Insurance Marketplace Realities 2027 – Cyber Risk

Leveraging the current rate environment

The cyber insurance market remains favorable for many buyers, with abundant capacity and sustained carrier competition keeping rates generally competitive. The projected range of -5% to +5% reflects a broadly stable environment, although results will vary by industry, loss experience, controls and exposure profile. Willis’ client experience in the first half of 2026 confirms that average rates remained negative, with more pronounced decreases observed in the excess layers.

Buyers may still have the opportunity to enhance their insurance programs through 2026, although signs of rate moderation are emerging across certain cyber insurers and classes of business. Program enhancements extend beyond immediate price savings, however. Forward-looking organizations can capitalize on the current market environment to optimize their insurance programs for long-term sustainability and more effectively address emerging risks and loss scenarios.

As outlined in our recently published Cyber Claims in Focus report, Willis suggests the following steps can help insureds derive greater value from cyber insurance:

• Use the cyber insurance underwriting process to drive discipline and governance, rather than approaching it as a tick-box exercise
• Align your policy coverage with your real risks, rather than assumptions
• Align your policy limits with your financial exposures
• Integrate cyber insurance into your incident response and continuity planning and testing
• Maximize pre-loss risk management services to improve your cyber resilience

Rather than treating premium reductions as a simple budget-saving measure, buyers should consider reinvesting potential savings in tailored coverage, higher limits and cyber risk controls and governance practices that insurers are increasingly prioritizing. These investments may deliver greater long-term value as the underlying cyber threat landscape continues to increase in both severity and complexity.

Impact of artificial intelligence

Artificial intelligence is creating a two-sided challenge. Organizations are adopting AI to improve productivity and decision making, but these applications can introduce new vulnerabilities, expand data-governance concerns and increase dependence on third-party technology. At the same time, threat actors can use AI to accelerate reconnaissance, create more convincing social-engineering campaigns and identify exploitable weaknesses at greater scale.

From a claims standpoint, “AI isn't yet appearing as a stand-alone driver of cyber insurance claims, but is fueling risk volatility by materially amplifying existing threats such as social engineering and ransomware attacks.” AI will also continue to increase concerns around privacy and the management of confidential information, including third-party data. 

While the mere involvement of AI in an incident does not automatically determine whether coverage applies, the rise of AI-related cyber incidents reinforces the need for forward-looking scrutiny of cyber policy wordings. In the current marketplace, “most cyber policies don’t tend to distinguish between AI‑enabled and non‑AI‑enabled events and typically don’t feature AI exclusions. Whether an AI‑related event triggers a cyber insurance policy depends on whether it creates a covered cyber incident.” Policyholders should therefore evaluate whether existing policy wording and coverage provisions adequately address both current and planned AI use cases.

As organizations accelerate AI adoption, risk managers should:

1. Evaluate how AI is being deployed across the business
2. Identify the financial losses that could realistically arise from AI-related incidents
3. Assess whether those losses fall within existing cyber coverage
4. Consider whether additional insurance protection is required to address identified gaps

Ransomware as a continuing threat

Ransomware remains one of the most significant drivers of cyber loss. Our global claims data suggests that “ransomware is the highest-severity risk in our dataset and one of the most expensive categories of all cyber events. It’s also impacting organizations large and small.”

Beyond first-party expenses and business interruption losses, the growing prevalence of data exfiltration can create substantial privacy and regulatory exposures, further amplifying the financial severity of ransomware events. AI may further increase the speed, efficiency and reach of attacks, enabling threat actors to exploit vulnerabilities and target organizations more effectively. Large-scale or systemic events may exceed the assumptions used when limits were originally purchased. Buyers should model realistic scenarios, evaluate dependent-business and vendor exposures, review waiting periods and any applicable sublimits and consider whether current insurance towers can absorb both a major event and related follow-on costs.

Privacy non-compliance and wrongful collection

Privacy exposure adds another layer of complexity. Regulatory non-compliance, improper data collection practices and evolving expectations around the use of personal information can result in investigations, litigation and remediation costs. Although robust privacy coverage is generally available, policy language varies substantially across insurers.

Coverage breadth may depend on factors such as an organization’s industry, loss history, business practices and the quality of underwriting information provided. Clear and comprehensive submissions can help underwriters better understand an organization’s risk management practices and may support more favorable coverage terms. When evaluating privacy and regulatory coverage offerings, buyers should carefully review applicable definitions, exclusions, consent-related requirements and the interplay among privacy, media and cyber coverage provisions.

In closing

Overall, competitive market conditions should not be conflated with declining risk. The most effective strategy is to convert favorable pricing into greater resilience: align limits with credible loss scenarios, tailor coverage to the organization’s risk profile, strengthen controls and present underwriters with robust risk information. These actions can help ensure organizations derive greater value from their cyber insurance programs and that coverage remains fit for purpose as AI, ransomware and privacy threats continue to evolve.