Cyber insurance rates fell for 13 quarters running; US rates went flat

01Thirteen quarters down, and the US line has reached zero

The global line crossed below zero in the third quarter of 2023, when Marsh recorded a 2% fall after a 1% rise in the quarter before.⁵ The decline deepened to between 6% and 7% a quarter through 2024 and 2025, then eased to 5% in the first quarter of 2026 and 4% in the second and third.⁶⁷¹ The US line fell more gently and earlier: Marsh dates US declines to the second quarter of 2023, and the cuts shrank from 4–6% in 2023 and 2024 to 2% in the first half of 2026 before reaching zero.¹⁰³

02What drives it: capacity in, claims steady, severity up

Marsh’s explanation is supply. “Capacity continued to expand through new entrants and MGAs despite ongoing consolidation”, and many buyers spent the room on broader cover and lower retentions. Across all lines it cites strong insurer profitability, surplus capital, cheaper reinsurance and higher investment returns.¹² On claims, Marsh says frequency “stayed steady and severity continued to rise even as rates fell”.² In the US it lists what underwriters are watching: music copyright claims under the media cover, which it says are affecting loss ratios; rising non-breach privacy claims over website tracking; and vendor incidents that hit “thousands of downstream organizations”.³ One claim cost has fallen: the share of US ransomware claims in which a ransom was paid was below 20% in 2025, against about 60% in 2019.⁸

Whether flat US rates mark a turn is disputed. Marsh’s own words are “early signs of rate stabilization” and a pace of decline “suggesting a degree of stabilization”; it makes no forecast of increases.² In September Michael Spinks of the underwriter CFC told Insurance Business he believes the market is closer to the bottom of the cycle than the top, with some rates “approaching 2019 pre-hard market levels”; the same report cited AM Best’s US cyber loss ratio, up 4.3 points to 53% in 2025.¹¹ In August Colin Fox of Integrity, part of Hayes Parsons, said “I don’t think it’s sustainable” and saw early US hardening that could reach UK prices in six to twelve months; Selorm Kofi Domeh of Talbot Jones argued that a profitable book and healthy competition could let current pricing hold.¹²

03What it means at renewal: lower prices, the same questions, more exclusions

Outside the US the arithmetic still favours the buyer: Marsh recorded third-quarter falls of 5% to 11% in every other region, and in Europe long-term agreements, reinstated limits and AI endorsements were still on offer, some from only a small number of insurers.² Lower prices have not removed the underwriting test. Marsh’s list of twelve controls, written in the hard market of 2022, opens with MFA for remote and privileged access and includes secured, encrypted and tested backups and endpoint detection and response (EDR); Marsh said then that adopting certain controls had become “a minimum requirement of insurers”.¹³ In 2026 Marsh still reports that accounts with well-documented risks and good loss records get the better outcomes, and insurers now add AI: “most asking questions on AI exposure, use, and controls or protections”.²¹⁰

The exclusions matter as much as the price. Since 31 March 2023 Lloyd’s has required every standalone cyber-attack policy written in its market to carry a state-backed cyber-attack exclusion that meets its standard, at inception or renewal.¹⁴ Marsh says US clients reread war exclusions in early 2026 given tension in the Middle East, that some insurers added “clarifying AI endorsements” whose wording clients must test against their own use of AI, and that cyber exclusions “largely remained in place” in US property policies.⁹³