BaFin's Third Cyber Insurance Survey: German Premiums Reach About €807 Million as Accumulation Risk Remains the Main Worry

Germany's financial regulator has published the most detailed public picture yet of the country's cyber insurance market, and it shows a business that is still growing but at a much slower pace than before. The Federal Financial Supervisory Authority, known as BaFin, published its third survey of the cyber insurance market on May 29, 2026. Its figures come from insurers' own returns and describe the market up to the end of 2024. The article on BaFin's website is the source for every number below, although some details may appear only in charts that the text does not reproduce.

The survey covered 179 primary insurers, 28 reinsurers and 14 branches, up from 178, 10 and 12 in the 2023 survey. Among them, 66 provide direct stand-alone cyber business, up from 64 in 2023 excluding branches, and 25 provide inward reinsurance, up from 22. BaFin used profit and loss data for 2022 to 2024 under German commercial accounting rules, and updated the figures for 2020 and 2021 for comparison. An important regulatory change sits behind the data. Cyber is now treated as a separate insurance class. Separate reporting under the German Insurance Reporting Regulation applies from financial year 2025, and an EU-level reporting obligation has applied since financial year 2023. That means future surveys should be more complete.

On premiums, BaFin reports that direct stand-alone gross written premiums were about €807 million in 2024. Including branches and cyber add-on cover, the figure was about €932 million. Direct premiums grew about 13% in 2024, compared with about 10% in 2023, but that is far below the growth of about 66% in 2021 and 56% in 2022. The market is therefore still expanding, though the explosive phase seems to have ended. Inward reinsurance, where primary insurers pass risk to reinsurers, tells a different story. Stand-alone inward reinsurance premiums were about €1,635 million in 2024. Growth was about 2% in 2023 and then premiums fell about 26% in 2024, after growth of roughly 54% in 2021 and 72% in 2022. BaFin cites market saturation and lower prices resulting from greater reinsurance capacity as the causes.

The customer mix is changing. Small and medium-sized enterprises accounted for about 25% of gross written premiums in 2024, up from about 15% in 2020, while large corporates fell from about 85% to about 75%. BaFin notes that the move towards smaller firms was stronger in Germany. Private customers account for less than 1% of premiums, so cyber insurance remains a business product. The international share of direct premiums fell from 54% in 2020 to 48% in 2024, meaning German insurers are writing a larger share at home.

Profitability is a major theme. BaFin reports that the gross combined ratio in direct business was below 100% in every year except 2021. A combined ratio below 100% means the insurer's claims and costs were lower than its premiums. The net combined ratio, after reinsurance, was above 100% in every year except 2020, which BaFin says shows strong reliance on reinsurance. For inward reinsurance, the net combined ratio was below 100% only in 2020 and 2023. International business shows wider swings in combined ratios than German business, and inward reinsurance retention fell slightly in 2024. In simple terms, direct insurers have been able to price at a profit before reinsurance, but they lean heavily on reinsurers to keep the book balanced.

The regulator's main concern is accumulation. This describes a situation where one event, such as an attack on a widely used software supplier or a cloud service, causes claims across many policyholders at the same time. BaFin says accumulation losses have been observed more often in large corporates and, within that segment, increasingly in international business. It reports that most insurers analyse accumulation losses in direct business but just under half factor them into premiums. It also notes that insurers lack comprehensive cyber claims data and that loss scenarios can change quickly. That combination, limited history and fast-changing threats, makes pricing and reserving difficult. Cyber claims are usually settled within three years, though cases involving SMEs and especially large corporates take longer.

What does this mean for businesses? Companies that buy cyber cover should expect insurers to ask detailed questions about security controls, because insurers are trying to understand their accumulation exposure. They should read the policy wording closely for exclusions related to widespread events or infrastructure failures, and check what limits apply. For SMEs, which are an increasing share of the market, the survey suggests insurers want this business, but the long-term pricing is not settled. Businesses should not assume that premiums will stay at today's levels.

For insurers, the survey suggests two lessons. The first is that reliance on reinsurance has been high, and the recent fall in reinsurance premiums reflects cheaper reinsurance capacity, which may not last. The second is that building models for accumulation and including them in prices is still a work in progress for around half the market.

BaFin's analysis does not forecast losses or recommend products. It describes what insurers reported, and some details, such as the number of policies with ransom cover, are collected but not stated in the text. Readers should therefore treat the figures as a snapshot of 2024 rather than the current state of the market. An earlier version of this article cited a Munich Re estimate that the global cyber insurance market at about $15 billion of premiums in 2025, could not be confirmed in this review and is not relied on here. The next survey, and the separate reporting that began for financial year 2025, will show whether growth recovers and whether insurers narrow the pricing gap on accumulation.