If you've renewed a cyber insurance policy in the last three years, you've probably watched your premium go down each time. That trend has held across nearly every region — the US, Europe, the UK, Australia and New Zealand — and it's easy to assume it just keeps going. It won't, and understanding why is more valuable to a business owner than the discount itself.

 

How the Cyber Insurance Market Got Here

Cyber liability insurance is a young line, but it hasn't behaved like one. Most insurance markets take decades to move through a full cycle of growth, correction and stabilization. Cyber has compressed that cycle into about ten years.

 

Before 2020, growth in cyber insurance was driven almost entirely by new buyers entering the market — pricing stayed flat while adoption climbed. Then came the 2020–2022 hard market: a wave of ransomware attacks drove annual rate increases near 70%, even as some businesses pulled back on the coverage limits they carried. Rates more than made up the difference, and the global cyber insurance premium base nearly doubled.

 

Since then, the market has spent three straight years giving that back. Falling loss activity, stronger cyber controls among policyholders, and a flood of new capacity have pushed cyber insurance premiums steadily downward. That's the environment most buyers know today: broader coverage, higher limits, and a rate that seems to only move in one direction.

 

Why Cyber Insurance Rates Are Starting to Flatten

The signal to watch is the United States, which accounts for roughly 70% of global cyber insurance premium and has historically been the first market to turn — in either direction.

 

US rate reductions have already slowed to the low single digits, down from double-digit and even 40%+ declines just a couple of years ago. Loss ratios in the US cyber market climbed from about 49% in 2024 to roughly 55% in 2025.  Add in a typical expense load, and current projections put the market-wide combined ratio at 97% for 2026 — a level with very little room left to absorb further rate cuts before underwriting results tip into unprofitable territory.

 

The rest of the world is a few steps behind the US, not on a different path:

• Europe remains deep in its softening phase, with rate decreases still common in the double digits and some individual accounts seeing corrections of 70%+ where pricing had lagged the broader market. But margin compression is already visible — modeling across different starting loss ratios shows even well-performing portfolios approaching profitability thresholds by 2027.
• The UK has shifted from 20–30% rate reductions to the mid-to-high single digits, with loss ratios rising from the 30–40% range to 50–60% as competition has pushed some carriers into looser underwriting standards, particularly in the SME segment.
• Australia and New Zealand are furthest from a floor, with SME rate reductions still running 10–15% per renewal. But even there, loss ratios are ticking upward, and the same forces — more capacity chasing flat demand — are starting to compress margins from a position of strength rather than distress.

The pattern across every region is the same: rates keep falling until margins run out of room, not until claims force the issue.

 

The Real Risk: Claims Are Quiet, Not Absent

This is the part worth sitting with. Reported cyber losses haven't spiked. Ransomware activity, in particular, has been relatively contained across most markets in the past year. On its own, that looks like a green light for more softening.

But a quiet claims environment isn't the same as a lower-risk one. Over the same period that pricing has fallen, cyber insurance coverage has quietly broadened — insurers have extended supply chain and contingent business interruption terms, raised limits, and loosened some underwriting requirements to stay competitive. Meanwhile, the underlying threat landscape hasn't relaxed at all:

• Business email compromise and funds-transfer fraud remain a steady source of attritional claims, especially for small and mid-sized businesses. In one recent sample, the median funds misdirected was around $26,000 — with a top loss north of $2 million.
• Supply chain and vendor concentration risk is rising as more of daily business runs through the same small set of cloud and software providers, meaning a single incident at one vendor can generate correlated losses across many otherwise-unrelated policyholders.
• Litigation and settlement timelines are lengthening in some markets, adding a longer "tail" to claims that used to resolve quickly.

None of this shows up as a single dramatic loss event. It shows up gradually, in loss ratios that creep upward even while headline claims stay calm — which is exactly the pattern showing up in every region right now.

 

What a Cyber Insurance Market "Finding a Floor" Means for Your Renewal

None of this points to an imminent hard market or a sudden spike in cyber insurance premiums. It points to something more useful to plan around: a transition from a buyer's market to a more selective, disciplined one over the next 12 to 24 months.

 

Two things are worth doing at your next cyber insurance renewal, while conditions still favor the buyer:

1. Lock in terms, not just price. A market nearing its floor tends to pull back on coverage breadth before it pulls back on rate. Favorable terms — higher limits, broader supply chain and business interruption coverage — are more available today than they're likely to be in a year or two. Negotiating those terms now, rather than chasing the lowest premium alone, is the more durable move.

 

2. Stress-test your coverage against the claims that are actually happening. Ransomware headlines shape a lot of buying decisions, but the steadier risks — business email compromise, funds-transfer fraud, vendor and supply chain exposure — are the ones quietly driving loss ratios higher across every region in this report. Confirm your policy responds to all of them, not just the scenario that makes the news.

 

The Bottom Line on Cyber Insurance in 2026

The cyber insurance market has moved through its early growth phase, its hard-market correction, and three years of steady softening — and it's now approaching the point where further rate decreases become harder to justify on the numbers. The US is closest to that inflection point; Europe, the UK, and ANZ are following the same trajectory at their own pace.

 

For businesses buying or renewing cyber liability insurance, that's not a reason for alarm. It's a reason to use the window that's still open — favorable pricing and broad coverage — to get the policy right before the market's discipline catches up with its pricing.