Cheap Cyber Insurance Has Never Been More Expensive
Cyber insurance rates have now fallen four years in a row, down roughly 5% year to date in 2026 after a 13% drop in 2025, according to Insurance Journal. If you’re renewing a policy this quarter, congratulations, you have the upper hand on price.
Now the bad news. Over that same period, average claim severity for large US businesses more than doubled, past $4.4 million in 2025, even as claim frequency fell 34%. The Chubb data behind that number tracks with everything else in the threat picture, where ransomware appeared in 48% of confirmed breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), a 44% jump over the prior year.
This is the cheapest cyber coverage has been to buy and the hardest it has ever been to collect on. Buyers budget for the premium and assume the claim takes care of itself, and that habit stopped working. The reasons why are worth understanding before your Q4 renewal lands.
Proof Replaced Promises
The cyber application used to be paperwork where you answered a questionnaire, someone typed “yes” next to multi-factor authentication (MFA), and the carrier quoted you a price. A lot of CISOs have spent the past few years admitting out loud that those questionnaires “ask the wrong questions and get the wrong answers,” which may now have come back to bite those same CISOs.
Carriers responded by checking. Outside-in technical scans run before quotes go out, so underwriters can see your exposed Remote Desktop Protocol (RDP) ports, your public email-authentication records (SPF, DKIM, and DMARC), and whether your endpoint detection and response (EDR) agents are live, all without asking you anything. Continuous monitoring between policy terms is spreading too, meaning the controls you attested to in October might get re-verified the following April while nobody tells you. The penalty isn’t a higher rate anymore. It’s rescission, or a claim that never gets paid.
Of roughly 38,500 closed US cyber claims in 2024, about three-quarters closed without a payout, according to the National Association of Insurance Commissioners’ (NAIC) 2025 Cybersecurity Insurance Report. Not all of those are denials, but the figure undercuts any assumption that a claim pays itself.
Courts have gone along with it. In Travelers Property Casualty Co. v. International Control Services (C.D. Ill. 2022), an applicant swore to enterprise-wide MFA, forensics found it deployed on the firewall and nowhere else. Travelers sued for rescission, and ICS agreed to void the policy from inception rather than fight it. Treat the application like a disclosure document now, because every “yes” is a warranty someone might audit after an incident.
What Carriers Now Demand
The Three Gates
Miss any of these and you’re shopping surplus lines at multiples of standard pricing, or not shopping at all.
| Control gate | What passes in 2026 | The artifact that proves it |
|---|---|---|
| Multi-factor authentication | Remote access, email, and privileged accounts; SMS no longer counts for privileged logins | Identity provider enrollment report |
| Endpoint detection and response | Every managed endpoint and server, with monitoring behind it, not just installed | EDR console coverage export |
| Backups | Immutable, isolated from attacker-reachable storage, restore-tested | Dated restore-test log |
Carriers have stopped asking whether you have a control and started asking for your deployment percentage.
A control that covers 85% of your fleet is a coverage gap with a security logo on it.
The Premium Tier
Beyond the gates sits the tier that moves your number, and it grows every renewal cycle.
- Privileged access management, including separated admin accounts and no standing access that can’t be justified
- Email authentication records set to quarantine or reject, not the “none” policy that collects dust
- A written incident response plan, tested in a tabletop exercise inside the past twelve months
- Patch management with real deadlines, roughly fourteen days for workstations and shorter for internet-facing systems
- Training with completion records, plus phishing simulations
- Vendor access reviews, because your cleaning company’s managed service provider (MSP) is your attack surface now
One stat explains why backups earned that gating status. Only 28% of ransomware victims made on-chain payments in 2025, a record low according to Chainalysis’s 2026 crypto crime analysis, while Verizon’s 2026 DBIR found 69% of victims declined to pay outright. Those two figures come from different datasets measuring different things, but they point the same direction. Refusal now works as a strategy, and it depends on having working copies of your data when criminals take the originals hostage.
The Evidence Binder Is the Deliverable
Every control needs an artifact, not an assertion. Tabletop after-action reports, DMARC records in public DNS, training completion data, all of it goes in one place for underwriter review.
Inventory comes first, since you can’t prove coverage on assets you don’t know you own, and shadow IT has a habit of surfacing precisely when forensic investigators are looking for the machine nobody secured. Companies holding SOC 2 or ISO 27001 certifications get a head start here, because those programs already generate most of the evidence underwriting wants. Map it, don’t rebuild it.
Negotiate Terms While You Have the Upper Hand
Read the Sublimits First
Renewal is the one moment you can fix what the policy actually says, and most buyers waste it haggling over price in a falling market. Price is the wrong battle here. Read the aggregate limit and everything sitting underneath it, because the aggregate is marketing. A $5 million policy carrying a $500K ransomware sublimit and a $250K funds-transfer sublimit is not a $5 million policy when the claim that arrives is a wire fraud.
Then read the exclusions that got quietly added at your last renewal, including the war and hostile cyber activity language that now applies without any declared conflict, and the systemic event carve-outs that push cloud outage losses back onto you.
Lock In Your Response Team
Panel requirements, consent provisions, and negotiated rate schedules determine whether your trusted counsel and your forensics firm answer the phone during an incident. Otherwise the carrier assigns you strangers at panel rates, on the worst day of your professional life. Get pre-approvals written into the policy or an endorsement, since a verbal assurance from your broker is worth slightly less than the coffee it was delivered over.
The Clock Math for Q4
The standard renewal-prep timelines converge on a ninety-day runway, and the math for a January 1 renewal date lands squarely in mid-October. If you’re reading this in the fourth quarter, you’re inside the window, so start today.
- Ninety days out. Inventory everything and run a gap analysis against the control gates.
- Sixty days out. Close the big gaps and run a restore test, logged and dated.
- Thirty days out. Assemble the evidence binder and tabletop your incident response plan.
- Fourteen days out. Broker reviews the completed questionnaire line by line before submission.
Resist the urge to sprint. Changes crammed into the final sixty days are detectable, and a rushed questionnaire is where overstated attestations get born. The company in that Travelers case presumably meant it when it checked the MFA box. It wasn’t enough, and the court didn’t care.
The Underwriting Audit Pays for Itself
For small and mid-sized businesses, the underwriting assessment amounts to a security review you’d otherwise pay a consultant for. It forces the inventory you’ve been postponing, surfaces the admin sprawl nobody admits to, and puts a date on the restore test that was always scheduled for someday. Firms that go through it honestly tend to come out more secure than firms that hired consultants for ten times the premium and skipped the insurance entirely.
The market keeps maturing with or without you. Global cyber premiums are projected to hit $16.4 billion in 2026 according to Munich Re’s global cyber risk survey, while penetration among small businesses sits somewhere between 10% and 20%. The blocker isn’t the premium, which for a $1 million policy on a small shop stays in the low four figures annually. It’s the persistent belief that the product never pays out, a belief that’s part myth and part self-inflicted, depending on how the buyer filled out the application.
A cheap policy you can’t collect on is the most expensive line item in your budget.
Q4 is when you decide which one you’re renewing.
