Market Index, Munich Re's 2026 cyber outlook and Lloyd's systemic risk scenario, plus the supervisory position of the Bank of England Prudential Regulation Authority (PRA) and EIOPA. Insurer and broker figures are those firms' own research on their own books and are attributed as such. Every figure carries the report name, publisher and edition in the same sentence or table row. It is for CISOs, risk managers and finance teams preparing renewals, setting retentions or explaining insurance to a board. Last reviewed: October 2026.
Key takeaways
- The US market grew again after its first contraction. The NAIC report on the cybersecurity insurance market puts 2025 US direct written premium at about $9.46 billion, up about 3.5% from $9.14 billion in 2024, the year premiums fell for the first time.
- Claims volumes are rising faster than premiums. The same NAIC report counts 56,323 reported claims in 2025, up 20%, and an industry loss ratio rising to about 53 from 48.7.
- Prices are still falling for buyers. The Marsh Global Insurance Market Index for Q3 2026 shows global cyber rates down 4%, with US cyber rates flat.
- Email fraud and ransomware dominate claims. Coalition's 2026 Cyber Claims Report, based on its own policyholders, finds business email compromise and funds transfer fraud behind 58% of incidents, and ransomware the costliest claim type at an average loss of $269,000.
- Take-up is far from universal. The UK Cyber Security Breaches Survey 2025/2026 finds 47% of businesses insured against cyber risk in some way, but only 10% hold a specific cyber policy, and 22% do not know whether they are covered.
Headline statistics
| Statistic | Figure | Source, publisher and edition |
|---|---|---|
| US cyber direct written premium, 2025 | About $9.46 billion (from $9.14 billion) | 2026 Report on the Cybersecurity Insurance Market, NAIC (2025 data) |
| US cyber policies in force, domestic insurers | 5.84 million, up 33% | NAIC 2026 report (2025 data) |
| US reported cyber claims | 56,323, up 20% | NAIC 2026 report (2025 data) |
| UK cyber claims paid by ABI members | £197 million in 2024, up 230% | ABI cyber claims figures, November 2025 |
| UK businesses with any cyber insurance | 47% (charities 35%) | Cyber Security Breaches Survey 2025/2026, DSIT |
| UK businesses with a specific cyber policy | 10% (charities 5%) | Cyber Security Breaches Survey 2025/2026, DSIT |
| Global cyber rate change | Down 4%; US flat | Global Insurance Market Index Q3 2026, Marsh |
| Average claim severity across Coalition policyholders | $116,000, down 19%; frequency up 3% | 2026 Cyber Claims Report, Coalition (2025 data) |
| Initial ransom demands to Coalition policyholders | Up 47%; 86% refused to pay | 2026 Cyber Claims Report, Coalition |
| Modelled five-year global loss from a payments-system cyber attack | $3.5 trillion central; $2.2 trillion to $16 trillion range | Systemic risk scenario, Lloyd's with Cambridge Centre for Risk Studies, October 2023 |
Statistics by theme
Market size and structure (United States)
The NAIC is the only source here built from regulatory filings rather than one firm's book. Its 2026 report covers the 2025 reporting year.
| Measure (NAIC, 2025 data) | Figure |
|---|---|
| Total direct written premium, including alien surplus lines | About $9.46 billion, up about 3.5% |
| Premium written by domestic insurers | $7.46 billion |
| Premium written by alien surplus lines insurers | About $2.0 billion, about 21% of the total |
| Premium by policy type | Primary about 64%, excess about 32%, endorsement about 4% |
| 2024 change in total premium | Down 7.11%, the first contraction recorded |
| Share of premium written by the top 10 groups | 51.03% |
| Share of premium written by the top 20 groups | 76.82% (largest group 8.44%) |
| Policies in force, change by type | Endorsement up 53.8%, primary up 13.6%, excess down 45.3% |
The rise in endorsement policies, cyber cover attached to a package policy, explains most of the 33% growth in policies in force. Endorsements usually carry low sub-limits, so policy counts overstate how much loss is actually transferred.
