Cyber Risk Insurance in 2026: What It Covers, What It Excludes and How to Buy It

When “cyber risk insurance” appeared among Google’s trending US searches on October 29, 2026, with more than 500 searches in the trending window, the timing was no coincidence. That week brought a run of headlines that showed how many different ways a business can be hurt by a digital failure. This article uses those events as a starting point for a practical explanation of the product that is supposed to absorb the cost.

The week that sent people searching

The news flow was varied. TechCrunch reported that Binance paused withdrawals as hackers were suspected of stealing billions in crypto; we cover it in our Binance analysis. HR Dive reported that PwC confirmed learning records were breached in an attack on a vendor site, after a known ransomware actor made a claim. Polymarket paused withdrawals after a third-party supplier was compromised. Fan-fiction site Archive of Our Own said it could be offline for up to four weeks after a security incident. And GM agreed a $220 million settlement over selling drivers’ private data, with a requirement to get express consent before collecting or sharing driving and location data.

Those events differ in kind: a theft, a ransomware claim, a supplier compromise, an outage and a privacy penalty. A cyber policy is designed, in different degrees, to respond to each type of loss. Which of them it actually covers depends on the wording, which is why buying one without understanding it is a risky shortcut.

What cyber insurance actually covers

Cyber policies are usually split into first-party cover, for your own losses, and third-party cover, for claims against you. Exact structures vary by insurer, but the common components are:

• Incident response costs: forensic investigators, legal advice, notification of affected people, call centres and credit monitoring.
• Business interruption: lost income and extra expense while systems are down, often with a waiting period before cover starts.
• Extortion and ransomware: negotiation support and, subject to law and policy terms, ransom payments.
• Data restoration: the cost of recovering or recreating lost data and rebuilding systems.
• Liability: claims from customers or partners over privacy breaches or security failures, and regulatory defence costs where insurable.
• Funds transfer and social engineering fraud: often capped at low sublimits or offered as an add-on.

The GM example shows why wording matters. A settlement over selling data is a privacy and regulatory matter linked to a business practice, not a hacker’s attack. Whether any policy responds to that kind of loss depends on exclusions for intentional conduct, how “privacy event” is defined and whether penalties are insurable at all. Insurers have been tightening policy language around non-breach privacy claims and contingent business interruption, according to market commentary.

What is not covered: the exclusions that matter

Most disputes come from a few common limits. War and state-backed attack exclusions are the headline issue: if an attack is attributed to a nation state, an insurer may argue the exclusion applies. That matters in a week when analytics firms were reported to be attributing the Binance incident to a North Korean unit, although attribution is not proof and policy language varies widely. Other typical limits include:

• Prior or known incidents and acts occurring before the retroactive date.
• Failure to maintain minimum security controls described in the application, such as multi-factor authentication.
• Infrastructure failures outside your control, such as a utility or cloud outage, unless contingent cover is bought.
• Betterment: upgrading systems beyond their prior state.
• Loss of the value of intangible assets, and in many policies digital assets or cryptocurrency. Crypto custody is a specialist line, and a general cyber policy should not be assumed to cover it.
• Sublimits on ransomware, social engineering and regulatory fines that are far below the headline limit.

The market: falling prices, rising claims

The pricing picture is unusual, and sources disagree, so the numbers below are best read as ranges. Cyber rates spiked during the ransomware surge, then fell. Lockton reported that premiums across its portfolio decreased by an average of 11% in 2025. Marsh reported that cyber rates declined 11% in the third quarter of 2025, and a secondary report of its index showed eight consecutive quarters of cuts through Q1 2026. DUAL has warned that international cyber rates have tumbled 43% since the fourth quarter of 2023, pushing the sector towards what it called an inflection point in 2026.

Gallagher describes a flatter picture, with pricing stabilised after a three-year softening and most buyers seeing flat rates, though healthcare faces single-digit increases because of elevated claims activity. S&P Global Ratings, by contrast, forecasts a rebound of 15% to 20% in 2026 after rates fell 22% from their 2022 peak. The honest summary: nobody agrees on direction, which means buyers should plan for either.

