Global cyber insurance market has undergone significant changes in H1 2025, presenting both challenges and opportunities for retail agents. Increased competition has driven carriers to lower rates and offer more comprehensive policies.
The report warns that some policies may exclude coverage for cyber warfare or terrorism acts. Reviewing these exclusions and considering policies with coverage extensions is crucial.
Beinsure Cyber Market Forcast indicates increased market competition has softened rates and expanded insurance policy offerings. However, cyber warfare remains a growing threat.
From 2024 to 2025, the global cyber insurance market grew from $16.66 bn to $21 bn and is projected to reach $120 bn by 2032, demonstrating a substantial 24.5% CAGR during the forecast period
Insurers are leveraging advanced technological tools to assess risk and provide cybersecurity services alongside insurance coverage. This blending of insurance and security services represents an innovative shift in the market, aiming to provide a more holistic approach to cyber risk management.
For retail agents, this is an exciting time to stake a claim in the cyber insurance market. The most significant opportunity lies in cross-selling and introducing cyber insurance to first-time buyers, as overall adoption remains low with substantial room for growth.
Cyber warfare and nation-state cyberattacks
The rise of cyber warfare and nation-state attacks presents significant risks in 2024, necessitating policy evolution, according to Flow’s latest industry report.
Recent notable attacks against public utilities include hacktivist attacks on water utilities in November 2023, where CyberAv3ngers compromised programmable logic controllers at water utilities in North America, Europe, and Australia, disrupting services for two days in at least one community.
Chinese state-backed hackers infiltrated U.S. water facilities, raising concerns about potential disruptions during conflicts. A Russian-linked hacktivist group attempted to disrupt operations at several Texas water utilities in early 2024 (see Cyber Risk Insurance Market Global Trends).
David Derigiotis, Head of Insurance for Flow, emphasized the importance of critical coverage, noting that government and critical infrastructure clients, along with Fortune 500 organizations, face heightened risks compared to everyday businesses. While small and medium-sized businesses could become collateral damage in broader attacks, policy costs must be balanced with the insurance’s value.
Cyber Insurance Market Landscape
Capacity for cyber insurance is expanding, with insurers offering more varied and comprehensive policies. The past six months have seen high-profile cyber incidents and data breaches with the average breach costing a record high of $4.45 mn.
These numbers are greatly influencing pricing trends to more accurately reflect the heightened risk environment.
Additionally, a new regulatory landscape has emerged, with an increasing number of states introducing privacy laws and new rules regarding cybersecurity incident disclosure as adopted by the Securities and Exchange Commission (SEC).
New consumer privacy and data protection laws have now been instated in 18 states while many more bills are currently moving through various committees.
Cyber landscape continues to evolve rapidly
The cyber landscape continues to evolve rapidly with emerging threats like ransomware, AI-driven attacks, and supply chain vulnerabilities. These threats can lead to severe consequences, including prolonged business interruptions, major data breaches, significant financial loss, and hefty regulatory fines.
Ransomware and other forms of extortion are prevalent in 92% of industries, ranking as a top threat. These attacks now account for 23% of all breaches.
System intrusions are responsible for 36% of breaches. These intrusions involve unauthorized access to computer systems by cybercriminals aiming to steal sensitive information, disrupt operations, or deploy malware for malicious purposes.
State-sponsored threat group, Cozy Bear, also known as APT29, has been carrying out devastating cyber attacks on major corporations since late 2023.
Both Microsoft and Hewlett Packard have revealed this attacker group to be the culprit of the breaches on their respective systems.
Cozy Bear’s primary targets are U.S. and European diplomatic entities, governments, non-governmental organizations (NGOs), and IT service providers.
Their primary goals include gathering intelligence from government, diplomatic, and military organizations, and infiltrating key sectors such as energy, technology, and academia to collect sensitive data and advance Russia’s geopolitical interests.
FAQ
The global cyber insurance market grew from 16.66 billion dollars in 2024 to 21 billion dollars in 2025 and is projected to reach 120 billion dollars by 2032, with a 24.5% compound annual growth rate (CAGR). This growth is driven by increased cyber threat activity, evolving regulatory landscapes, and rising demand from previously uninsured sectors. The market is now more competitive, with insurers lowering rates, offering broader coverage, and integrating cybersecurity services with traditional policies.
Several evolving threats are reshaping underwriting and pricing decisions:
Ransomware now affects 92% of industries and accounts for 23% of all breaches.
System intrusions, including malware deployment and data theft, cause 36% of breaches.
AI-driven cyberattacks and vulnerabilities in software supply chains are increasing.
Nation-state attacks and cyber warfare are escalating, with incidents targeting critical infrastructure in the US, Europe, and Australia. Groups like Cozy Bear (APT29) have infiltrated major corporations, including Microsoft and Hewlett Packard.
These threats have increased the cost and complexity of cyber incidents, reinforcing the need for adaptable, robust policies.
While coverage has expanded, some cyber insurance policies exclude key risks such as cyber warfare or terrorism-related events. These exclusions are increasingly relevant given the rise in state-sponsored attacks. Retail agents and policyholders must review exclusions carefully and consider policies offering coverage extensions or endorsements for high-impact events. Transparency and clarity in terms are now major expectations from insured parties.
A growing number of jurisdictions are enacting privacy and cybersecurity regulations. In the US alone, 18 states have implemented new consumer privacy laws, with others considering similar measures. The SEC has introduced mandatory disclosure rules for cybersecurity incidents, increasing reporting requirements for publicly traded companies. These developments are creating greater exposure to regulatory fines and litigation, prompting businesses to seek more comprehensive insurance protection.
Retail agents are well-positioned to capitalize on the growth of the cyber insurance market, particularly through cross-selling and onboarding first-time buyers. With overall market penetration still relatively low, there is significant untapped potential across small and mid-sized businesses. Agents can differentiate themselves by offering tailored coverage, explaining policy terms in plain language, and guiding clients through both the risk landscape and compliance requirements. The integration of cybersecurity services with insurance products also presents new value propositions for agents.