Global Cyber Insurance Premiums Soften in 2026 as War Risks Test Coverage Limits

The global cyber insurance market presents a study in contrasts in 2026: premiums are softening even as underlying demand and total market volume continue to grow, and insurers are grappling with how to structure coverage for an increasingly systemic and correlated risk. According to industry analysis, average cyber premiums are expected to fall roughly 11% in 2026 due to intense insurer competition, even as the total global market is projected to reach between $23 billion and $33.4 billion, up from approximately $15.3 billion in 2025.

A central concern dominating industry discussion is the structure of cyber coverage itself. Trium CEO Josh Ladeau warned that enterprise clients which require their vendors to carry cyber insurance are often relying on policy limits that are shared with dozens of other customers — a structure that creates a 'false sense of financial security' and breaks down precisely when it is needed most, during aggregated loss events where a single incident triggers simultaneous claims across many policyholders. This aggregation risk is the defining underwriting challenge of the cyber market.

The scale of the threat is underscored by industry leaders. USAA chief executive Juan Andrade called cyberattacks 'one of the most existentialist threats' facing the industry today, noting his company blocked eight billion intrusions last year as AI gives adversaries new tools to find vulnerabilities. At the same time, AI is reshaping the underwriting side: insurtechs are launching AI underwriting agents that learn an individual carrier's book and appetite, while the EU AI Act is requiring AI claims-handling systems to maintain human oversight.

Despite the challenges, insurers continue to expand capacity. Pen Underwriting announced it will double its UK cyber cover limit to £10 million ($13.3 million) for small and medium-sized enterprises with revenue up to £600 million from July 1, 2026. The broader context includes mounting regulatory pressure: the EU's Digital Operational Resilience Act (DORA), the US Cyber Incident Reporting for Critical Infrastructure Act, and growing recognition that, in the words of one widely cited estimate, cybercrime would rank as the world's third-largest economy if measured as a nation. The recent 23andMe breach settlement, largely funded by cyber insurance, has provided a real-world demonstration of how the market responds to large-scale incidents.