The cyber insurance market has gone through a pricing and underwriting transformation that many mid-market buyers haven't fully internalized. The benign market conditions of 2018–2020 — cheap premiums, loose underwriting, broad coverage — are gone. Loss ratios spiked dramatically as ransomware attacks against businesses scaled in 2020–2022. Underwriters responded by tightening eligibility requirements, adding exclusions, and increasing premiums substantially.
The good news is that the market has largely stabilized — premium growth has moderated and underwriting practices have become more consistent. The challenge for mid-market buyers is that the bar for obtaining comprehensive coverage at reasonable cost has permanently risen. This guide covers what coverage actually includes, what it costs in 2025-2026, and what underwriters are specifically requiring that many companies haven't addressed.
What Cyber Insurance Actually Covers
Cyber insurance is not a standardized product — policies vary significantly across carriers in terms of what's covered, what's excluded, and how claims are handled. That said, most comprehensive cyber policies cover some combination of:
First-party coverages (your own losses):
- Business interruption. Revenue losses and extra expenses incurred when a cyber incident prevents normal operations. This is typically the largest coverage component for ransomware events — coverage for the downtime period while systems are restored.
- Data recovery and restoration costs. Costs to restore or recreate data corrupted or destroyed in a cyber incident.
- Ransomware payments. Some policies cover extortion payments, though this coverage is increasingly restricted or excluded. Paying ransoms also has legal complications — payments to sanctioned entities are prohibited under OFAC regulations.
- Crisis management and notification costs. Forensic investigation, legal counsel (breach counsel), breach notification to affected individuals, credit monitoring services for affected customers, and public relations.
- Cyber extortion response. Negotiation services and related costs for extortion events.
Third-party coverages (claims by others against you):
- Privacy liability. Claims from individuals or regulators related to unauthorized disclosure of personal data.
- Network security liability. Claims that your security failure enabled an attack on a third party's systems.
- Media liability. Claims related to content you publish online (defamation, IP infringement).
- Regulatory defense and penalties. Costs to defend against regulatory investigations and, where insurable by law, regulatory fines and penalties.
What Cyber Insurance Costs in 2025-2026
Cyber insurance premiums are highly variable based on revenue, industry, coverage limits, deductible, and security posture. Directional ranges based on publicly available market data as of 2025-2026:
Small businesses ($1M–$10M revenue): $2,000–$8,000 annually for $1M coverage limit with a $10,000–$25,000 deductible. Healthcare and financial services companies in this tier pay toward the higher end of the range.
Mid-market companies ($10M–$100M revenue): $8,000–$50,000 annually for $1M–$3M coverage limits. Companies with weak security posture (no MFA, incomplete patch management) may face higher premiums, coverage exclusions, or outright declinations.
Mid-market companies ($100M–$500M revenue): $30,000–$150,000+ annually depending on industry, security posture, and coverage structure. Healthcare, financial services, and manufacturing companies in this tier that have experienced prior incidents pay at the top of the range.
These are directional ranges based on publicly available data. Actual premiums depend heavily on the specific underwriting questionnaire results and the carrier. Working with a specialist cyber insurance broker — rather than adding cyber coverage as an endorsement to a general commercial policy — consistently produces better coverage terms.
What Underwriters Are Requiring in 2025-2026
The underwriting questionnaire has become substantially more detailed since 2020. Controls that were optional discussions in 2019 are now binary eligibility requirements in many carrier applications:
Multi-factor authentication (MFA). This is the single most commonly scrutinized control in current underwriting. Most carriers now ask specifically: what percentage of your users have MFA enabled on email? On VPN? On remote desktop? On admin accounts? On cloud platforms? Organizations without MFA on email and remote access may face coverage exclusions for credential-based attacks or premium surcharges that effectively price them out of the market.
Privileged access management. Do you have controls specifically protecting administrator and privileged accounts? PAM is increasingly a standard underwriting question, particularly for manufacturing and infrastructure companies.
