Cyber insurance premiums fall despite rising ransomware attacks

• Future of cyber insurance is bright, with a strong focus on prevention, risk management, and incentivised security measures that will contribute to a safer digital landscape for all.
• The increased competition in the market is leading to more competitive premiums.
• Companies are increasingly using cloud providers and other robust backup systems to minimise downtime and financial losses.
• More than half of the premium growth by 2030 is anticipated to come from outside the US.

The global cyber insurance market is experiencing a paradoxical trend: premium rates are declining even as ransomware attacks surge.

The counterintuitive development, as highlighted in a recent report by broker Howden, is driven by a confluence of factors, primarily a growing awareness of cybersecurity risks and proactive measures taken by businesses to mitigate their exposure.

The past two years saw a meteoric rise in cyber insurance premiums, fueled by the surge in cyber incidents during the COVID-19 pandemic.

However, the tide has turned in 2023 and 2024, with double-digit price reductions being observed across the market. This shift is attributed to a number of factors.

Businesses are taking a more proactive approach to cybersecurity, investing in robust security measures and training their staff to combat cyber threats. The adoption of multi-factor authentication (MFA), likened to “locking the door when you leave the house” by Howden’s Sarah Neild, has significantly reduced data breaches and subsequent insurance claims.

The increased vigilance and investment in security infrastructure are key drivers behind the reduced need for insurance coverage.

A more resilient landscape

Insurers are increasingly willing to offer cyber insurance, driven by the growing demand for coverage and their confidence in the ability of businesses to manage cyber risks. The increased competition in the market is leading to more competitive premiums.

The report stated that the war in Ukraine, while initially contributing to a decrease in ransomware attacks as hackers redirected their efforts to military targets, has also raised concerns about global cyber security and has prompted increased investment in cybersecurity measures across the private sector, leading to a more resilient landscape.

Despite the global decrease in ransomware attacks in 2022, the first five months of 2024 saw an 18 per cent increase in recorded incidents. While this rise is concerning, it has not translated into a significant spike in insurance claims due to the proactive steps businesses have taken to mitigate the impact of such attacks.

Growing awareness

The report emphasises that business interruption remains the most significant cost following a cyberattack.

However, companies are increasingly using cloud providers and other robust backup systems to minimise downtime and financial losses. These measures, coupled with enhanced cybersecurity, are reducing the need for significant insurance payouts.

While the United States dominates the cyber insurance market, accounting for two-thirds of the global share, the fastest growth in the coming years is expected to come from Europe. This is primarily driven by lower current penetration levels and a growing awareness of cyber risks.

Smaller businesses in particular, who are often less aware of their vulnerability, are being targeted by insurers and are starting to see the value of cyber insurance.

The report highlights a crucial finding: 76 per cent of companies have enhanced their cybersecurity measures specifically to qualify for cyber insurance coverage. This demonstrates the power of insurance as an incentivizing force, encouraging businesses to invest in their security and reduce their overall risk profile.

While the US remains the dominant force in the cyber insurance market, the report predicts that over half of premium growth by 2030 will come from outside the US. European markets, with their increasing penetration rates, hold significant potential for growth.

Related Posts:

• Continued shift to cloud unlocks more investments
• Cybersecurity should be treated as a “business investment”