Cyber Insurance Statistics 2026: Cost, Claims and What Vendors Must Carry
By ClauseAudit Research · 10 sources ·
What do the latest cyber insurance statistics show?
Cyber insurance is getting cheaper to buy while claims keep climbing. U.S. direct written premium fell 7% to $9.14 billion in 2024, the first drop on record, yet reported claims rose almost 40% to nearly 50,000. The median paid claim is $83,000, and U.S. cyber rates slipped 2% in Q2 2026.
- U.S. cyber insurance direct written premium in 2024, down 7% from 2023 (2024, National Association of Insurance Commissioners (NAIC))
- $9.14 billion
- U.S. cyber insurance policies in force in 2024, essentially flat year over year (2024, National Association of Insurance Commissioners (NAIC))
- 4,368,614
- Rise in U.S. cyber insurance claims reported in 2024, to nearly 50,000 (2024, National Association of Insurance Commissioners (NAIC))
- Almost 40%
- Median financial impact of paid U.S. cyber insurance claims; top 10% exceeded $920,000 (Incidents Jan 1, 2019 to Oct 31, 2025, Verizon Business)
- $83,000
- Change in U.S. cyber insurance rates in Q2 2026, same as prior quarter (Q2 2026, Marsh)
- -2%
- Business email compromise losses reported to the FBI in 2025 (2025, Federal Bureau of Investigation, Internet Crime Complaint Center)
- $3.05 billion
- Share of cyber claim costs from large companies, which filed 3% of claims (Incidents 2021 to 2025, NetDiligence)
- 56%
- Global average cost of a data breach, up 12% and a record high (2026 report, IBM and Ponemon Institute)
- $4.99 million
Cyber insurance used to be the policy nobody could get a straight price on. Now the market is softer. Total premium shrank for the first time on record and rates keep easing.
The claims side tells a different story. More businesses are filing, email fraud drives a big share of claims, and the bill for a bad week can wipe out months of profit for a small firm. Below is what the numbers mean for you, and what to check in the contracts that decide who pays when a vendor gets hacked.
U.S. cyber insurance direct written premium, 2020 to 2024 (USD billions)
Chart data
| Label | Value (USD billions) |
|---|---|
| 2020 | $4.07B |
| 2021 | $6.54B |
| 2022 | $9.69B |
| 2023 | $9.84B |
| 2024 | $9.14B |
Premium more than doubled from $4.07B in 2020 to $9.84B in 2023, then fell to $9.14B in 2024. That dip reflects lower prices, not fewer buyers.
Download this chart (PNG)U.S. cyber insurance policies in force, 2019 to 2024
Chart data
| Label | Value |
|---|---|
| 2019 | 3,314,005 |
| 2020 | 4,019,428 |
| 2021 | 3,747,986 |
| 2022 | 3,913,123 |
| 2023 | 4,369,741 |
| 2024 | 4,368,614 |
Policies in force barely moved, from 4,369,741 in 2023 to 4,368,614 in 2024. Roughly the same number of policies brought in less premium, which is what a softening market looks like.
Download this chart (PNG)Median paid cyber insurance claim impact by company size (U.S.) (USD)
Chart data
| Label | Value (USD) |
|---|---|
| SMB (under $25M revenue) | about $38,000 |
| Mid-market ($25M to $250M) | about $96,000 |
| Large enterprise (over $250M) | about $283,000 |
A typical small business claim is about $38,000, while large enterprises sit near $283,000. For a firm with thin margins, the smaller number can still hurt more.
Download this chart (PNG)Top 10 U.S. cyber insurer groups by direct written premium, 2024 (USD millions)
Chart data
| Label | Value |
|---|---|
| Chubb Ltd Group | $560.6M |
| St Paul Travelers Group | $535.4M |
| Fairfax Financial | $360.6M |
| Tokio Marine Holding | $356.0M |
| AXA Insurance Group | $340.4M |
| Arch Insurance Group | $285.0M |
| At-Bay Specialty Insurance Group | $280.6M |
| American International Group | $276.6M |
| Sompo Group | $262.7M |
| Starr Group | $255.1M |
Chubb led with $560.6M in premium, followed closely by St Paul Travelers Group at $535.4M. The top 10 groups wrote about half of this premium (49.62%, excluding alien surplus lines), so a vendor's certificate may well name one of these carriers.