Underneath the pricing, claims are rising. In 2024, US insurers handled roughly 50,000 cyber claims, about a 40% increase on the prior year, according to the figures we found. Ransomware drives severity: Allianz Commercial puts it at 60% of the value of large cyber claims, those over EUR 1 million. In market size, Swiss Re projects about $16.4 billion of global premiums in 2026, after roughly $15.6 billion in 2025, a sharp slowdown from the 30%-plus annual growth between 2017 and 2022. Gallagher forecasts $30 billion to $50 billion by 2030. Several of these are secondary sources, and market-size estimates vary, so treat them as directional.

How underwriters price your risk

Insurers increasingly price on controls, not just industry and revenue. Applications ask about multi-factor authentication, endpoint detection and response, tested offline backups, patching speed, privileged-access management, email filtering, staff training and incident response planning. The same small-business guide that listed these controls as effectively mandatory for underwriting was a low-authority source, so treat that as directional, but it matches what brokers commonly report.

The supplier angle has become prominent. The PwC and Polymarket events both involved third-party compromise. Underwriters ask how you manage vendor risk, and some policies include cover for losses caused by a service provider’s outage, often as a sublimit. If your operations depend on a few critical vendors, that clause may matter more than the headline limit.

How to buy cyber cover well

1. Quantify your exposure first. Estimate downtime cost per day, records held, regulatory exposure and the revenue lost if a key vendor fails. Limits should come from scenarios, not rules of thumb.
2. Fix the cheap controls before you apply. Multi-factor authentication, tested backups and patching reduce both price and the risk of a declined claim.
3. Answer the application with care. A misstatement about controls is a standard ground for dispute. Have IT and finance review it together.
4. Compare sublimits, not just premiums. A cheap policy with a low ransomware sublimit may be a worse buy than one that costs more.
5. Check the waiting period and the definition of an outage. Business interruption cover often begins only after hours of downtime.
6. Understand panel requirements. Many policies require you to use the insurer’s approved response firms and to notify quickly. Use them from the first hour.
7. Test your plan. Insurance pays for losses; it does not restore operations. Rehearse the first 48 hours of an incident.

Small businesses: a special case

Smaller firms are often assumed to be too small to be targeted, yet automated attacks do not choose by size. They also have the least capacity to absorb a long outage. For a small company, the most useful part of a cyber policy may be the response team: access to forensic and legal specialists at the moment they are needed. When comparing quotes, ask how the incident hotline works, what the response firms are, and what the cover is for funds-transfer fraud, since invoice and payment fraud is among the most common small-business losses. Our insurance guides cover how this fits with other business cover.

What the week’s events teach

Taken together, the incidents of late October show that loss comes from many sources: attackers going after valuable targets, suppliers that become the entry point, outages that stop revenue, and regulators who penalise how data is handled. Cyber insurance responds to part of this, not all of it. It is best understood as one layer: controls to prevent, plans to respond, contracts that allocate vendor risk, and insurance to transfer what remains.

If the search spike is anything to go by, many more businesses are asking about this cover now than a week ago. The best time to buy, and to read the wording closely, is before the incident, when there is time to ask questions and the market, by most accounts, is still competitive.

Quick checklist

• List your five most critical vendors and the cover you hold for their failure.
• Confirm that multi-factor authentication covers email, remote access and admin accounts.
• Verify that backups are offline or immutable and have been restored in a test.
• Read the war, state-actor and crypto-asset exclusions.
• Check the ransomware, social engineering and regulatory sublimits.
• Know who to call, and in what order, in the first hour.

Sources: Google Trends US, TechCrunch, HR Dive, and broker and insurer market commentary (Lockton, Marsh, Gallagher, DUAL, S&P Global Ratings, Swiss Re, Allianz Commercial), as of October 30, 2026. General information, not insurance advice.