Enterprises in regulated industries often carry cyber insurance policies because contracts require it or boards ask for documented risk transfer. The global market for these policies reached about $16 billion in premiums in 2024. Coverage has become widespread. Payouts have grown less predictable.

The gap between exposure and coverage

The Global Federation of Insurance Associations, which represents insurers accounting for close to 90 percent of premiums worldwide, quantified the cyber protection gap at about $900 billion in a 2023 report, with annual economic losses from cyber incidents exceeding that figure. A 2024 white paper from Marsh McLennan and Zurich Insurance Group amplified those findings and called for public-private action to close the gap. The Global Federation of Insurance Associations reached similar conclusions independently, describing insured losses as covering only a small share of annual global cyber losses.

The US cyber market contracted in premium volume for the first time on record, driven by eleven consecutive quarters of rate decreases. Excess capacity has pulled prices down even as reported losses have climbed.

The underwriting bargain

Applications for cyber coverage run long. Some questionnaires now include more than fifty items covering multifactor authentication, backup practices, endpoint detection, patching cadence, and incident response testing. Answers become legal representations. A control that lapses after binding, or a partial deployment described as universal, can shift a later claim into dispute.

“Cyber insurance has a legitimate role, but it is not a control plane, a trust model, or a resilience strategy. It is a residual-risk financing tool,” Dr. Chase Cunningham, a former NSA analyst who publishes analysis under the DrZeroTrust name, told Help Net Security.

Denials cluster around recurring themes. Independent analyses place the denial rate for cyber claims between 40 and 44 percent. Cases hinge on misrepresentation, lapses in required controls, and application answers signed off by staff without deep technical understanding of the attestations.

Exclusions carved out of catastrophe

Merck’s litigation over NotPetya damages, which the company put at roughly $1.4 billion, tested the war exclusion in “all risks” property policies and produced a New Jersey appellate ruling favoring the pharmaceutical company in May 2023. The case settled confidentially in January 2024. Lloyd’s of London had already moved in the same direction, issuing a market bulletin in August 2022 that required standalone cyber policies to explicitly exclude state-backed attacks from March 31, 2023 onward, with four model clauses offering different levels of restriction.

Social engineering sits in a similar zone. Standard policies often exclude these events entirely or cap payouts at $250,000, a figure that sits well under the average loss for this attack type.

Systemic risk and public policy

Lloyd’s scenario modeling has estimated that a major attack on global financial services payment systems could cost the world economy roughly $3.5 trillion. That figure sits far above the total premiums the entire cyber insurance market collects each year.

Cunningham sees room for a federal cyber backstop along the lines of the Terrorism Risk Insurance Act, with conditions attached. “I think a federal cyber backstop is worth exploring for truly catastrophic systemic cyber events, but only if it is designed as a last-resort resilience mechanism, not as a subsidy for weak security,” he said. He argues that eligibility should require minimum controls tied to NIST CSF and CISA’s Cybersecurity Performance Goals, with evidence-based proof, and that both insurers and policyholders should retain meaningful exposure so taxpayers avoid underwriting preventable negligence.

Guidance for mid-market buyers

Mid-market companies without a dedicated CISO or in-house counsel often lean on brokers to interpret cyber risk. Cunningham recommends a wider circle. “I would tell them to build a small advisory triangle around the insurance process: a cyber-specialist broker, an independent technical advisor or fractional CISO, and outside counsel who understands cyber coverage and breach response,” he said.

He points to CISA’s Cybersecurity Performance Goals and NIST’s small business cybersecurity materials as starting baselines. On broker credentials, he lists PLUS cyber-liability training, RPLU, CPLP, The Institutes’ Associate in Cyber Risk Management, CPCU, ARM, CRM, and CIC as useful screening signals. Claims experience matters as much as any credential.

One question, he says, tends to reveal the difference. “How many cyber claims have you helped manage?” A surface advisor asks about limits, revenue, and MFA. A serious advisor probes where MFA is enforced, who holds privileged access, how backups are protected, when the last restore occurred, and what sub-limits apply to social engineering and business interruption.

Coverage decisions carry legal weight the day a questionnaire is signed. Application answers become the record insurers reference when a claim arrives, and the gap between advertised limits and payable amounts often traces to sublimits, waiting periods, exclusions, and control representations written before an incident. Resilience work sits upstream of any policy. Insurance follows the security program that produced it.

As cyber threats evolve, so must the insurance industry's approach to underwriting and claims. The Global Federation of Insurance Associations has called for better data sharing between insurers and policyholders to improve risk assessment. Some carriers now offer usage-based policies that adjust premiums based on real-time security posture, but adoption remains low due to privacy concerns and integration challenges. The denial rate of 40-44% highlights a fundamental disconnect between what policyholders think they have purchased and what insurers are obligated to pay. This is exacerbated by the complexity of modern attacks and the increasing use of ransomware combined with data theft, which blurs the lines between traditional property and casualty coverage.

In the wake of the SolarWinds and Colonial Pipeline incidents, the U.S. government has actively encouraged the adoption of baseline cybersecurity measures through initiatives like the CISA Cybersecurity Performance Goals and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. These frameworks are not just guides for security teams; they are increasingly becoming the yardstick by which insurers evaluate risk. A company that can demonstrate adherence to these controls may secure better terms, while those that cannot face higher premiums or outright declination.

The future of cyber insurance will likely see more collaboration between the public and private sectors, as highlighted by Cunningham's backstop proposal. But until then, buyers must do their homework. The advice from Dr. Cunningham to form an advisory triangle is not just helpful—it is essential for mid-market firms navigating a market where the fine print can mean the difference between survival and a catastrophic uncovered loss. The key takeaway: insurance is a financial contract, not a security strategy. The best policy is the one written after a thorough risk assessment and with the guidance of experts who understand both the technical and legal dimensions of cyber risk.

Source:Help Net Security News