From Niche Product to Core Security Strategy
Cyber insurance isn’t new, but its role has changed dramatically. The ransomware surge of the late 2010s and early 2020s turned what had been a specialty product into something close to a standard business expense, covering incident response, legal fees, business interruption, and in some cases ransomware payments themselves. That growth has been substantial: according to a 2025 report from the National Association of Insurance Commissioners, US cyber insurance premiums reached nearly $15 billion in 2024, up 7% from the prior year, with direct written premium in the US market alone hitting roughly $9.14 billion — a figure that dwarfs the market of just a few years earlier.
But growth in premiums has come with growth in claims. The same NAIC data cited nearly 50,000 claims across the US in 2024, the highest on record and a jump of almost 40% year over year. That doesn’t necessarily mean attacks are getting more frequent — it could reflect more companies buying coverage in the first place, more aggressive attackers, or some combination of both. What it does suggest is that insurers are underwriting a moving target, and the methods they’ve relied on to price that risk may not be keeping pace.
Why the Old Playbook Is Losing Its Grip
Traditional underwriting worked something like an annual health checkup: a company filled out a questionnaire once a year, insurers compared it against historical claims data, and a premium was set. That approach assumes two things that no longer hold as firmly as they once did — that threats evolve slowly, and that a snapshot taken once a year stays accurate for the next twelve months.
Generative AI tools have made that assumption shaky. Large language models let attackers write convincing phishing emails without the spelling mistakes that used to be a tell, impersonate executives with unsettling fluency, and scale social engineering campaigns in ways that were previously labor-intensive. Thomas Pytel, vice president at Cowbell, put it plainly: "AI is changing the speed, scale, and credibility of phishing and impersonation, so historical loss experience alone is insufficient. Underwriting must assess how a business verifies identities, authorizes payments, and controls its own use of AI".
Cloud concentration adds a second complication. Many organizations now depend on a small number of shared cloud and identity platforms to run core operations, which means a single stolen credential or compromised API key can cascade into a much larger disruption than it would have a decade ago, when systems were more siloed. Insurers built their models on a world of isolated incidents; they’re now pricing risk in a world of interconnected failure points.
What Insurers Are Starting to Demand
In response, the questionnaire has gained teeth. George Gerchow, chief security officer at Bedrock Data, describes the old process bluntly: a short form that "no one checked." Today, he says, insurers expect multifactor authentication, endpoint detection and response tools, immutable backups, and privileged access controls as baseline requirements, with some carriers moving toward continuous telemetry rather than a once-a-year attestation. Daniel Woods, head of emerging risks at Coalition, says legacy underwriting based on point-in-time questionnaires simply can’t keep pace with how threats evolve — a gap that’s been widening since the ransomware epidemic took hold around 2020.
The table below captures the broad shape of that shift, though the pace and specifics vary by insurer and industry.
| Aspect | Traditional underwriting | Active, continuous underwriting |
|---|---|---|
| Assessment frequency | Annual questionnaire | Ongoing telemetry and periodic reassessment |
| Basis for pricing | Historical claims data | Historical data plus real-time posture signals |
| Required controls | Loosely defined, rarely verified | MFA, EDR, immutable backups, access controls expected |
| Insurer’s role | Pays claims after an incident | Offers monitoring, tooling, and incident support |
| Risk of gaps | Discovered after a breach occurs | Surfaced earlier through continuous checks |
This evolution also explains why some insurers now sell security services directly rather than simply writing policies. Coalition offers detection and response tooling to its policyholders, Resilience provides risk management software, and Cowbell offers services like penetration testing and employee training. The logic is straightforward: an insurer that helps prevent a claim is better off than one that waits to pay for it. Coalition has argued its "Active Insurance" approach has produced far fewer claims than the industry average, and that most of its 2024 claims closed without any out-of-pocket cost to the policyholder — though that’s a vendor’s own characterization of its performance, not an independently audited outcome.
The simplified flow below shows how this active model is meant to work across the life of a policy.
flowchart TD A[Application and control checks] --> B[Policy issued with required controls] B --> C[Continuous monitoring and telemetry] C --> D[Insurer-supported detection and response] D --> E[Incident occurs] E --> F[Claim reviewed against attested controls]
The Risk of Turning Protection Into a Checkbox
There’s a genuine upside here. As Gerchow notes, "insurance did more to get MFA and EDR deployed in the mid-market than any of us standing on a stage". When a financial incentive pushes smaller companies — the ones least likely to have dedicated security teams — toward basic protections they might otherwise skip, that’s a meaningful improvement in the overall ecosystem’s resilience.
But the same dynamic carries a risk: treating the application as the finish line rather than the starting point. Gerchow warns that "the application is a snapshot, and too many teams treat passing it as the goal," noting that lapsed MFA or an untested backup that was attested to on paper is now one of the fastest ways a claim gets denied. Jeremiah Grossman, CEO of Root Evidence, adds a related concern: many organizations simply lack the internal data to measure their own risk accurately, leaving the insurer — ironically — better positioned to understand the company’s exposure than the company itself. That’s a meaningful detail for any business owner who assumes a signed policy means genuine protection: it doesn’t, by itself, and insurers increasingly expect to see evidence, not promises.
The Risk Nobody Has Fully Priced Yet
Even an actively engaged insurer can only model so much. Some scenarios remain genuinely hard to quantify — namely, what happens if a major cloud platform or identity provider suffers a widespread outage or compromise. Gerchow points to the 2024 CrowdStrike software update issue as a preview: a flawed update with no attacker involved still grounded flights and disrupted hospitals in a single morning. A genuine compromise of a major identity provider, he argues, would force every downstream customer into simultaneous forensics, legal response, and notification obligations — a scenario insurers are responding to by tightening policy language around war exclusions, widespread-event carve-outs, and sublimits on dependent business interruption. None of this means such an event is imminent or inevitable, but it does mean the industry itself is signaling uncertainty about how fully it could absorb one.
What This Means for Companies Buying Coverage
The practical takeaway isn’t that cyber insurance has become untrustworthy — it’s that it has become more demanding, and rightly so. A policy is increasingly a reflection of an insurer’s confidence in a company’s actual defenses, not a replacement for them. For any organization treating a signed policy as the end of its security obligations, the message from this shift is clear: read the exclusions, keep the controls you attested to actually running, and remember that even the most engaged insurer is still pricing a threat landscape that keeps moving faster than the data behind it.