Endpoint detection and response (EDR). Is EDR deployed on endpoints? Is it actively monitored (managed EDR/MDR) or unmonitored? The distinction matters — an EDR tool that generates alerts no one reviews is less protective than managed monitoring. See our EDR guide for the evaluation framework.
Backup integrity. Do you have backups? Are they tested? Are they offline or air-gapped? The evolution of ransomware to specifically target and destroy backups before encrypting production systems has made backup integrity a core underwriting question.
Patch management. What is your patch management cadence? Is patching current for operating systems and applications? Organizations with significant unpatched vulnerabilities may face questionnaire follow-up or coverage conditions.
Email security. Do you have anti-phishing and email filtering beyond provider defaults? Email remains the primary attack vector for business email compromise, which is one of the highest-frequency cyber claims.
Security awareness training. Do employees complete security awareness training? How often? Are phishing simulations conducted? Training completion rates are increasingly a specific underwriting question.
Common Coverage Exclusions to Watch For
Cyber policies have exclusions that can significantly limit coverage at exactly the moment you need it. Key exclusions to review with your broker:
War and nation-state exclusions. Following litigation around the NotPetya malware (which insurers attempted to classify as war), many policies now include nation-state or war exclusions. The scope of these exclusions varies; some carve back coverage for certain scenarios. This is particularly relevant for healthcare, energy, and defense-adjacent industries that are targeted by nation-state actors.
Prior acts exclusions. Events that began before the policy inception date. If a breach began (the attacker established access) before your policy started, even if discovered after, the prior acts exclusion may apply.
Unencrypted data exclusions. Some policies exclude claims related to loss of unencrypted personal data. If you store customer data unencrypted, this exclusion is a significant gap.
Infrastructure failure exclusions. Some policies exclude losses resulting from failures of third-party infrastructure (cloud provider outages, internet service outages). Understand how your policy handles dependency on third-party infrastructure.
Cyber Insurance and Your IT Provider
Your MSP or MSSP's security posture directly affects your insurability. An MSP that has experienced a significant breach affecting multiple clients — or whose own security controls are weak — can affect your underwriting. Some carriers ask specifically about your managed service providers in underwriting questionnaires.
More practically: the security controls your IT provider implements on your behalf (EDR, patch management, backup) directly affect how underwriters evaluate your security posture. An MSP that provides comprehensive, documented security services supports better underwriting outcomes. An MSP that can't provide documentation of your security controls makes the underwriting questionnaire harder to answer accurately.
Frequently Asked Questions
Is cyber insurance required?
Not by law in the US (some states have data breach notification laws that imply financial exposure, but no mandate for insurance). However, it's increasingly required by: enterprise customers who require vendors to carry cyber insurance as a contract condition, financial institutions as part of vendor risk management, and government contractors. Cyber insurance is also simply good risk management — the cost of a major incident without insurance can be existential for a mid-market company.
How does ransomware affect cyber insurance coverage?
Ransomware is covered under most cyber policies' business interruption and data recovery provisions. Ransom payments themselves may or may not be covered depending on the policy and whether payment would violate OFAC sanctions (payments to sanctioned entities are prohibited regardless of insurance coverage). Critically, business interruption coverage only applies if you have an actual documented business interruption — companies with robust backup capabilities and fast recovery times collect less in business interruption claims.
What should I do if my current security posture doesn't meet underwriting requirements?
Prioritize the controls that have the highest underwriting impact: MFA, EDR with monitoring, and backup integrity are the three that most consistently affect insurability and premium. A specialist cyber insurance broker can advise on which controls will have the most impact on your specific renewal. Address the gaps before renewal if possible; mid-term policy changes are typically not available for material security improvements.
How do we know if our cyber insurance coverage is adequate?
Work with a specialist cyber insurance broker to model your maximum probable loss — the realistic worst-case cost of a significant breach. Consider: business interruption based on your daily revenue, forensic investigation and breach counsel costs, notification costs for all customers who might be affected, and potential regulatory fines. Compare that figure to your coverage limit. Many mid-market companies are underinsured — carrying $1M limits for scenarios that could realistically generate $3M–$5M in losses. See our ransomware recovery cost guide for specific loss estimates.