Claims and loss experience
- US claims volume: the NAIC 2026 report counts 56,323 reported claims in 2025, up 20% and more than six times the 2017 level.
- US loss ratios: NAIC reports an industry-wide loss ratio of about 53 for 2025 against 48.7 in 2024; primary policies ran at 57% including defence and cost containment, excess at 52%, and endorsements at 19.1% (10.2% in 2024).
- Large business severity: NAIC reports average severity for businesses with $1 billion or more in revenue of about $4.4 million in 2025, roughly double the $2.2 million of 2024.
- UK claims paid: the ABI reports its members paid £197 million in cyber claims in 2024, a 230% increase or £138 million more than in 2023. Malware and ransomware made up 51% of claims, up from 32%, and new policies rose 17%. The ABI notes its data is a sample from participating members and is not extrapolated to the whole market.
- Claim mix at a reinsurer: Munich Re's Cyber Insurance: Risks and Trends 2026 states first-party claims account for 62% of the cyber claims it actively manages and that malicious events outnumber non-malicious ones by about three to one.
Claims by cause (Coalition policyholders, 2025)
Coalition's 2026 Cyber Claims Report draws on more than 100,000 policyholders in the US, Canada, the UK, Australia and Germany. These are Coalition's own figures for its own book.
| Claim type or measure | Figure | Change |
|---|---|---|
| Business email compromise plus funds transfer fraud | 58% of incidents | Not stated |
| Funds transfer fraud share of claims | 27% (second most common) | Frequency down 18% |
| Funds transfer fraud average severity | $141,000 | Down 14% |
| Funds transfer fraud claims that began with BEC | 52% | Not stated |
| BEC average severity | $27,000 | Down 28%; frequency up 15% |
| Ransomware average loss | $269,000 (costliest type) | Initial demands up 47% |
| Ransomware claims with dual extortion | 70% | Not stated |
| Funds recovered for policyholders | $21.8 million, average $202,000 | Not stated |
| Closed claims with no out-of-pocket loss | 64% | Not stated |
| Organisations with more than $100 million revenue | Five times the claim frequency of smaller firms; average severity $268,000 | Severity down 7% |
Pricing
- Rates: the Marsh Global Insurance Market Index for Q3 2026 reports a global composite rate decrease of 5%, the ninth consecutive quarterly decrease, with global cyber rates down 4% and US cyber rates flat. Marsh measures renewal rate changes for its own clients.
- Loss trend against price: with NAIC loss ratios rising and Marsh rates still falling, the soft market of the past two years is under pressure. This is our reading of the two sources together, not a statement by either publisher.
Take-up and coverage (United Kingdom)
| Organisation type (DSIT CSBS 2025/2026) | Cover within a wider policy | Specific cyber policy |
|---|---|---|
| Micro businesses | 37% | 8% |
| Small businesses | 40% | 15% |
| Medium businesses | 36% | 24% |
| Large businesses | 22% | 32% |
| All businesses | 37% | 10% |
| All charities | 31% | 5% |
| High-income charities (£500,000 or more) | 55% | 20% |
The Cyber Security Breaches Survey 2025/2026 reports overall cover of 47% for businesses, 55% for small and 61% for medium businesses, 35% for charities and 75% for high-income charities (up from 64% in 2024/2025). 22% of businesses and 13% of charities did not know whether they had any cyber insurance.
Protection gap and systemic risk
- Uninsured losses: Munich Re's 2026 outlook states that the lion's share of cyber risk remains uninsured, without giving a percentage, and reports that nearly nine in ten C-level respondents to its Cyber Risk and Insurance Survey 2026 do not feel adequately protected.
- Accumulation: Lloyd's systemic risk scenario (October 2023, with the Cambridge Centre for Risk Studies) models a cyber attack on a major payments system costing the global economy $3.5 trillion over five years in its central case, from $2.2 trillion to $16 trillion across severities, with an expected loss of $140 billion. Lloyd's set this against cyber premium of just over $9 billion at the time.
