Soft Market, Hard Reality: Cyber Insurance Is At An Inflection Point
Increasing cyber risks and falling rates means the cyber insurance market is at an important crossroads, where either disciplined rate increases will preserve profitability or continued declines may lead to a period of losses pushing combined ratios in the cyber insurance segment above 100%.
We expect reinsurers will remain the backbone of insurers' ability to transfer cyber risk, making the reinsurance market the primary absorber of cyber accumulation risk as cyber exposures grow in scale and interconnectedness.
The decline in cyber insurance rates is beginning to slow, with early signs of improving pricing discipline that may help stabilize underwriting profitability and preserve the current reinsurance-led-market structure. However, adverse cyber loss trends and persistent competitive pressure could challenge pricing adequacy and increase the risk of market underpricing.
The cyber insurance market remains a paradox. Increasing cyber threats and the potential for greater damage are increasing risks and the cost of claims. These factors are driving demand for insurance, yet insurance rates have fallen for several consecutive quarters, eroded by abundant underwriting capacity and intense competition. Given this backdrop, it is a testament to insurers' underwriting discipline that the sector remains broadly profitable.
S&P Global Ratings sees signs that the market is turning, with early indicators suggesting downward pricing momentum is slowing as underwriting margins tighten following more than two years of rate declines. The U.S. market, in particular, is experiencing decelerating rate reductions, with pricing trends moving toward stabilization.
We consider this emerging dynamic creates two plausible market scenarios:
In this scenario, continued market pressures encourage insurers to implement controlled rate increases to offset the rising cost of incidents. Pricing adjusts progressively, allowing carriers to maintain cyber insurers’ combined ratios below 100% and preserve underwriting profitability.
Chart 1 | Scenario one: A gradual market rebalancing
f--Forecast. Source: S&P Global Ratings.
If weak pricing discipline results in sustained underpricing, profitability could materially decline over the next one to two years. This scenario could trigger a market correction--similar to the dynamic experienced by the cyber insurance market in 2021, or the global property and casualty (P/C) reinsurance market in 2023. Depending on the timing and scale of the correction, the market could face multi-year underwriting losses. To restore profitability, cyber insurers would likely need to take decisive action including sharp premium increases, capacity reductions, and a tightening of underwriting standards.
Chart 2 | Scenario two: A delayed correction and hard market transition
Cyberattacks continue to grow in volume, while the vectors of attack and their potential to cause damage are increasing.
First, AI is emerging as a significant force multiplier for threat actors, lowering barriers to entry and making attacks cheaper, faster, and more scalable. Simultaneously, AI introduces new attack vectors and expands the overall cyber risk surface, with AI systems themselves presenting new opportunities for exploitation.
Second, geopolitical tensions continue to elevate global baseline cyber activity. State-sponsored operations, cyber espionage, and politically motivated attacks contribute to a structurally higher threat environment. These geopolitically motivated cyberattacks raise several concerns for insurers and reinsurers, particularly regarding claims uncertainty, systemic risk, and operational exposure (see "Insurance Brief: Middle East War Fuels Cyber Risk," March 11, 2026).
Together, these developments are driving a sustained increase in underlying claims pressure across the cyber insurance ecosystem.
At first glance, recent cyber insurance market profitability appears counterintuitive. Despite declining premium rates and a rising threat environment, most carriers have maintained underwriting performance, though this trend appears to be facing emerging and gradual pressures.
Active portfolio re-underwriting is a key driver of this persistent profitability. Insurers are increasingly withdrawing from, repricing, or tightening terms in underperforming or overexposed segments, while simultaneously retaining and selectively expanding well-performing business where loss experience and risk selection remain favorable.
Three additional factors help explain the apparent profitability paradox:
First, advances in cybersecurity and AI-driven defense capabilities have limited loss severity by enabling faster detection and response.
Second, insurers have generally maintained disciplined by enforcing robust cybersecurity requirements.
Third, insured organizations have become increasingly resilient due to increased cybersecurity investment and insurer-supported prevention and incident response services.
