A few years ago, cyber insurance was something most business leaders filed under “nice to have”, a product for large corporations with legal teams and dedicated risk managers. In 2026, that perception has shifted dramatically. High-profile breaches at household names have underscored that no organisation is too big or too small to be targeted. Increasingly, businesses are discovering that without cyber insurance, the financial fallout from even a single incident can be devastating.
But cyber insurance isn’t a magic safety net. The market has matured rapidly, and insurers have tightened their requirements significantly. Simply having a policy doesn’t mean you’re covered, and finding that out after an incident is a very expensive lesson.
The Scale of the Risk and the Gap in Protection
The global cyber insurance market was valued at $26.25 billion in 2025 and is projected to grow from $33.05 billion in 2026 toward $223 billion by 2034. The numbers reflect a market responding to a genuine and growing need. Claims frequency jumped nearly 40% in 2024, with nearly 50,000 US claims reported, even as premiums fell.
But despite the evident risk, the protection gap is stark. Only 10–20% of SMEs carry cyber insurance, compared to 80% of large corporations. In the UK, research from GlobalData suggests that just over 40% of UK SMEs currently hold cyber insurance, compared with 63% of medium-sized firms and around 70% of FTSE 100 companies.
That gap is particularly troubling given where the attacks are landing. SMEs account for roughly 98% of all claims by volume. In other words, smaller businesses are getting hit most often, yet they are the least likely to have cover in place.
What Cyber Insurance Actually Covers
This is where many business owners get unstuck. Cyber insurance policies vary considerably, and the devil is in the detail.
Most comprehensive policies cover some combination of incident response costs, business interruption losses, data breach notification and management, ransomware payments and recovery, legal liability, and regulatory fines.
60% of all cyber insurance claims originated from Business Email Compromise and Funds Transfer Fraud, not ransomware. Yet ransomware remains the most destructive in terms of cost. According to
Allianz, ransomware accounts for 60% of the value of large claims, those over €1 million.
One critical caveat is that not all policies cover social engineering attacks, such as phishing. If a member of your team is tricked into transferring funds to a criminal, that may fall outside standard cover unless you have specifically included social engineering endorsements.
Read the exclusions as carefully as you read the coverage.
What Insurers Now Require From You
The days of filling in a simple form and getting covered are over. As the market has matured, insurers have significantly raised the bar on what they expect policyholders to have in place before they will offer cover and before they will pay a claim.
Insurers now demand proof of multi-factor authentication, incident response planning, and stronger cybersecurity controls alongside increasingly stringent cyber insurance policies. Failing to maintain these controls during the policy period, not just at the beginning of the policy, may result in a claim being denied.
Common requirements now include:
- Multi-factor authentication across critical systems
- Endpoint detection and response tools
- Regular staff security awareness training
- Tested backups with offline or immutable copies
- A documented and tested incident response plan
- Privileged access management controls
The relationship between your cybersecurity posture and your insurability is now direct and measurable. A weaker security posture does not just put you at greater risk. It can result in higher premiums, lower coverage limits, and potentially no cover at all for the highest-risk scenarios.
The Premium Picture in 2026
The cyber insurance market has been through a fascinating cycle. After years of rapid premium growth driven by the ransomware surge, prices softened significantly in 2023 and 2024 as more capacity entered the market and insurers competed aggressively for business.
After three consecutive years of downward pressure, rates are heading towards relatively stable levels in 2026.
For businesses renewing policies this year, the practical implication is that pricing is relatively stable, but coverage scrutiny is not. Insurers are underwriting more carefully, asking harder questions, and in some cases excluding specific risks, such as nation-state attacks or unpatched legacy systems, that they may previously have covered without question.
Cyber Insurance Is Not a Substitute for Cybersecurity
This is perhaps the most important point of all, and one that insurers themselves are increasingly vocal about.
Cyber risk management needs to be holistic, integrated, and reviewed on an ongoing basis. Insurance compensates for loss. It does not prevent an attack, reduce downtime, protect your reputation, or stop the operational chaos that can follow a major incident.
The businesses that fare best after a cyber incident are those that combine strong preventive security with appropriate insurance cover.
The insurance pays for the recovery. The security reduces the likelihood of needing it and determines how quickly you can get back on your feet when you do.
Think of it the same way you would think of car insurance. You buy it because accidents happen. But you still drive carefully, maintain the vehicle, and wear a seatbelt.
One without the other is an incomplete strategy.
Getting the Right Cover
For businesses that do not yet have cyber insurance, or are approaching renewal, here are the practical steps to take.
Audit Your Current Security Controls
Understand what you have in place before approaching insurers. Gaps will be identified during underwriting, and addressing them proactively puts you in a stronger position.
Work With a Specialist Broker
Cyber insurance policy language varies significantly. A broker who specialises in cyber risk can help you compare policies properly and understand what you are actually buying.
Don’t Underestimate Your Coverage Needs
More than 70% of SMEs have coverage limits that fall below £1 million, despite the fact that the cost of downtime and data breaches has increased substantially.
Make sure your coverage limits reflect your actual risk exposure.
Review Your Policy Annually
Your risk profile changes as your business grows, adopts new technology, or enters new markets. A policy that was right twelve months ago may leave significant gaps today.
Cyber insurance has moved from niche to necessity. The question for most businesses in 2026 is not whether to get it. It is whether what they have, or do not have, will actually protect them when they need it most.
Want Help Assessing Your Cybersecurity Posture Before Approaching Insurers?
Our team can help you assess your cybersecurity posture and understand what controls you may need to strengthen before approaching insurers or renewing your cover. Get in touch today.