Supervisory position
- UK PRA: Supervisory Statement SS4/17 Cyber insurance underwriting risk (first published July 2017, last amended at 31 December 2024) distinguishes affirmative cyber cover from non-affirmative or "silent" cyber exposure, expects boards to review non-affirmative exposure at least annually, and expects cyber stress tests covering accumulation through cloud and cross-product exposure at return periods up to 1 in 200 years.
- EIOPA: in a 2020 speech on its cyber underwriting work, EIOPA described the European market as growing rapidly and identified the lack of quantitative incident data as the main obstacle to pricing, proposing a standardised, anonymised incident reporting framework. It gave no market figures.
What the numbers mean for defenders
Insurers price on what causes their claims. The claims figures point at email fraud, ransomware and identity weaknesses, which is why underwriting questionnaires focus on MFA, backups, privileged access and payment controls.
- Payment controls pay back in claims terms: with BEC and funds transfer fraud behind 58% of Coalition incidents, out-of-band verification of bank detail changes is a control insurers ask about. See the Business Email Compromise Response Playbook and the Business Email Compromise and Fraud Statistics Guide.
- Ransomware readiness drives severity: ransomware is the costliest claim type for Coalition and half of ABI claims. Immutable, tested backups reduce both the loss and the pressure to pay. See the Backup Security and Immutable Backup Guide and the Ransomware Statistics Guide.
- Identity evidence is underwriting evidence: phishing-resistant MFA on remote access, email and privileged accounts is the question most often asked at renewal. See the Phishing-Resistant MFA Guide and the Privileged Access Management Guide. Service accounts and API keys are increasingly in scope of the same questions.
- Know what you hold: 22% of UK businesses do not know whether they are covered, and endorsement cover is the fastest-growing US policy type. Confirm limits, sub-limits and exclusions before an incident, not during one.
- Quantify before choosing a limit: sector and size severity figures from NAIC and Coalition give a starting point, but a limit should come from your own loss scenarios. See the Cyber Risk Quantification Guide and the FAIR Model Guide.
Choosing which figure to use
| Question | Best source | Limitation |
|---|---|---|
| How big is the market and is it growing? | NAIC report (US), ABI (UK claims) | US only; ABI is a member sample |
| What causes claims and how much do they cost? | Coalition Cyber Claims Report, NAIC severity | Coalition sees its own book, weighted to smaller firms |
| Will my renewal price rise? | Marsh Global Insurance Market Index | Marsh client renewals, not the whole market |
| Do peers buy cover? | DSIT Cyber Security Breaches Survey | UK only; self-reported |
| How bad could an accumulation event be? | Lloyd's systemic scenario | Modelled, not observed |
Small organisations should look at the DSIT micro and small business rows and the Coalition averages, which are closer to their scale. Large organisations should use the NAIC large-business severity and the Coalition over-$100 million row, and expect towers of primary and excess cover rather than a single policy.
Using the numbers at renewal
- Collect last year's questionnaire answers and evidence (MFA coverage, backup tests, EDR coverage, PAM scope) before the broker meeting.
- Map your top three loss scenarios to the claim types above and check each against policy wording, sub-limits and waiting periods.
- Compare your proposed retention and limit with the size-relevant severity figures, then with your own quantified scenarios.
- Test the insurer's incident response panel and notification steps in a tabletop exercise, and record the notification deadline in the incident response plan. See the Incident Response Plan Template.
- After renewal, log any exclusions and gaps in the risk register as retained risk with a named owner, and revisit if the market hardens. See the Risk Register Template.
Metrics that show the programme is working
- Share of underwriting questionnaire controls you can evidence with a report, not a statement.
- MFA coverage on email, remote access and privileged accounts (target 100%).
- Days since the last successful restore test of critical systems.
- Ratio of insured limit to the modelled severe loss for your top scenario.
- Time from incident declaration to insurer notification in exercises.
- Premium and retention change at renewal compared with the Marsh index for your region.