While the factors cited above have supported profitability to date, the market appears to be approaching a turning point. Insurance rates continue to decline as loss frequencies increase, while competitive pressures are leading some insurers to broaden policy coverage.
One notable example of this trend is the expansion of coverage for business interruption losses arising from cyber incidents affecting third-party suppliers and service providers. While these extensions increase the relevance of cyber insurance for entities, they also increase interconnectedness within insured portfolios and introduce meaningful accumulation risk.
Whether this results in the gradual market adjustment outlined in scenario one or the delayed correction of scenario two will depend largely on pricing discipline. In scenario one, controlled rate increases could preserve underwriting profitability. In the second scenario, continued pricing pressure and rising losses could quickly erode margins and trigger a transition to an important, albeit slow, return to profitability.
An inflection in the cyber insurance market would have affects well beyond primary insurers. As cyber exposures continue to grow in scale and complexity, the key question is how the risk will be distributed across the insurance, reinsurance, and capital markets ecosystem.
Chart 3 | A cyber insurance market correction would have implications beyond primary insurersThe cyber (re)insurance value chain
Source: S&P Global Ratings.
Cyber remains one of the most heavily reinsured business lines due to the nature of its systemic and accumulative risks.
Today, risk flows from policyholders to insurers and subsequently into the reinsurance market, where a significant share of cyber exposure ultimately concentrates. Ample reinsurance capacity remains available across both proportional and non-proportional structures, contributing to moderately softer reinsurance terms and continued competition among capacity providers. Cyber reinsurers hold the keys to market discipline as they set underwriting standards, shape pricing, and promote consistent risk management across the cyber insurance market. For these reasons, reinsurers will ultimately play a central role in determining which of the two scenarios (described above) emerge.
While quota share arrangements continue to dominate cyber reinsurance, the market is evolving beyond traditional proportional risk-sharing models. Reinsurers are increasingly deploying aggregate excess-of-loss mechanisms, stop-loss covers, catastrophe event structures, and occurrence-based protections to address the challenges of covering low-frequency, high-severity cyber events.
This evolution reflects a broader maturation of the cyber reinsurance market. Recent developments suggest growing demand for structures that address specific aggregation and tail-risk concerns, rather than complete reliance on broad proportional risk-sharing arrangements. At the same time, reinsurers are placing greater emphasis on portfolio construction, systemic risk modelling, and capital efficiency to limit and manage exposure to cyber risks growing in interconnectedness.
The next layer of the cyber risk transfer chain is retrocession (reinsurance by a reinsurer) and capital markets participation, both of which remain comparatively underdeveloped.
While insurers transfer a material share of cyber risk to reinsurers, only a limited portion is subsequently retroceded. Industry data suggests cyber retrocession is concentrated among a relatively small group of large reinsurance players.
Meanwhile, cyber capital market activity has proven subdued in 2026, with only one new cyber insurance linked securities (ILS) transaction completed to date: Hannover Re’s $35 million Cumulus Re issuance (see chart 4). The transaction, which provides parametric protection against major cloud service outages, represents the third consecutive renewal of the Cumulus Re program. Each issuance has increased in size, reflecting growing confidence in the structure and underlying risk.
While established sponsors such as Beazley, Chubb, and Hannover Re renewed existing ILS in 2025 and 2026, no new cedents entered the market, and AXIS and Swiss Re did not renew their publicly placed cyber-ILS structures.
Chart 4 | Cyber catastrophe bond issuance has been subdued in 2025 and 2026
Sources: Artemis.bm, S&P Global Ratings.
The still limited cyber-ILS investor base is gradually broadening as investor confidence in the asset class grows. Cyber risk is still a relatively untapped insurance peril, which creates an opportunity for higher risk premium compared to more established natural catastrophe bonds. Improvements in cyber risk modelling are helping investors better assess risks and evaluate the associated risk/return profile. Nevertheless, uncertainty around tail risk means investors remain cautious.
