Insurance Marketplace Realities 2026 Spring Update – Cyber Risk

Key takeaway

While competitive conditions have prevailed in the cyber market since 2022, this trend is decelerating as several prominent insurers are focusing on book stability. The trajectory of the market will largely be shaped by ongoing loss trends, especially those characterized by severe ransomware incidents and systemic events occurring in early 2026. These developments, along with the results of cyber reinsurance renewals, will play a pivotal role in determining whether the market undergoes a shift toward firmer conditions later this year.

Insurer competition is offsetting escalating cyber losses

Cyber losses continue to escalate, bad actors continue to deploy new tactics, and the risks have never been so unpredictable. At the same time, an abundance of insurer competition is pursuing cyber premiums, as underwriters are eager to capitalize on the biggest growth opportunity in the wider insurance industry.

The cyber market is expected to grow to $16 billion in 2025, according to MunichRe's 2025 Risks and Trends report. Beazley predicts that the market will grow to at least $40 billion by 2030. Several notable insurers have raised concerns that heightened underwriting discipline is needed to ensure continued profitability of cyber insurance, so that the marketplace can be positioned effectively to meet this increased demand.

Cyber risk driving losses

1. Ransomware remains a dominant cause of cyber losses
   • In 2025, ransomware was the most significant cyber risk. Attack frequency increased by 45% year-over-year, according to the 2026 Cannata Report, while Bright Defense found that the average ransom payments declined by 50%, reflecting improved organizational resilience and a growing reluctance to pay.
   • The ransomware risk profile evolved materially, including a notable rise in insider enabled attacks, where threat actors incentivized employees to facilitate system access.
   • While improved controls have reduced business interruption duration, the sheer severity of large-scale events — often exceeding $1 billion — will increasingly challenge traditional limit assumptions.
2. Vendor incidents are driving systemic losses
   • After vendor incidents impacting Change Healthcare and CrowdStrike, 2025 saw a drastic increase in cloud outages, with notable outages impacting AWS, Microsoft Azure, Google Cloud and Cloudflare.
   • November 2025’s Radware report estimates the cost of Cloudflare's outage alone to have cost anywhere from $5 billion to $15 billion, and the increased frequency and severity of these losses has exhibited just how dependent organizations are on technology vendors.
   • Vendor risks and increased reliance on a core group of technology providers will continue to stress test cyber insurance
   • Fortunately, most outages in 2025 were rectified quickly in less than a day. An incident that lasts several days or weeks could result in losses with exponentially higher billion-dollar impacts.
   • In the short term, we don’t expect any material impact to cyber insurer appetite for system failure coverage given the current state of competition pursuing cyber premiums.
3. Privacy risk extends beyond data breaches and cyber attacks
   • Privacy risk has focused on liabilities resulting from unauthorized disclosure of sensitive personal data, either from negligent protection of data or a malicious cyber-attack. Often overlooked are losses arising from wrongful data collection and regulatory non-compliance that do not involve any sort of cyber event.
   • The findings of a 2022 investigation by The Markup, a non-profit publication, showed a substantial portion of hospitals utilized pixel tracking technologies without explicit consent, which fueled class action lawsuits, congressional inquiries and updated guidance from regulatory entities surrounding pixel compliance.
   • In 2025, notable pixel tracking settlements in the healthcare sector totaled over $100 million, according to Feroot, with plaintiffs successfully bringing claims under a mix of U.S. federal and state statutes, often repurposing older privacy, wiretap and anti-hacking laws.
   • Underwriting privacy and wrongful collection risk will be increasingly challenging for cyber insurers given that companies are unlikely to stop using pixel tracking technologies and will continue to aggregate data.
   • Some markets have started to curtail previous coverage expansions for wrongful collection, but the current marketplace should allow buyers with favorable loss history and privacy controls to find wrongful collection coverage with persistence.
4. Artificial intelligence is amplifying cyber risk
   • The introduction of AI into the threat environment amplifies cyber risk because it allows bad actors to automate processes that were previously manual.
   • AI delivers greater speed and efficiency to a bad actor’s ability to identify vulnerabilities and deploy cyber attacks.
   • Since AI exclusions have not yet been deployed regularly on cyber policies, cyber insurance should be well-positioned to respond to this amplification of exposure.
   • Several novel AI specific insurance solutions have entered the marketplace, but available capacity and buying appetite have so far been limited. This could change with a sizable first time AI loss, which will be an inevitable watershed moment.
   • In the meantime, it will be imperative for buyers to proactively pursue as broad coverage as possible under cyber policies covering the full range of possible AI losses.

Specific industry trends

• Aviation: This continues to be a challenging industry class for cyber markets. After recent extended outages caused by cascading technology failures, including CrowdStrike, Microsoft and AWS, cyber markets are reevaluating their appetite to offer certain business interruption coverages like system failure and contingent business interruption.
• Healthcare: In recent years, healthcare has experienced significant impacts from both systemic outages (Change Healthcare and CrowdStrike) and litigation related to web-tracking usage. These substantial losses have resulted in increased underwriting scrutiny and less favorable rates.
• Retail: Fortinet recently reported that 24% of cyber attacks were perpetrated against retailers, making this one of the most targeted industry sectors. There are a number of factors that make retail attractive, including large amounts of customer PII and similar security infrastructures used across the industry. A successful attack on one retailer may work on a counterpart due to these similarities.
• Construction: The construction industry is undergoing digital transformation, with smart equipment, AI-driven project management and cloud-based tools becoming integral to daily operations. While these advancements offer efficiency and innovation, they also introduce significant cyber vulnerabilities. More cyber insurers are creating construction-specific endorsements to address these unique exposures.
• Manufacturing: More companies are grappling with how to protect their operational technology (OT) systems, which generally lack embedded Vulnerabilities can lead to large-scale business interruption losses and potential lateral movement into information technology (IT) systems. Carriers are regularly collecting OT-specific underwriting information, including whether OT and IT networks are properly segmented to prevent lateral movement.
• Tech, telecom, media: In 2024 and 2025, technology companies experienced cyber attacks or outages that cascaded down to their customers (see section ‘Vendor incidents are driving systemic losses’ above), demonstrating the vulnerabilities created when technologies are interconnected. As companies race to incorporate AI capabilities into their technology solutions, embedded security and supply chain management will be essential to avoid systemic failures.
• Higher education: Underwriter scrutiny around end-of-life (EOL) systems has ramped up based on the custom software used by many educational institutions. Carriers want to see protections in place or the replacement of these systems with something more secure.

Coverage terms and WTW innovation

WTW continues to invest in proprietary and exclusive capacity solutions designed to enhance efficiency, stability and client outcomes across market cycles. For example, CyXS provides Willis’ clients with access to up to $150 million of Lloyd’s capacity, which can be deployed anywhere above the primary layer. The lead insurers make underwriting and claims decisions for the panel, while participating insurers blind-follow for a streamlined block of capacity. This structure is designed to ensure expedited claims recovery, which is meaningful especially for significant limits. CyXS capacity also includes a reinstatement option (i.e., CyXS Restore), which provides insureds with the opportunity to reinstate policy limits for any future unrelated losses during the policy year.

More broadly, in September 2025, WTW launched the Gemini facility, a global, multi-line auto-follow facility designed to locally deliver A+ rated capacity to WTW clients across their insurance portfolios. Gemini helps clients navigate market volatility with confidence while maximizing the efficiency of their capital spend. The introduction of substantial, sustainable and readily available capacity through all market cycles is available for any risk, regardless of complexity across shared and layered or quota share placements.