Framework mapping
| Insurance activity | NIST CSF 2.0 | ISO/IEC 27001:2022 |
|---|---|---|
| Deciding to transfer, accept or reduce risk | GV.RM-04 | Clause 6.1.3 Information security risk treatment |
| Quantifying scenarios to set limits | GV.RM-06 | Clause 6.1.2 Information security risk assessment |
| Notifying the insurer and using its panel | RS.MA-01 | A.5.24 Information security incident management planning and preparation |
| Recovery covered by the policy | RC.RP-01 | A.5.30 ICT readiness for business continuity |
| Underwriting evidence on access controls | PR.AA-05 | A.5.15 Access control |
| Feeding claim lessons back | ID.IM-01 | A.5.27 Learning from information security incidents |
Common failure patterns when using cyber insurance statistics
- Treating one insurer's book as the market: Coalition, Munich Re and Marsh report their own policyholders, claims or clients. Say so every time.
- Mixing currencies and years: ABI figures are 2024 claims in sterling, NAIC and Coalition are 2025 in dollars, Marsh is Q3 2026.
- Reading policy counts as protection: endorsement growth raised US policy counts by a third, but endorsements carry small sub-limits.
- Quoting the Lloyd's $3.5 trillion as an expected loss: it is a modelled scenario; Lloyd's own expected loss figure is $140 billion over five years.
- Assuming cover exists: more than a fifth of UK businesses do not know. Check the schedule, not the assumption.
- Using severity averages as a limit: averages hide the tail; the NAIC large-business severity doubled in one year.
Methodology notes and caveats
- NAIC: compiled from the cybersecurity supplement to insurers' annual statements plus data on alien surplus lines insurers; covers 2025. Some figures in the report are cited from AM Best; those are not used here. The report's text is not fully consistent on the 2024 domestic base, so we use its headline totals.
- ABI: a sample of participating member firms, not grossed up to the market; covers 2024 claims paid.
- DSIT Cyber Security Breaches Survey 2025/2026: official statistics on UK businesses and charities; insurance questions are self-reported and include "don't know" answers.
- Coalition: the firm's own claims across more than 100,000 policyholders in five countries during 2025; its book is weighted towards small and medium-sized businesses.
- Marsh: renewal rate changes for Marsh clients by quarter; regional cyber percentages other than global and US are shown only in charts.
- Munich Re and Lloyd's: a survey plus the reinsurer's own claims, and a modelled scenario respectively. Market-size estimates from Munich Re and Swiss Re are widely quoted, but we could not read them on the publishers' own pages, so they are left out.
- Regulators: the PRA and EIOPA items describe supervisory expectations, not market statistics. Lloyd's requirements on state-backed attack exclusions are not covered here because we could not read the Lloyd's bulletin itself.
Practitioner checklist
- Cite every insurance figure with publisher, report name and data year, and flag insurer or broker figures as that firm's own book.
- Confirm whether you hold a specific cyber policy or only an endorsement, and record limits, sub-limits and exclusions.
- Map the top claim causes (email fraud, ransomware) to controls you can evidence at renewal.
- Implement out-of-band verification for payment and bank detail changes.
- Test restores of critical systems and keep the evidence for underwriters.
- Extend MFA and privileged access evidence to service accounts and API keys, which questionnaires increasingly cover.
- Write the insurer notification steps and deadline into the incident response plan and exercise them.
- Set limits from quantified scenarios, using NAIC and Coalition severities only as a cross-check.
- Record uninsured and excluded exposures as retained risk with an owner.
- Refresh this page's figures when NAIC (late summer), Coalition (spring) and DSIT (spring) publish new editions.
Standards and references
- NAIC: 2026 Report on the Cybersecurity Insurance Market
- Bank of England PRA: SS4/17 Cyber insurance underwriting risk
- DSIT: Cyber Security Breaches Survey 2025/2026
- ABI: Nearly £200 million paid in cyber claims to help UK businesses recover
- EIOPA: Cyber underwriting: managing the risks of digital finance
- Lloyd's: Systemic risk scenario reveals global economy exposed to $3.5trn from major cyber attack
- Munich Re: Cyber Insurance: Risks and Trends 2026
- Coalition: 2026 Cyber Claims Report
Related NHI Mgmt Group resources: Cyber Insurance Guide · Insurance Sector Identity Security Guide · Cybersecurity Statistics Guide · Data Breach Statistics Guide · Insider Threat Statistics Guide