Download this chart (PNG)Cybercrime losses reported to the FBI (IC3), 2020 to 2025 (USD billions)
Chart data
| Label | Value (USD billions) |
|---|---|
| 2020 | $4.2B |
| 2021 | $6.9B |
| 2022 | $10.3B |
| 2023 | $12.5B |
| 2024 | $16.6B |
| 2025 | $20.877B |
Losses reported to the FBI climbed every year, from $4.2B in 2020 to $20.877B in 2025. These are reported losses across all crime types, not insured losses, but the direction is hard to miss.
Download this chart (PNG)Cyber insurance market size: U.S. and global
| Measure | Value | Period | Source |
|---|---|---|---|
| U.S. direct written premium (incl. alien surplus lines) | $9,143,618,143 | 2024 | NAIC |
| U.S. direct written premium, U.S.-domiciled insurers only | $7,082,935,371 | 2024 | NAIC |
| North America cyber premium | USD 10.6bn (69% of global) | 2024 | Munich Re |
| Global cyber insurance market | Nearly USD 15bn | 2025 | Munich Re |
| Global cyber premium forecast | Around USD 28bn | 2030 (forecast) | Munich Re |
| Global cyber insurance rate change | -4% (12th straight quarterly decline) | Q2 2026 | Marsh |
Source: National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025 edition, 2024 data); Munich Re, Cyber Insurance: Risks and Trends 2025; Munich Re, Global Cyber Risk and Insurance Survey 2026; Marsh, Global commercial insurance rates fall 6% in Q2 2026; marks eighth consecutive quarterly decline. Download as image
U.S. cyber insurance by policy structure, 2024
| Policy structure | Share of premium | Share of policies in force | Claim closure rate |
|---|---|---|---|
| Primary (stand-alone) | 65% | 41.6% | 83.93% |
| Excess | 31% | 3.3% | 76.84% |
| Endorsement to another policy | 4% | 55.1% | 91.52% |
| Total | 100% | 100% | 82.05% |
Source: National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025 edition, 2024 data). Download as image
U.S. cyber insurance claims closed with and without payment, 2024
| Policy structure | Closed with payment | Closed without payment |
|---|---|---|
| Primary | 8,838 | 16,422 |
| Excess | 514 | 10,802 |
| Endorsement | 589 | 1,331 |
| Total | 9,941 | 28,555 |
Source: National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025 edition, 2024 data). Download as image
What drives cyber insurance claims: recent insurer and FBI data
| Statistic | Value | Period | Source |
|---|---|---|---|
| Claims from business email compromise and funds transfer fraud | 58% of all claims | 2026 report (2025 claims) | Coalition |
| Average initial ransom demand | Over $1M (up 47%) | 2026 report (2025 claims) | Coalition |
| Ransomware victims that refused to pay | 86% | 2026 report (2025 claims) | Coalition |
| Business email compromise losses reported to FBI | $3,046,598,558 | 2025 | FBI IC3 |
| Ransomware complaints reported to FBI | 3,611 | 2025 | FBI IC3 |
| Claims analyzed / share from SMEs (<$2B revenue) | 10,309 / 97% | Incidents 2021 to 2025 | NetDiligence |
Source: Coalition, Inc., 2026 Cyber Claims Report; Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report); NetDiligence, NetDiligence Releases 2026 Cyber Claims Study. Download as image
How much does cyber insurance cost in 2026?
Premiums depend on your revenue, industry, security controls and claims history, so a single national average price tells you very little. What the data does show is direction, and the direction favors buyers.
Marsh reported U.S. cyber rates fell 2% in Q2 2026, matching the prior quarter. Globally, Marsh reported a 4% drop, the twelfth straight quarterly decline. Total U.S. premium fell 7% to $9.14 billion in 2024 even though the number of policies stayed flat. Put simply, about the same number of policies cost less in total.
That gives you room at renewal. If your premium went up last year with no claims and no change in your business, ask your broker to market the policy. Showing multi-factor authentication, backups and email controls can help you earn a better quote.
Why is cyber insurance getting cheaper while claims rise?
It looks backwards. Claims jumped almost 40% in 2024, losses reported to the FBI hit $20.877B in 2025, and yet prices keep easing. A few things explain the gap.
Insurers raised prices hard a few years ago and tightened what they would cover. Premium went from $4.07B in 2020 to $9.84B in 2023. Many buyers had to prove basic security, such as multi-factor authentication and offline backups, just to get a quote. Those requirements left insurers with a pool of better-protected customers to compete for.
Competition does the rest. The top 10 insurer groups wrote only about half of the premium in the NAIC's group rankings, and the leader, Chubb, held under 8%. No single carrier sets the price. When many insurers want the same clean accounts, rates drift down even as claim counts climb.
