The US insurance regulators’ annual cyber market report shows large companies are claiming less often, but their average claim now costs twice as much as a year earlier. With a London market heavyweight among the top three US cyber writers, the numbers matter to UK buyers and underwriters as much as to American ones.
What happened
On Wednesday 21 October 2026 the National Association of Insurance Commissioners (NAIC), the body that coordinates US state insurance regulators, released its annual cyber insurance market study, covering the 2025 calendar year. It draws on regulatory filings rather than broker surveys.
The headline growth figures are striking. Cyber premium written by US-domiciled insurers reached $7.46bn in 2025, up from about $2.75bn in 2020. Add the roughly $2bn written by non-US “alien” surplus lines carriers and the total comes to around $9.46bn, a 3.5% rise that returned the market to growth after its first ever contraction in 2024. The number of domestic policies grew by a third to 5.84 million, while claims reported to insurers were up a fifth at 56,323.
The finding that stands out, though, concerns the largest buyers. For businesses with at least $1bn in annual revenue, the report records 10 claims per 100 policies in 2025, down from 15. Yet the average claim from that group doubled to $4.4m, and is up 586% since 2021. Mid-market average claims rose 23% to $759,000, while the average for smaller firms fell from $215,000 to $142,000.
The biggest three writers by premium volume are Chubb, Beazley and St. Paul Travelers, as Cybersecurity Dive also reported.
The detail
The NAIC offers a cautious explanation for the large-firm pattern. Tighter underwriting and better security controls may be stopping more incidents from becoming claims, it suggests, while the events that do get through are increasingly expensive. It points to rising business interruption costs and the growing bill for breach and privacy litigation as the main drivers of severity.
Profitability is also moving the wrong way for insurers. Across the industry, losses climbed to 53% of premium against 48.7% a year earlier, a second annual rise in a row, according to Business Insurance. The deterioration sat mainly in primary cyber policies, where the loss and defence cost ratio rose by around eight points to 57%. Meanwhile prices kept falling: regulatory intelligence service Regxplora notes the first quarter of 2026 as the eighth successive quarter of US cyber rate cuts.
Much of the growth in policy numbers came from cyber cover bolted onto other commercial policies. According to Business Insurance, endorsements account for close to two in three policies but only around 4% of premium, while primary cyber policies carry about 64%.
On the threat side, the regulators list frontier AI, a maturing criminal ecosystem, nation-state activity and supply chain exposure. They single out supply chain risk as “the defining challenge of the current cycle”, because a single incident or flaw can hit large numbers of insureds simultaneously. Concentration among cloud providers is flagged as a particular source of potential simultaneous claims.
Why it matters for UK organisations
This is a US report, but the cyber market is not neatly national. Beazley, the London-headquartered specialist that Zurich took over this month, ranks among the top three US writers, a reminder of how closely the American book is tied to the London market. Loss trends in the US flow into London underwriting appetite, and from there into the terms UK companies are offered.
For UK buyers, three points stand out from the analysis.
First, severity is the number to watch. Comfortable loss ratios were the backdrop to the soft market UK buyers have enjoyed. A rising one, combined with eight straight quarters of US rate cuts, is the classic precursor to underwriters tightening up. Larger UK organisations renewing in the next year should not assume today’s direction of travel is permanent.
Second, the large-firm data is consistent with something UK insurers have been saying for some time: controls may influence frequency, even if they do not stop expensive events. That should strengthen the hand of organisations that can evidence mature security in renewal conversations.
Third, the regulators’ focus on correlated supply chain and cloud losses is directly relevant to UK firms, which rely on the same handful of cloud and software providers. Policy wording on systemic events, war exclusions and dependent business interruption will matter more, not less. Regxplora’s summary highlights lingering doubt over how social engineering, payment diversion fraud and war exclusions are treated.
Cover embedded in package policies is another issue that crosses the Atlantic: many UK SMEs hold cyber as an add-on without knowing its limits, and the NAIC’s endorsement figures show how much US cover is sold the same way.
Expert view
From the testing side of the fence, the frequency finding rings true. When we assess large organisations that have invested properly in identity controls, segmentation and logging, the easy routes in are far fewer than they were five years ago. What remains tends to be the hard stuff: a compromised supplier, a flaw in a widely used platform, or a recovery process that has never been tested at scale. Those are exactly the events that produce long outages and big legal bills.
In my experience, many boards still treat cyber insurance as the plan for a bad day rather than one element of it. A $4.4m average is a reminder that the policy limit, the business interruption waiting period and the panel response arrangements need to be read as carefully as any technical control. One year’s frequency drop is a signal, not yet a trend.
The supply chain warning is the part I would put in front of a UK risk committee. Correlated losses are what make insurers nervous, and what they fear they will eventually price for or exclude.
What to do now
- Read the wording before renewal. Check how your policy treats cloud provider outages, dependent business interruption, systemic events and war exclusions, and get answers in writing.
- Size limits against severity, not frequency. Model the cost of a multi-week outage plus litigation, not just the incident response retainer.
- Evidence your controls. Multi-factor authentication, patching cadence, privileged access and tested backups are what underwriters ask about. Cyber Essentials covers the baseline (user access control, security update management, secure configuration); Cyber Essentials Plus gives independent proof.
- Map critical suppliers. List the cloud, software and managed service providers whose failure would halt the business and rehearse that scenario.
- Check for embedded cover. If cyber sits as an endorsement on a package policy, confirm its limits and whether a standalone policy is warranted.
- Test recovery. Restore a critical system from backup end to end, timed, before the renewal meeting.
Bottom line
The NAIC data paints a market that is bigger, cheaper and, for insurers, slowly less profitable. Large firms are claiming less often but paying far more when things go wrong, and supply chain events threaten losses that land on many policyholders at once. UK buyers should enjoy soft pricing while it lasts, but use it to buy the right cover and prove their controls, not to cut corners.
Sources
- NAIC: 2026 Report on the Cybersecurity Insurance Market
- Cybersecurity Dive: Large businesses’ cybersecurity insurance claims are now less frequent but more expensive
- Business Insurance: U.S. cyber premiums rebound, policy numbers surge: NAIC
- Regxplora: NAIC reports 33% growth in cyber policies and 20% increase in claims for 2025