Additionally, investors face the risk that their collateral is locked up for extended periods, as cyber loss claims can develop slowly after an incident is reported. This can make it difficult for investors to redeploy capital. Consequently, cyber-ILS investors appear to primarily seek transactions related to extreme and remote risks structured as per-occurrence excess-of-loss coverage, rather than providing coverage for attritional losses from smaller cyber incidents. Transactions based on frequency rather than severity may not offer sufficient risk/return benefits to an investment portfolio.
According to artemis.bm, a catastrophe bond news and data provider, cyber catastrophe bonds currently account for 1.3% of the outstanding catastrophe bond and ILS market. Since the first issuance in 2023, cyber catastrophe bonds have represented a steadily declining share of total catastrophe bond issuance volume, falling to just 0.19% of new issuance year-to-date in 2026, in part due to growing demand for natural catastrophe ILS (see chart 5).
Chart 5 | New cyber catastrophe bonds' market share has declined amid weaker conditionsCyber catastrophe issuance versus total catastrophe bond and ILS issuance
Data as of July 13, 2026. ILS--Insurance-linked securities. Sources: Artemis.bm, S&P Global Ratings.
While this decline may suggest a challenging market environment, the trend is primarily driven by limited need for (re)insurers to tap alternative capital rather than limited investor appetite. With ample capacity available in the traditional reinsurance market, relatively soft reinsurance pricing, and solid profitability across the cyber insurance sector, insurers and reinsurers currently have little economic incentive to tap capital markets through cyber catastrophe bonds.
Nevertheless, the bonds continue to play an important strategic role. Rather than competing with traditional reinsurance on day-to-day loss activity, they provide targeted protection against large-scale cyber events and serve as a mechanism for transferring tail risk into institutional capital pools. They can also be tailored to address specific exposures, such as cloud outage risk, as demonstrated by the Cumulus Re series from Hannover Re.
The point at which (re)insurers are likely to turn to alternative capital depends on which of the two scenarios we outlined early materializes.
In scenario one, a gradual repricing of cyber risk in the primary insurance market would likely preserve the current market structure. Reinsurance capacity would remain broadly available, and cyber-ILS would continue to be a strategic complement to traditional risk transfer mechanisms.
In scenario two, the market is more dynamic. If rising losses continue to outpace pricing adjustments, underwriting profitability in the cyber primary insurance segment could face increasing pressure, leading to more selective deployment of reinsurance capacity. In this environment, cyber-ILS structures could prove increasingly attractive as a tool for managing cyber exposure, not because traditional capacity disappears, but because alternative capital may offer an additional source of scalable protection when conventional markets become constrained (so long as the risk/return profile remains attractive for ILS investors).
Scenario two suggests that the cyber insurance market may be approaching more than just an underwriting inflection point; the next phase of market development could also change how cyber risk is financed. While reinsurance remains the dominant absorber of cyber risk today, a more challenging market environment could gradually increase the role of capital markets.
While both trajectories remain possible, we consider scenario one to be more probable given that the decline in U.S. cyber insurance rates is beginning to decelerate. This slowing downward trend suggests that improved pricing discipline and more rigorous underwriting standards are recalibrating the market, likely preserving current structures and reinsurance availability. However, scenario two remains plausible should competitive pressures or excess capacity re-emerge, resulting in pressure on underwriting profitability that could trigger more selective deployment of traditional reinsurance capacity.
Manuel AdamFrankfurt+49-696-399-9199manuel.adam@spglobal.com
Paul AlvarezRichmond+1-202-383-2104paul.alvarez@spglobal.comTaoufik GharibNew York+1-212-438-7253taoufik.gharib@spglobal.com Johannes BenderFrankfurt+49-693-399-9196johannes.bender@spglobal.comRaam Ratnam, CFA, CPALondon+44-20-7176-7462raam.ratnam@spglobal.com
Charles-Marie DelpuechLondon+44-20-7176-7967charles-marie.delpuech@spglobal.com Alexander J GombachNew York+1-212-438-2882alexander.gombach@spglobal.comMaren Josefs London+44-20-7176-7050maren.josefs@spglobal.comSimon AshworthLondon+44-20-7176-7243simon.ashworth@spglobal.com
Ron A Joas, CPANew York+1-212-438-3131ron.joas@spglobal.com
