Cyber premiums fall, but fears of underpricing loom

Cyber insurance rates have fallen across the board, giving buyers room to renegotiate – but behind the numbers, concern is building over what comes next. “If we were to exclude distressed situations, most buyers are seeing flat to moderate decreases at renewal,” said David Wasson (pictured), senior vice president at Brown & Brown Insurance Services. 

Wasson reviewed his firm’s single-layer primary placements and found an average premium reduction of 13.5%, with media accounts trending closer to 18.5%. But he said the numbers don’t tell the full story. “We’re seeing a lot of outliers… sometimes reductions of 25, even 50 percent,” he said. Those sharp declines tend to come through a mix of moderate cuts on the primary layer and much steeper discounts on excess layers – particularly for firms that faced the brunt of the 2020–2023 hard market. 

Are you an insurance innovator? Tell us — we want to hear your story

This downward trend may benefit insureds in the short term, but Wasson warned that it could set the stage for renewed volatility. “If claims activity is stable, but the pricing deteriorates significantly, that could be enough to trigger another hard market,” he said. “And I do worry a little bit about how that would be perceived.” 

Pressure on pricing, friction in underwriting 

Pricing wasn’t the only factor shifting in 2024. Wasson pointed to a noticeable decline in underwriting scrutiny over the past two years, especially for middle-market and small-business buyers. “We are seeing… decreased pricing but also decreased scrutiny in underwriting, and the decrease in the last 24 months has been pretty dramatic,” he said. 

The adoption of scan-based underwriting tools – once the domain of insurtech startups – has now become widespread, including among traditional carriers. These tools leverage third-party and proprietary technologies to assess cyber risk with limited human intervention. Reactions from clients have been mixed. “Some think it’s valuable and forward-thinking. Others view it a little more cautiously or a little bit more skeptically,” said Wasson. 

Artificial intelligence, while dominating headlines, has had minimal impact so far on cyber insurance policies. “There’s been maybe a handful of fairly superfluous coverage changes… mostly clarifying that a claim includes a claim that’s triggered by artificial intelligence,” said Wasson. The bigger risk, he suggested, is how AI endorsements from other product lines may begin to blur boundaries and increase pressure on cyber policies. “We might see certain elements of other coverages start to cause some pressure for the cyber market,” he said. 

Mismatch in exposures and limits 

Third-party exposure remains one of the sector’s biggest blind spots. Studies have suggested that 30–40% of insured cyber events are triggered by third parties – a rate Wasson believes is unusually high. “Even if you think of auto… it’s unlikely that anybody’s going to hit several million cars at once,” he said. 

While the market has kept up with evolving threats – ransomware being a prime example – some risks are still hard to insure. “It’s still difficult to transfer significant amounts of risk for things like social engineering fraud, invoice manipulation, other types of more heavily financial crimes,” he said. 

Other gaps lie in demand-side risk transfer. The Jaguar Land Rover incident, Wasson said, highlighted how the industry still lacks a viable mechanism for protecting against demand-side interruptions – when a buyer can’t consume a service due to their own cyber event. “There’s really not much opportunity to transfer that risk right now,” he said. 

That lack of standardization extends to wrongful collection claims, an area where coverage terms remain inconsistent. “Some carriers just plain won’t provide the coverage. Some provide defense only,” said Wasson. “There’s just not the degree of standardization with wrongful collection that we see with other coverage concepts.” 

Too much competition, too little margin 

Looking forward, Wasson said his biggest concern is underwriting discipline. “Some carriers are being very, very competitive. And I do have some concerns that rates might be getting a little thin,” he said. The market doesn’t need a surge in claims to collapse again – just a continued deterioration in pricing. “If we see the next hard market sooner rather than later… that could cause a negative reputational impact,” he added. 

He sees room for growth in the small-business segment, where take-up rates remain low. But scaling that business comes with execution risk. “When you’re doing things at scale, it’s typically based on the infrastructure that you set up,” Wasson said. “If that infrastructure turns out to not be great… that can really turn buyers or brokers off.” 

Underinsurance is also prevalent, particularly in how clients balance cyber and property coverage. “We still see a lot of buyers that are buying far below their probable maximum loss,” he said. Even companies buying $500 million in business interruption for property often carry just $50 million for cyber. With prices softening, Wasson said now is the time to right-size those programs – but uptake has been slow. “We don’t see it quite as often as I expected we might,” he said. 

Frictions persist despite advances 

Despite advances in technology and product design, friction in the underwriting process remains high. Wasson pointed to two persistent challenges: the first is growing demand for peripheral coverages that lack appetite in the market—risks tied to consumer protection statutes like Telephone Consumer Protection Act or Fair Credit Reporting Act. “Those coverages sort of often lack a good home… and it’s enormously difficult,” he said. 

The second is a disconnect between underwriters and insureds, particularly on technical requirements. “Things are getting so detailed that it can often cause friction in the underwriting process,” said Wasson. Smaller buyers who outsource IT functions often struggle to answer granular technical questions, leading to delays and frustration. “You’re playing a bit of a telephone game,” he said.