What is cyber insurance?

In the same way that car insurance pays for vehicle damage and bodily harm in the event of an accident, cyber insurance policies pay for damaged computer systems, lost revenue, legal expenses and other cyberattack costs.

Security breaches are growing more common and more costly. According to IBM’s Cost of a Data Breach report, the global average cost of a data breach (March 2024 through February 2025) was USD 4.44 million. Cyber insurance can lessen the financial impact of these breaches, making it an important part of risk management for businesses today.

Any company that stores customer information or relies on technology, which includes most businesses, faces cyber risks. Security teams can take steps to mitigate cyber threats, but they cannot prevent them entirely. According to the Travelers Risk Index, 57% of business leaders think cyberattacks are inevitable.

Standard business insurance products, like general liability coverage and errors and omissions policies, typically don’t cover losses from cyber events, leaving companies vulnerable for the full cost of phishing attacks, business email compromise scams, and other cybercrimes. These attacks can have a heavy financial toll. For example, the average data breach caused by a phishing attack costs USD 4.80 million.

Cyber insurance policies arose to close this coverage gap. By covering ransom payments, malware remediation and other costs, cyber policies can help companies limit their damage, recover more quickly and raise their overall level of cyber resilience.

Cyber insurance coverage can vary based on what the business needs, the types of data the business stores and the business’s industry. Many cyber policies offer options for first-party and third-party coverage. First-party coverage pays for the business’s direct losses, like the costs of recovering data and restoring systems. Third-party coverage pays for damage suffered by parties outside the business, like consumers who had their data stolen.

When it comes to specific losses, many cyber policies pay for things like:

While cyber policies can cover a lot, there are some incidents they won’t pay for. These are called exclusions. Common exclusions include:

While demand for cyber insurance is high, rising cyber insurance costs are making it hard for companies—especially small businesses—to find coverage. According to Marsh McLennan, cyber insurance prices rose by 110% in the first quarter of 2022.

According to 451 Research, cyber insurance may contribute to increasing ransomware attacks. As more businesses buy cyber policies, they become more comfortable paying ransoms because insurance will cover them. Hackers, in turn, feel encouraged to keep asking for ransoms. One new strain of ransomware, HardBit, even asks victims to share the details of their cyber policies so the hackers can calculate a ransom the policy will cover.

Price turbulence is also fueled by the fact that cyber insurance is relatively new compared to other insurance products. Insurers have limited historical data on cyberattack costs, which makes it difficult to create accurate risk models and set stable prices.

As insurance companies see their losses climb, they respond by raising premiums and limiting coverage. Insurer AXA has stopped covering ransomware payments for policies issued in France. Lloyd’s of London will no longer cover state-sponsored cyberattacks, another source of major losses.

Insurers are also setting stricter network security requirements for insured companies. Some underwriters won’t even offer an insurance quote unless a company has multi-factor authentication, data encryption, zero trust or similar policies in place. Some insurance companies are taking on a more consultative role, giving policyholders and business owners access to security tools and service providers to help them improve security posture. Some experts predict that cyber insurers may become key figures in enforcing standards like the NIST Cybersecurity Framework, as companies that follow these standards will be less costly to insure.