For you, the lesson is to read the policy, not just the price. Any renewal can change the wording, the retention or the sublimits on the exact losses that hit small firms most. A cheaper renewal that quietly halves your fraud coverage is not a bargain.
How often do cyber insurance claims get paid?
Claims are rising fast. U.S. insurers saw almost 40% more claims in 2024, with nearly 50,000 reported. That is a lot of businesses learning, in the worst week of their year, what their policy actually covers.
Here is the part most owners miss. In 2024, 9,941 U.S. cyber claims closed with payment and 28,555 closed without one. Excess policies account for 10,802 of the unpaid closures, which makes sense, since an excess layer pays only after the primary policy is used up. Other claims can close without payment because the loss was under the deductible, the notice was precautionary, or the claim ran into an exclusion or a condition the business did not meet.
Email fraud is the big driver. Coalition found that business email compromise and funds transfer fraud made up 58% of its claims, and the FBI recorded $3.05 billion in business email compromise losses in 2025. If your policy caps social engineering at a small sublimit, the coverage you rely on most may be the thinnest part of it.
How much does a cyber incident cost a small business?
The median paid U.S. cyber claim is $83,000, based on incidents from 2019 through October 2025. That median rose from roughly $60,000 in 2019 to roughly $110,000 in 2024, so the typical hit is getting bigger, not smaller.
Size matters. Small businesses under $25M in revenue had a median paid impact of about $38,000, mid-market firms about $96,000, and large enterprises about $283,000. The tail is long: the top 10% of paid claims exceeded $920,000.
Large companies with $2 billion or more in revenue filed just 3% of claims but accounted for 56% of claim costs in the NetDiligence data. Companies under $2 billion in revenue filed the other 97%, and each of those claims costs less in dollars. For a ten-person agency or a solo consultant, though, a $38,000 loss can be the difference between a good year and a loan.
What cyber insurance should a vendor carry?
There is no single legal minimum. The right limit depends on what the vendor touches. A bookkeeping app holding your client records is a very different risk from a logo designer who never logs into your systems.
Start with your exposure, not a round number. Ask what it would cost you if this vendor leaked your data or let a fraudster into your email: notifying customers, forensic work, downtime and lost deals. Then compare that figure to the vendor's liability cap and its insurance limit. If the cap is one month of fees and the vendor carries little coverage, you are self-insuring their mistakes.
Watch the policy type too. Endorsements tacked onto another policy made up 55.1% of U.S. cyber policies in force in 2024 but only 4% of premium. A cheap add-on often lacks the limits or breadth of a stand-alone cyber policy, so ask which one the vendor has.
- Ask for a certificate of insurance that shows a cyber or technology errors and omissions policy, the carrier, the limit and the policy dates.
- Confirm the policy covers third-party claims, meaning claims from you and your customers, not just the vendor's own costs.
- Ask whether social engineering and funds transfer fraud are covered, and at what sublimit.
- Require notice if the policy is cancelled or the limit drops during the contract.
What to do if you are the one being asked to carry it
Insurance clauses are not just for big vendors. Picture this: a client asks for a cyber policy with a limit you have never priced, and the deadline is Friday.
Do not sign a requirement you cannot meet. Call a broker first and get a quote at the limit requested. If the cost is out of proportion to the job, propose a lower limit tied to what you actually handle, or ask the client to narrow your access so the risk matches the coverage. Then check that your indemnity promise is not bigger than your policy. A contract that makes you liable for all breach losses, uncapped, while your coverage stops at a fixed limit leaves you holding the gap personally.
How ClauseAudit helps
Cyber insurance only pays what the policy covers. The contract decides who has to pay in the first place. An automated review of your SaaS or vendor agreement flags the clauses that move breach costs onto you.
Upload the agreement and you get plain-English notes on each risky term, with suggested wording to ask for before you sign.
- Liability cap: whether data breaches are carved out of a low cap, such as one month of fees
- Insurance clause: whether the vendor must carry cyber coverage, at what limit, with proof on request
- Indemnification: who pays third-party claims after a breach, and whether that promise is capped
- Breach notice: how fast the vendor must tell you about a security incident
- Security standards: whether certifications like SOC 2 are promised in the contract or only on the website
- Data on termination: that the vendor returns and deletes your data when the contract ends
Frequently asked questions
How big is the U.S. cyber insurance market?
U.S. cyber insurance direct written premium was $9.14 billion in 2024, according to the NAIC. That figure includes alien surplus lines carriers. It was the first decline on record, down 7% from 2023, while the number of policies in force stayed essentially flat at 4,368,614.
