Cyber Insurance in 2026: A Market of Nearly $15 Billion, Falling Rates and Small Businesses That Still Go Without Cover

Cyber insurance is a young and fast-changing market, and recent reports give a picture of a business that is large and still growing, but whose prices are falling and whose smallest customers are still mostly uninsured. This article brings together three sources: Munich Re's Global Cyber Risk and Insurance Survey 2026, an Insurance Journal report of October 16 on a Triple-I briefing, and an Insurance Business report of October 16 on small business take-up. An earlier version of this article gave a market range of $23 billion to $33.4 billion for 2026, described a US reporting law taking effect in May 2026, and quoted two figures from the World Economic Forum. Those items do not appear in the sources reviewed for this update, and they were inconsistent with Munich Re's own estimate, so they have been removed.

Start with the size of the market. Munich Re's survey, the fourth edition, was published on April 22, 2026 and draws on more than 9,500 respondents in 20 countries, across industries and company sizes. The reinsurer says the global cyber insurance market totalled nearly $15 billion in 2025, that premium growth has slowed over the last three years after an exceptionally steep rise, and that global premium volume is expected to reach around $28 billion by 2030. It gives an average annual growth rate of 15% for the period from 2020 to 2030. The text on Munich Re's page does not include findings on preparedness, artificial intelligence or ransomware, which are in the full report. Swiss Re's projections, quoted by Insurance Journal, are lower for the near term: premiums of $16.4 billion in 2026 and $17.1 billion in 2027, with North America accounting for roughly two-thirds of the market. Different forecasters use different definitions, which is why their figures differ.

Prices are moving down. According to the Insurance Journal report, cyber rates have now fallen for four consecutive years, with a drop of about 5% so far in 2026 following a 13% decline in 2025. Falling rates reflect competition among insurers, improved security among larger buyers, and a period in which ransomware claims did not grow as fast as feared. Global premiums, the report says, have grown about 5% a year since 2022, according to Swiss Re. Falling rates are good news for buyers, but they raise the question of whether insurers are charging enough, given the loss trends below.

The loss trends are worrying. The FBI's Internet Crime Report, cited in the article, shows US cyber-related losses reaching nearly $21 billion in 2025, up from about $16 billion in 2024, and reported incidents exceeding 1 million, compared with 859,532 in 2024. Chubb data, cited by the Insurance Information Institute (Triple-I), show that the average claim severity for large US businesses roughly doubled to over $4.4 million in 2025, while claim frequency for that segment fell 34%. So claims are less frequent but more costly when they occur. IBM data cited in the article show that about 15% of 2026 data breaches came from supply-chain compromises, costing about $5 million on average, and Verizon's 2026 Data Breach Investigations Report found ransomware involved in 48% of breaches, with 69% of ransomware victims declining to pay, partly because of stronger backups. IBM also found that organisations using security AI and automation averaged $4 million per breach, against $5.93 million without those tools.

Artificial intelligence cuts both ways. The Insurance Journal article says AI-powered phishing, impersonation and social engineering make attacks more sophisticated and easier to launch, and that the FBI reported nearly $893 million in losses tied to AI-driven incidents in 2025. At the same time, AI tools used for defence are associated with lower breach costs. Sean Kevelighan, chief executive of Triple-I, said insurance alone is not enough, and that prevention, preparedness and coverage have to work together.

The gap is greatest among small businesses. Swiss Re estimates SME penetration at 10% to 20%, according to the Insurance Journal article. The Insurance Business article adds regional detail: Lindsey Maher of the specialist insurer CFC puts US SME penetration at 30% to 40%, and comparable markets such as the UK, Canada, Australia and New Zealand at roughly 10% to 15%. A UK government survey published on April 30, 2026, of 2,112 businesses, found 47% insured against cyber risk in some form, up from 45% and 43% in the previous two years, though that figure includes cyber cover bundled into wider policies. In Canada, a survey of 308 business owners found 22% held any cyber insurance and 12% held a standalone policy.

Why is the take-up so low? Maher attributes the higher US figure to competition, with more than 200 carriers offering cyber products there, and to years of marketing to small businesses, and not to greater sophistication among buyers. She points to obstacles elsewhere: cyber is often left to the end of a renewal or missed during the policy year, some generalist brokers see it as complicated, and insurer application forms designed for large corporations are disproportionate for a firm with 15 staff. Her view is that long application forms are not realistic to expect small clients to complete. The Insurance Journal article adds that cost may not be the main barrier and that misunderstanding of what cover offers may also matter.

What should a small business do? Ask a broker for a simple quote and compare cyber cover included in package policies with standalone cover, since limits and exclusions differ. Put basic controls in place, such as multi-factor authentication, tested backups and staff training, which insurers ask about and which reduce the chance of a claim. Check whether the policy covers social engineering and funds transfer fraud, supply-chain events and business interruption. And review cover each year, as the threats and prices are changing.

For the industry, the combination of falling rates, rising severity and low penetration among small firms is both a risk and an opportunity. Closing the small-business gap would grow the market, but doing so profitably will depend on simple products, better distribution and pricing that reflects the losses recorded.