--- title: "Cyber insurance rates fell for 13 quarters running; US rates went flat" summary: "The quarterly change in cyber insurance rates at renewal, globally, in the US and by region, Q2 2023 to Q3 2026, from Marsh's Global Insurance Market Index." url: https://www.thetechbag.com/blog/cyber-insurance-prices-thirteen-quarters-down format: Trend desk: "Security operations" published: 2026-10-21 facts_checked: 2026-10-21 author: TechBag (The TechBag Journal) tags: ["cyber insurance","Marsh","Global Insurance Market Index","insurance rates","soft market","underwriting","MFA","EDR","backups","war exclusion","Lloyd's","IRDAI"] cover: https://www.thetechbag.com/blog/covers/cyber-insurance-prices-thirteen-quarters-down.png --- # Cyber insurance rates fell for 13 quarters running; US rates went flat *The quarterly change in cyber insurance rates at renewal, globally, in the US and by region, Q2 2023 to Q3 2026, from Marsh's Global Insurance Market Index.* Trend · Security operations · By TechBag · Published 2026-10-21 · Facts checked 2026-10-21 · Canonical: https://www.thetechbag.com/blog/cyber-insurance-prices-thirteen-quarters-down The short version - Global cyber insurance rates fell 4% in the third quarter of 2026, the 13th quarter in a row of year-on-year declines, by Marsh’s index. In the US they were flat, after 13 straight quarters of decreases.[1][3] - Marsh puts the fall down to capacity: new insurers and agencies keep entering. It also says claim frequency is steady and severity is still rising. It calls the US reading “stabilization”, not a turn; brokers and underwriters quoted this year disagree on what comes next.[2][11][12] - At renewal, cheaper cover still comes with the controls questionnaire (MFA, backups, EDR), new questions on AI, and exclusions for war and state-backed attacks. India saw some of the steepest cuts in Marsh’s region; IRDAI publishes no rate series we found.[4][13][14] Cyber insurance is still getting cheaper almost everywhere except the US, where the fall has stopped. Marsh’s Global Insurance Market Index, released on 21 October, put global cyber rates down 4% from a year earlier in the third quarter, the same as in the second quarter. Rates were flat in the US “after an extended period of declines”, while every other region kept falling.[1] The US is the first of Marsh’s eight regions where the fall has stopped. ## Thirteen quarters down, and the US line has reached zero The global line crossed below zero in the third quarter of 2023, when Marsh recorded a 2% fall after a 1% rise in the quarter before.[5] The decline deepened to between 6% and 7% a quarter through 2024 and 2025, then eased to 5% in the first quarter of 2026 and 4% in the second and third.[6][7][1] The US line fell more gently and earlier: Marsh dates US declines to the second quarter of 2023, and the cuts shrank from 4–6% in 2023 and 2024 to 2% in the first half of 2026 before reaching zero.[10][3] **Figure: Global cyber rates have fallen for 13 quarters; the US decline reached zero in Q3 2026** *Year-on-year change in cyber insurance rates at renewal, %, Q2 2023 to Q3 2026* | | Global | US | | --- | --- | --- | | Q2 2023 | 1 | -4 | | Q3 2023 | -2 | -6 | | Q4 2023 | -3 | -4 | | Q1 2024 | -6 | -6 | | Q2 2024 | -6 | -5 | | Q3 2024 | -6 | -4 | | Q4 2024 | -7 | -5 | | Q1 2025 | -6 | -4 | | Q2 2025 | -7 | -3 | | Q3 2025 | -6 | -3 | | Q4 2025 | -7 | -3 | | Q1 2026 | -5 | -2 | | Q2 2026 | -4 | -2 | | Q3 2026 | -4 | 0 | Source: Marsh, Global Insurance Market Index (global and US pages, quarterly) · as of 21 October 2026 · Below zero = cheaper than a year earlier. Marsh rounds to whole numbers; rates reflect its own client mix. ReportedWhat the index measures Each point is the average change in the rate a Marsh client paid at renewal against the same cover a year earlier, rounded to a whole number and weighted by Marsh’s own client mix.[2] Thirteen falls in a row do not add up to a single total: each quarter compares with its own year-earlier quarter, so the falls overlap. ## What drives it: capacity in, claims steady, severity up Marsh’s explanation is supply. “Capacity continued to expand through new entrants and MGAs despite ongoing consolidation”, and many buyers spent the room on broader cover and lower retentions. Across all lines it cites strong insurer profitability, surplus capital, cheaper reinsurance and higher investment returns.[1][2] On claims, Marsh says frequency “stayed steady and severity continued to rise even as rates fell”.[2] In the US it lists what underwriters are watching: music copyright claims under the media cover, which it says are affecting loss ratios; rising non-breach privacy claims over website tracking; and vendor incidents that hit “thousands of downstream organizations”.