Are cyber insurance rates going up or down in 2026?
Down. Marsh reported its clients' U.S. cyber rates fell 2% in Q2 2026, the same as the prior quarter, and global cyber rates fell 4%, the twelfth straight quarterly drop. Your own renewal can still rise if you had a claim, grew fast or have weak security controls, so shop the policy if it does.
What is the average cyber insurance claim?
The median paid U.S. cyber insurance claim is $83,000, based on incidents from 2019 through October 2025 in Verizon's Breach Impact Study. Small businesses under $25M in revenue had a median of about $38,000. The top 10% of paid claims went above $920,000, so averages can hide a very long tail.
Why are so many cyber claims closed without payment?
In 2024, 28,555 U.S. cyber claims closed without payment against 9,941 closed with payment. Reasons vary. Some incidents fall under the deductible or turn out to be minor. Others run into exclusions, low sublimits, or conditions the business did not meet, such as security controls it said it had on the application.
What causes most cyber insurance claims?
Email fraud leads. Coalition found business email compromise and funds transfer fraud made up 58% of its claims. The FBI recorded $3.05 billion in business email compromise losses in 2025, the second-largest loss category after investment fraud. A fake invoice or changed bank details is far more common than a movie-style hack.
Do small businesses need cyber insurance?
If you hold customer data, send or receive payments by email, or depend on software to operate, it is worth pricing. The median paid claim for businesses under $25M in revenue is about $38,000. For a small firm, that can be months of profit. Some clients also require it in their contracts.
How much cyber insurance should I require from a vendor?
Base it on what the vendor can access. Estimate what a leak or fraud through that vendor would cost you, then compare it to their liability cap and insurance limit. Ask for a certificate showing a stand-alone cyber or tech errors and omissions policy, and check whether social engineering fraud is covered.
Does a data breach cost more than the insurance claim?
It can. IBM put the global average cost of a data breach at $4.99 million in its 2026 report, a record high. That figure includes costs a policy may not cover, like lost customers and staff time. Insurance helps, but your contracts decide whether a vendor shares the bill.
Use this data
Every chart and card below is free to reuse under CC BY 4.0. Download what you need and link back to this page.
Stat cards
Key findings card
Infographic
U.S. cyber insurance direct written premium, 2020 to 2024 (USD billions)
U.S. cyber insurance policies in force, 2019 to 2024
Median paid cyber insurance claim impact by company size (U.S.) (USD)
Top 10 U.S. cyber insurer groups by direct written premium, 2024 (USD millions)
Cybercrime losses reported to the FBI (IC3), 2020 to 2025 (USD billions)
Cyber insurance market size: U.S. and global
U.S. cyber insurance by policy structure, 2024
U.S. cyber insurance claims closed with and without payment, 2024
What drives cyber insurance claims: recent insurer and FBI dataEmbed the infographic
Free to share on your site, blog or slides under CC BY 4.0. Please keep the credit link.
Sources and method
Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. Figures that could not be confirmed were left out.
- National Association of Insurance Commissioners (NAIC), Report on the Cybersecurity Insurance Market (2025 edition, 2024 data) (November 2025 (covers 2024 annual statement data))
- Verizon Business, 2026 Breach Impact Study (June 2026 (2026 edition))
- Marsh, US insurance rates (Global Insurance Market Index, Q2 2026) (July 22, 2026 (Q2 2026))
- Marsh, Global commercial insurance rates fall 6% in Q2 2026; marks eighth consecutive quarterly decline (July 23, 2026)
- Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 IC3 Annual Report (Internet Crime Report) (April 2026 (2025 edition))
- NetDiligence, NetDiligence Releases 2026 Cyber Claims Study (September 15, 2026 (2026 study))
- IBM and Ponemon Institute, Cost of a Data Breach Report 2026 (2026 edition)
- Coalition, Inc., 2026 Cyber Claims Report (2026 edition (claims across 100K+ global policyholders))
- Munich Re, Global Cyber Risk and Insurance Survey 2026 (2026 edition)
- Munich Re, Cyber Insurance: Risks and Trends 2025 (2025 edition (2024 premium data))
Cite this page
ClauseAudit, “Cyber Insurance Statistics 2026: Cost, Claims and What Vendors Must Carry”, updated October 18, 2026, https://clauseaudit.com/data/cyber-insurance-statistics. Free to reuse with a link back (CC BY 4.0).
This page summarises published data and law as checked on October 18, 2026. Figures are updated as new editions are released, and your own situation may differ. It is general information, not legal, tax or financial advice.