This is a half-year update looking back at the GB cyber insurance market in H1 2025, providing analysis and insights, covering market trends of pricing, capacity, coverage, and notable cyber incidents.
The cyber risk environment in H1 has been incredibly turbulent, with multiple incidents reported in mainstream media; however, this is countered by very favourable buying conditions for cyber insurance, delivering an acute juxtaposition and highlighting that the decision of how much cyber insurance capacity to purchase is undoubtedly a c-suite responsibility.
01
02
03
H1 has been dominated by the continually reported nefarious work undertaken by the ransomware-as-a-service group DragonForce[3] (and affiliates falling under the ‘Scattered Spider’[4] moniker), who allegedly perpetrated many of the attacks against UK retailers.
The impact of these incidents being so severe that it is already publicly reported to have resulted in hundreds of millions of profits being lost as a result, and the incidents being constantly reported across mainstream media channels.
Worryingly the techniques at play are not new, nor are they overly sophisticated. As with so many frauds they have been deploying phishing techniques, in recent instances to obtain access credentials from IT helpdesks, making two things clear;
Scattered Spider[7] criminals and affiliates have been using these techniques for some time, however, the severity and impact only becoming more severe.
In addition to tried and tested techniques such as phishing, threat actors are ever resourceful in finding new techniques to circumnavigate security measures, developing tooling such as those to bypass Endpoint Detection and Response (EDR) systems, which businesses have invested significant sums in to reduce their exposure to malicious cyber events.
It's clear that threat actors are not letting up in finding any new opportunities to monetise their efforts and/or further their or their master’s ideals.
Capacity remains in very plentiful supply, with insurers seeking to make their proposition as appealing as possible, pushing boundaries of their historic comfort zones to try and outpace their peers.
In the wake of the retail cyberattacks, clients have been utilising the plentiful supply of capacity to increase limits both at renewal and mid-term.
Many insurers secured very favourable outcomes when renewing their reinsurance programmes, emboldening their respective plans to grow in a highly competitive market.
H1 has delivered results for a swathe of clients that were previously unachievable, resulting in brokers needing to caution clients that the sustainability of such terms feels less certain come next renewal.
Many clients are tactically utilising the extremely appealing premiums on offer to either enter the cyber market or to increase the limits they purchase. Such astute decisions are unsurprising, with capacity pricing often (specific pricing is tailored to individual clients and many variables) assuming it will not be subject to claim in the next 50 to 200 years (5,000 to 20,000 per million of capacity).
Given the events in the public domain, such generous terms are resonating with many new buyers, allowing them to purchase large limits immediately.
During H1 Willis’ cyber team has continued to work with clients and insurers to break new ground in a number of innovative areas, including Artificial Intelligence.
While expanding and tailoring coverage are critical, H1 has showed why our longstanding efforts on key policy efficacy areas, such as the ability for claim payments to be made at break-neck speed due to affirmative policy provisions are just as, if not more important when a client is reliant on the cornerstone of insurance, the ‘promise to pay’.
