Global Cyber Insurance Premiums to Fall ~11% in 2026 Despite Rising Attack Frequency

The global cyber insurance market is experiencing a striking paradox in 2026: even as cyberattacks grow more frequent and sophisticated, average premiums are expected to decline by roughly 11% due to intense competition among insurers. This softening market dynamic, highlighted in industry analyses including data referencing Munich Re and S&P Global, reflects a maturing market where abundant capacity and improved underwriting are driving prices down — a welcome development for buyers but a profitability challenge for carriers.

Munich Re estimates the global cyber insurance market reached approximately $15 billion in premiums in 2025, growing 7% year-on-year, with projections for the market to expand at an average annual rate exceeding 10% through 2030 to reach around $28 billion. Other forecasts place 2026 global market premiums in the $23 to $33 billion range. North America accounts for nearly 70% of global premiums, making it the dominant region in the cyber insurance landscape.

The pricing softening is driven by several factors. After years of sharp premium increases following a wave of major ransomware losses, the market has attracted substantial capital, including from traditional reinsurers and alternative sources such as cyber catastrophe bonds. Improved cyber hygiene among policyholders — better backups, incident response plans, and security controls — has reduced loss frequency and severity, supporting more stable underwriting results. AM Best has maintained a Stable outlook on the global cyber insurance sector, citing strong demand and sustained profitability despite the competitive pressure.

However, the picture is not uniform. While most businesses are seeing flat or declining rates, high-risk industries such as healthcare and certain sectors still face single-digit increases. Claims data from MGAs like Cowbell shows ransomware attacks rose roughly 45% in 2025, even as average payments fell — a sign that attack frequency and insurer pricing are diverging. Regulatory mandates, including the EU's DORA and the US CIRCIA 72-hour incident reporting requirement (effective May 2026), continue to drive adoption. For buyers, the softening market and improving terms make 2026 an opportune time to secure or expand coverage. For insurers, the challenge is maintaining underwriting discipline and managing correlated, systemic cyber risk in an increasingly competitive environment.