[3] One claim cost has fallen: the share of US ransomware claims in which a ransom was paid was below 20% in 2025, against about 60% in 2019.[8] **Figure: The fall slowed in four of eight regions, most in the US; IMEA, Canada and Asia fell faster** *Year-on-year change in cyber insurance rates at renewal, %, Q3 2025 vs Q3 2026, by Marsh region* | | Q3 2025 | Q3 2026 | Change | | --- | --- | --- | --- | | US | -3 | 0 | 3 pts | | Global | -6 | -4 | 2 pts | | Canada | -3 | -5 | -2 pts | | Asia | -5 | -6 | -1 pts | | UK | -11 | -7 | 4 pts | | Pacific | -10 | -8 | 2 pts | | Europe | -12 | -9 | 3 pts | | IMEA | -6 | -10 | -4 pts | | Latin America & Caribbean | -11 | -11 | 0 pts | Source: Marsh, Global Insurance Market Index, Q3 2025 and Q3 2026 regional pages · as of 21 October 2026 · IMEA = India, Middle East and Africa. Change shown in percentage points. Whether flat US rates mark a turn is disputed. Marsh’s own words are “early signs of rate stabilization” and a pace of decline “suggesting a degree of stabilization”; it makes no forecast of increases.[2] In September Michael Spinks of the underwriter CFC told Insurance Business he believes the market is closer to the bottom of the cycle than the top, with some rates “approaching 2019 pre-hard market levels”; the same report cited AM Best’s US cyber loss ratio, up 4.3 points to 53% in 2025.[11] In August Colin Fox of Integrity, part of Hayes Parsons, said “I don’t think it’s sustainable” and saw early US hardening that could reach UK prices in six to twelve months; Selorm Kofi Domeh of Talbot Jones argued that a profitable book and healthy competition could let current pricing hold.[12] ## What it means at renewal: lower prices, the same questions, more exclusions Outside the US the arithmetic still favours the buyer: Marsh recorded third-quarter falls of 5% to 11% in every other region, and in Europe long-term agreements, reinstated limits and AI endorsements were still on offer, some from only a small number of insurers.[2] Lower prices have not removed the underwriting test. Marsh’s list of twelve controls, written in the hard market of 2022, opens with MFA for remote and privileged access and includes secured, encrypted and tested backups and endpoint detection and response (EDR); Marsh said then that adopting certain controls had become “a minimum requirement of insurers”.[13] In 2026 Marsh still reports that accounts with well-documented risks and good loss records get the better outcomes, and insurers now add AI: “most asking questions on AI exposure, use, and controls or protections”.[2][10] The exclusions matter as much as the price. Since 31 March 2023 Lloyd’s has required every standalone cyber-attack policy written in its market to carry a state-backed cyber-attack exclusion that meets its standard, at inception or renewal.[14] Marsh says US clients reread war exclusions in early 2026 given tension in the Middle East, that some insurers added “clarifying AI endorsements” whose wording clients must test against their own use of AI, and that cyber exclusions “largely remained in place” in US property policies.[9][3] Our view Our view, for a buyer renewing in the next two quarters: ask for the rate change and the wording change as two separate lines; get the war, state-backed and AI clauses in writing before you accept a reduction; and answer the controls questionnaire from evidence (MFA coverage, a restore test, EDR coverage), because that is what the better outcomes in Marsh’s reports were tied to. If you are buying this in India India is inside Marsh’s IMEA region, where cyber rates fell 10% in the third quarter, the 12th fall in a row; Marsh says India saw the steepest reductions in the region but gives no Indian figure for the quarter.[4] Its earlier IMEA pages do: Indian cyber rates rose 5–10% in the second quarter of 2025 and were stable in the third, then fell 10–15% in the fourth quarter, about 30% on average in the first quarter of 2026 and 25–30% in the second.[15] These are a global broker’s readings of its own Indian placements, given as ranges. We found no cyber rate series from IRDAI or from an Indian broker to set beside them. Marsh also notes that insurers in India “remained more cautious” than those in the Middle East, so a cheaper quote here will come with the same controls questionnaire.[15] What to watch: Marsh’s fourth-quarter index. The last two came out in the first week of February (5 February 2025 and 4 February 2026).