UK cyber insurance got cheaper again in the third quarter of 2026: Marsh’s latest pricing index shows UK rates down 7%, a steeper fall than the 5% recorded in the spring. For buyers this is a strong moment to renegotiate, but only if they use it to fix the gaps in their cover and controls, not just to bank a lower premium.
What happened
On 21 October 2026 Marsh published its Global Insurance Market Index (GIMI) for the third quarter. Across all commercial lines and all regions, average rates fell 5%. That is the ninth quarterly decline in a row, following a 6% fall in Q2.
The UK fell faster than the world as a whole. Composite UK commercial rates dropped 8%, the same as in each of the two previous quarters, which makes this the eleventh straight quarter of falling UK prices. UK property fell 11%. UK financial and professional lines fell 5%, compared with 4% the quarter before.
Cyber is the line that matters here. According to Marsh’s UK commentary, reported by Insurance Business, UK cyber rates fell 7% in Q3, after a 5% drop in Q2. Globally, cyber rates fell 4%, the same pace as Q2 and the thirteenth successive quarter of reductions. The United States was the exception: cyber pricing there was flat after a long run of cuts, while every other region kept getting cheaper.
John Donnelly, president of global placement at Marsh Risk, said many buyers had been “more inclined to retain premium savings” than to spend them on extra cover, with geopolitical and economic uncertainty in the background.
The detail
Marsh puts the soft market down to plenty of capital and fierce competition. Insurers are profitable, reinsurance is cheaper, investment returns are higher, and a quiet US hurricane season helped underwriting results. In cyber specifically, new carriers keep arriving. Marsh says many buyers used that extra capacity to widen their cover and secure lower retentions, the insurance term for the excess the policyholder pays before the insurer does.
The UK cyber commentary adds three points worth noting. First, the fall speeded up slightly in Q3, but the cuts are smaller than in earlier quarters of the cycle, which suggests the sharpest cuts of this soft cycle may be behind us. Second, insurers holding existing accounts generally sought to keep them. Buyers thinking of moving are weighing price against continuity and the claims expertise of their current insurer. Third, Marsh says well-prepared renewals still get noticeably better results, even though buyers broadly hold the advantage.
One detail from the property market affects security teams too. Marsh notes that cyber exclusion wording was actively debated in UK property placements during the quarter. That is the old “silent cyber” question: whether a cyber event that causes physical damage or business interruption is covered by a property policy or deliberately excluded from it.
Why it matters for UK organisations
A falling market changes the negotiation. In a hard market, insurers set the terms and buyers with weak controls struggle to get cover at all. Eleven quarters of UK rate cuts have shifted that balance. A mid-sized firm renewing this winter can reasonably expect to pay less, ask for more, or both.
There are two catches. The first is that the price is falling faster than the threat. This autumn has brought a series of supplier compromises and mass-exploitation campaigns that hit UK public services and businesses at the same time. Those are exactly the correlated, many-victims-at-once events that cyber underwriters worry about most. Cheaper cover does not mean lower risk. It reflects how much capital is chasing premium.
The second catch is that the cycle will turn. Insurance prices move with losses, and the pattern after bad loss years is well established. If a major systemic cyber event hits the market, today’s generous terms could be pulled back quickly at the next renewal. Organisations that use this period to lock in sensible wording and multi-year deals, and to improve the controls insurers ask about, will be better placed than those that simply take the discount.
Government and industry surveys have repeatedly suggested that many UK small businesses still do not hold dedicated cyber cover or are unclear what it pays for. A buyer’s market is the cheapest point at which to fix that.
Expert view
In my experience, the renewal questionnaire is where security and insurance meet, and in a soft market it is too easily treated as paperwork. When the market was hard, insurers wanted evidence: multi-factor authentication on remote access and email, an offline or immutable backup, endpoint detection, a patching cadence for internet-facing systems. Those questions have not gone away just because capacity is plentiful. What has changed is that a buyer with a well-documented security programme now has real leverage to turn that evidence into better terms.
When we test organisations, the findings that would cause trouble at claim time are rarely exotic. They are an MFA exception for a service account, a VPN appliance two patches behind, or a backup that shares credentials with the domain it protects. If the proposal form said those controls were in place and the incident shows otherwise, a cheap policy can become a disputed one.
Boards are also being pushed to treat cyber as a business risk with a named owner. Insurance is one of the few places that risk gets a price, so a falling price reflects market conditions, not a smaller risk.
What to do now
- Start renewals early and go in prepared. Marsh is clear that preparation still separates outcomes. Gather evidence of controls, recent test results and incident response arrangements before approaching the market.
- Check every answer on the proposal form against reality. Confirm MFA coverage, patch levels on internet-facing systems and backup isolation actually match what you declare. These line up with the Cyber Essentials controls on user access, security update management and secure configuration.
- Spend some of the saving on cover, not just the budget. Use the soft market to review limits against a realistic worst case, remove restrictive ransomware or supplier sub-limits, and negotiate lower retentions.
- Read the exclusions in your property and cyber policies together. Make sure an event that causes physical damage or business interruption is not left uncovered because each policy points to the other.
- Look at contingent business interruption. Given recent supplier and cloud incidents, check whether an outage at a key third party triggers your cover.
- Consider a long-term agreement if your broker can secure one on good wording, to carry today’s terms into a harder market.
- Weigh incumbent claims expertise against price. A cheaper insurer with no track record of handling your sector’s incidents may cost more when you need it.
Bottom line
Marsh’s Q3 index confirms that UK cyber insurance remains firmly a buyer’s market, with rates down 7% and capacity still growing. That is good news for budgets, but the threat has not eased. The organisations that gain most will be those that turn the discount into better cover and back their proposal forms with controls that hold up when a claim is tested.
