NAIC Reports Continued Growth in US Cyber Insurance Market

The US cyber insurance market continued to expand in 2025, although rising claims and declining rates are creating challenges for insurers, according to the National Association of Insurance Commissioners (NAIC). In its Report on the Cybersecurity Insurance Market: 2025 Reporting Year, the NAIC examined market performance, underwriting trends, and emerging cyber-security threats, finding that domestic cyber insurance premiums have nearly tripled since 2020.

According to the study, total US cyber insurance direct written premium, including alien surplus lines, reached approximately $9.46 billion in 2025, up 3.5 percent from the previous year. Domestic insurers accounted for $7.46 billion, compared with $2.75 billion in 2020. Premium growth has moderated in recent years as competition and market capacity have increased.

The NAIC reported that domestic cyber insurance policies in force increased 33 percent to 5.84 million in 2025, while reported claims rose 20 percent to 56,323. Much of the growth in policy counts came from cyber endorsements added to other commercial insurance policies, rather than stand-alone cyber coverage.

According to the study, primary cyber policies continue to account for the largest share of premium, while endorsements represent nearly two-thirds of policies in force. The findings reflect the widespread practice of including limited cyber protection within other commercial insurance policies.

Cyber Insurance Loss Ratios Increase as Rates Decline

The NAIC found that the industry-wide cyber insurance loss ratio increased to 53 percent in 2025 from 48.7 percent in 2024, marking the second consecutive annual increase. The deterioration occurred as cyber insurance pricing continued to decline, with the first quarter of 2026 marking the eighth consecutive quarter of US cyber insurance rate reductions.

According to the study, primary cyber coverage experienced the greatest deterioration in underwriting results, while excess coverage showed a slight improvement. Loss ratios also increased for cyber endorsements, although those policies account for a relatively small share of overall premiums.

The study identified significant differences in claims severity across business sizes. Average claim severity for large businesses with annual revenue of at least $1 billion doubled to approximately $4.4 million in 2025. Claims severity also increased among middle-market businesses but declined for small and mid-sized enterprises.

According to the NAIC, claim frequency declined among larger businesses despite the increase in severity. Rising business interruption expenses and data breach litigation costs contributed to the higher average cost of claims among large organizations.

Reinsurance Capacity and Emerging Coverage Solutions

The NAIC reported that reinsurance capacity remains strong, with reinsurers continuing to support primary cyber insurers primarily through proportional arrangements. The study also identified a shift toward nonproportional reinsurance structures intended to provide greater protection against large losses.

According to the study, the insurance-linked securities and catastrophe bond markets continued to provide additional cyber risk capacity in 2025. Insurers are also developing new coverage solutions addressing systemic risks, including parametric insurance products designed to respond to cloud service outages.

Cyber Threats Create Additional Underwriting Challenges

The NAIC identified artificial intelligence (AI), ransomware, cyber-enabled fraud, and third-party technology dependencies as significant developments affecting the cyber insurance market. The study noted that AI-enabled attacks and faster exploitation of software vulnerabilities could increase claims frequency and severity, particularly among organizations using common technology systems.

According to the study, ransomware remains a major source of insured cyber losses. Although attack volumes have remained relatively stable at elevated levels, ransomware incidents continue to create substantial financial exposure through business interruption, recovery costs, and extortion demands.

The NAIC also highlighted business email compromise, social engineering, and AI-generated deepfakes as growing concerns. The study noted that standard cyber insurance policies frequently exclude or limit coverage for social engineering and funds transfer fraud, potentially leaving gaps between cyber insurance and separate crime insurance policies.

According to the study, reliance on shared cloud infrastructure and third-party technology providers presents an additional challenge for cyber insurers. A single outage or security vulnerability affecting a widely used provider can generate simultaneous losses across multiple policyholders, creating accumulation risk within insurance portfolios.

The study also identified a substantial cyber insurance protection gap, particularly among small and mid-sized enterprises. Despite increasing demand for coverage, a significant portion of global economic losses from cyber incidents remains uninsured.

Regulatory Outlook

The NAIC concluded that the cyber insurance market remains profitable but faces increasing pressure as expected losses rise while insurance rates decline. The study identified large-account claims severity, AI-enabled threats, third-party accumulation risk, and gaps in existing coverage as areas requiring continued attention.

According to the study, these developments have implications for underwriting, rate adequacy, policy wording, and regulatory oversight as insurers respond to changing cyber risks and market conditions.