[6] The test is whether the US reading moves above zero and whether the other regions follow it, as Fox expects for the UK, or keep falling. How we did this Figures as of 21 October 2026 Every rate figure is Marsh’s Global Insurance Market Index: the average year-on-year change in renewal rates for Marsh clients, rounded to whole numbers. The 14-quarter series comes from Marsh’s own pages: the Q3 2026 release and regional pages, its archive pages for Q4 2023 and Q2 2024 onward, the Q3 2023 PDF (which gives Q2 and Q3 2023), and Internet Archive copies of the Q1 2024 global page and the Q4 2023 to Q2 2024 US pages. We computed no cumulative fall, because the quarterly figures overlap. Views on a turn are attributed to the people who hold them, as Insurance Business reported them; the AM Best loss ratio is as reported there. Left out: forecasts we could not read at source. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Marsh, Global commercial insurance rates fall 5% in Q3 2026 (press release)](https://www.marsh.com/en/about/media/global-commercial-insurance-falls-5-percent-q3-2026.html) — 21 October 2026 2. [Marsh, Global Insurance Market Index, Q3 2026, with its regional pages](https://www.marsh.com/en/services/international-placement-services/insights/global-insurance-market-index.html) — 21 October 2026 3. [Marsh, US insurance rates, Q3 2026](https://www.marsh.com/en/services/international-placement-services/insights/us-insurance-rates.html) — 21 October 2026 4. [Marsh, India, Middle East and Africa insurance rates, Q3 2026](https://www.marsh.com/en/services/international-placement-services/insights/imea-insurance-rates.html) — 21 October 2026 5. [Marsh, Global Insurance Market Index Q3 2023 (PDF)](https://www.marsh.com/content/dam/marsh/Documents/PDF/marsh-tp/gimi_q3_2023_report.pdf) — 30 October 2023 6. [Marsh, Global Insurance Market Index archive, Q4 2023 and Q2 2024 to Q2 2026 (global and regional pages)](https://www.marsh.com/en/services/international-placement-services/insights/global-insurance-market-index-q2-2026.html) — Quarterly editions to 22 July 2026 7. [Marsh, Global Insurance Market Index Q1 2024, Internet Archive copy](http://web.archive.org/web/20240620211545/https://www.marsh.com/en/services/international-placement-services/insights/global-insurance-market-index.html) — Q1 2024 edition (copy of 20 June 2024) 8. [Marsh, US insurance rates, Q4 2025](https://www.marsh.com/en/services/international-placement-services/insights/us-insurance-rates/us-insurance-rates-q4-2025.html) — 4 February 2026 9. [Marsh, US insurance rates, Q1 2026](https://www.marsh.com/en/services/international-placement-services/insights/us-insurance-rates/us-insurance-rates-q1-2026.html) — 22 April 2026 10. [Marsh, US insurance rates, Q2 2026 (and Internet Archive copies of the Q4 2023 to Q2 2024 US pages)](https://www.marsh.com/en/services/international-placement-services/insights/us-insurance-rates/us-insurance-rates-q2-2026.html) — 22 July 2026 11. [Insurance Business, Cyber rates keep falling – but how much lower can they go?](https://www.insurancebusinessmag.com/us/news/cyber/cyber-rates-keep-falling--but-how-much-lower-can-they-go-590161.aspx) — 17 September 2026 12. [Insurance Business, Cyber insurance prices have fallen for three years. Brokers aren't sure it can last](https://www.insurancebusinessmag.com/uk/news/cyber/cyber-insurance-prices-have-fallen-for-three-years--brokers-arent-sure-it-can-last-586161.aspx) — 14 August 2026 13. [Marsh, Cyber resilience: Twelve key controls to strengthen your security (PDF)](https://www.marshmclennan.com/web-assets/insights/publications/2022/april/uscybercampaigntwelvekeycybercontrolsv31.pdf) — April 2022 14. [Lloyd's, Market Bulletin Y5381: State backed cyber-attack exclusions](https://assets.lloyds.com/media/35926dc8-c885-497b-aed8-6d2f87c1415d/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdf) — 16 August 2022 15. [Marsh, India, Middle East and Africa insurance rates, Q2 2025 to Q2 2026 editions](https://www.marsh.com/en/services/international-placement-services/insights/imea-insurance-rates/imea-insurance-rates-q2-2026.html) — 24 July 2025 to 22 July 2026 Related on TechBag: the [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa), the [backup and recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) and the [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection). **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — MFA for remote and privileged access heads the insurers' controls list - [Backup and recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — secured, encrypted and tested backups are on the same questionnaire - [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — EDR coverage is the third control underwriters ask about