The relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defense process.
While cyber insurance has existed for years, the ransomware boom of the late 2010s and early 2020s transformed it from a niche risk transfer product into a central component of many organizations’ security strategies. Today, policies cover everything from incident response and business interruption to legal costs and, in some cases, ransomware payments. Some of the names you’ll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.
The threat landscape, especially when discussing enterprises, was never moving at a slow pace. But compared to the business email compromise and conventional ransomware attacks of five or 10 years ago, techniques are now evolving faster than ever, meaning insurance agencies must work harder to keep up.
Large language models (LLMs) have enabled threat actors to orchestrate complex attacks, streamline malware and exploit development, design phishing lures without typos, and operate at a scale never before possible. AI introduces uncertainty into threat models built largely around ransomware and data extortion attacks, which insurers have accumulated years of claims data around. Social engineering advancements could alter both attack frequency and severity faster than historical loss data can account for.
While outside of AI, attackers are also coming up with new social engineering tactics all the time, and cloud resource consolidation means compromised credentials or a single stolen API key can lead to devastating consequences.
Thomas Pytel, vice president at Cowbell, tells Dark Reading his firm believes in underwriting that continuously adapts to risk. “AI is changing the speed, scale, and credibility of phishing and impersonation, so historical loss experience alone is insufficient. Underwriting must assess how a business verifies identities, authorizes payments, and controls its own use of AI,” he says.
According to a 2025 report from the National Association of Insurance Commissioners (NAIC), cyber insurance premiums reached nearly $15 billion in 2024, up 7% year over year. Additionally, direct written premium (DWP) for the US market reached roughly $9.14 billion in 2024, compared with a market that was only a fraction of that size several years earlier. This underscores how cyber insurance has evolved to become a highly significant segment of the cyber-risk ecosystem.
On the other hand, that same NAIC report cited nearly 50,000 claims across the US in 2024, the highest on record and a nearly 40% increase year over year. This could speak to the increasing number of customers choosing insurance, the aggressiveness of attackers, or both.
What remains to be seen is whether the industry’s growth has outpaced its ability to accurately model the threat landscape.
Broader Threat Landscape Means Stricter Underwriting Requirements
Increasing insurance popularity also gave way to the rise of certain requirements for coverage, primarily demanding insurance customers uphold a certain quality of cybersecurity posture.
George Gerchow, IANS faculty and chief security officer at Bedrock Data, tells Dark Reading that a few years ago, these requirements were contained on a short form that “no one checked,” but insurers now expect multifactor authentication (MFA), endpoint detection and response (EDR), immutable backups, and privileged access controls, while “some are moving to continuous telemetry instead of a once-a-year attestation.”
Daniel Woods, head of emerging risks at Coalition, agrees. He says legacy underwriting models based on point-in-time questionnaires cannot keep pace, and this has been true since the ransomware epidemic took hold around 2020.
This occurred amid concerns that organizations would use cyber insurance as a replacement for patching, practicing defense in depth, or using strong data and authentication controls.
Better posture may be an objective net good no matter where it comes from, though it also risks turning security into a compliance exercise. Gerchow says these requirements can feel like that depending on who you ask.
“Insurance did more to get MFA and EDR deployed in the mid-market than any of us standing on a stage, and that part worked,” he says. “But the application is a snapshot, and too many teams treat passing it as the goal. The carrier finds the gap for you at claim time. Lapsed MFA or an untested backup you attested to is now one of the fastest ways to get a claim denied.”
Jeremiah Grossman, CEO of cyber loss prevention vendor Root Evidence, says insurance carriers are requiring more to be implemented, steadily, year over year, and “it seems to be working well for many.” However, he says, “The issue is that organizations tend to not have the data to properly measure and model their risk, and their carriers are often in a better position to do so.”
Cyber Insurers Become Active Players
One relatively recent development in this space has been the rise of insurance organizations as active participants in the security process. While insurers these days broadly require MFA, security products like EDR, managed detection and response (MDR), and validated backups, insurance firms will also offer security products and services directly to their customers.
Coalition’s offering includes access to an automated detection and response product, for example, while Resilience offers risk management tooling and Cowbell offers services including risk assessment, penetration testing, and training. All of these firms also work with other security vendors to recommend preapproved products and incident response services. While on the other end, traditional security vendors like Arctic Wolf offer products specifically for insurability.
Coalition argues its “Active Insurance” model has resulted in 73% fewer claims than the industry average and is why 56% of claims reported in 2024 were resolved with no out-of-pocket expense to those insured. Woods says that as the threat landscape intensifies, insurers that passively issue policies and hope claims do not exceed premiums will face increasingly worse results.
“The solution is for insurers to bring threat researchers and security experts in-house to monitor the threat landscape and actively support customers in improving protections during the life cycle of their policies,” he says. “Risk transfer is still a fundamental component of cyber insurance, but so is ongoing protection and prevention.”
Some risk remains difficult to model. Gerchow argues that if a crisis were to occur tomorrow where a major cloud or identity provider was taken down or compromised, the market would struggle to absorb it, and, he says, “the carriers know it.”
“Look at where policy language is moving: war exclusions applied to nation-state activity with no declared conflict, widespread-event carve-outs, and small sublimits for dependent business interruption. CrowdStrike in 2024 was a bad update with no attacker anywhere in it, and it still grounded flights and stalled hospitals in a single morning,” he says. “A real compromise of a major identity provider means every downstream customer needs forensics, counsel, and notification at the same time. If I’m a CISO this week, I’m reading the systemic-event exclusions in my policy first and assuming a big piece of that loss stays with me.”
