The global cyber insurance market is confronting a moment of transition. After a decade of rapid expansion and exceptional profitability, carriers now face slowing premium growth, falling rates and an apparent shift in corporate attitudes towards cyber risk.
Howden’s Rebooting Growth report, released this month, notes that worldwide cyber premiums grew by just 6 per cent annually between 2022 and 2024 – a dramatic slowdown from the near 40 per cent compound rate achieved during the hard market. Although underwriting margins remain enviable, with combined ratios averaging 70 per cent and cumulative profits of $9 billion since 2022, the engine of growth is faltering.
Pricing has retreated 22 per cent from its 2022 peak, with international markets seeing the sharpest reductions. Insurers will need to expand exposures by roughly 15 per cent each year if premium targets are to be met. For Howden, the path forward lies in unlocking demand from underserved markets, with continental Europe at the forefront. Its survey of 1,200 business leaders in France, Germany, Italy and Spain estimates the direct cost of cyber incidents at €307 billion over the past five years, yet penetration remains below 30 per cent – well behind the UK.
It's not for a lack of big cyber news stories including JLR’s ongoing hack fallout, and the supplier hack that closed airports across the continent.
Among large corporates, 41 per cent of non-buyers signalled plans to purchase cover within five years, with modelling suggesting a 19 per cent return on investment from cyber insurance through avoided attack-related costs. The value case is reinforced by evidence that even basic security measures, such as patching and password hygiene, cut attack costs by nearly 90 per cent.
Yet this drive for growth comes as business sentiment towards cyber risk shows signs of easing. The latest Travelers Risk Index found that while cyber remains the top concern for large and mid-sized firms, it slipped to third place overall across businesses of all sizes. Only 56 per cent of respondents said they worry “a great deal” about cyber exposures, down from 62 per cent a year earlier – the lowest level since 2020.
At the same time, fewer large companies view an attack as inevitable, and nearly a quarter of firms admitted to neglecting even the most basic controls such as firewalls, data backups and software updates. This comes despite a rise in reported incidents, with 25 per cent of businesses experiencing a cyber event in the past year.
“Companies need to stay vigilant and not take their eye off the ball, because the key to successful cyber mitigation is staying ahead of it,” warned Lauren Winchester, vice president of cyber risk services at Travelers.
Travelers also reported that US stand-alone cyber premiums fell by 6 per cent in the first quarter of 2025, the first decline since 2018. Competitive pressure, improving defences and fewer ransomware claims were cited as drivers of the shift.
For insurers, the juxtaposition is striking: on the one hand, businesses express reduced anxiety and insurers grapple with softening prices; on the other, both Howden and Travelers point to the persistence of ophisticated and costly attacks.
As Jean Bayon de La Tour, Head of Cyber, International at Howden, put it: “Our analysis confirms the powerful role cyber insurance plays in mitigating one of the most critical threats facing businesses today.”
The task for brokers and carriers will be to ensure that falling premiums and a degree of corporate complacency do not obscure the reality of evolving, highly targeted cyber threats – and that new markets are tapped before the current growth cycle slips further from view.
