Cyber

Market Update

Executive Summary

The cyber landscape in the first part of 2026 is paradoxical: cyber risk is increasing, yet insurance conditions remain favorable. Threat activity is intensifying, with attacks becoming faster, more automated, and increasingly focused on identity.¹ At the same time, because of continuing competition between cyber insurers and improvements in cybersecurity by insureds, insurance remains plentiful and pricing is attractive, particularly for those companies that are managing their cyber risks well.

Insurance Market Outlook

Cyber Insurance Marketplace

The cyber insurance market remains broadly competitive. Organizations’ cyber hygiene has improved to the point that insurers see cyber insurance as a profitable line of business. Capacity is plentiful, which has prolonged the soft market and continued the trend of premium moderation. We do not anticipate a significant change in the market for the remainder of 2026.

Insurance Trends

AI Exposures Push Policy Boundaries

Organizations often ask whether losses involving artificial intelligence are covered. The good news is that cyber and technology E&O policies do not limit coverage in any way. The same is not necessarily true for other financial lines policies. A small number of insurers have begun to attach exclusions of varying breadth to D&O, employment practices liability, crime, and other financial lines policies. It remains to be seen whether competitive pressures affect how often those exclusions are used and whether the exclusions proliferate in the industry.

Industry Trends

Cyberattack Vectors are Changing

Historically, threat actors have introduced malware, including ransomware, to compromise computer systems and electronic data. While this is still happening, today, criminals are increasingly focused on compromising user identities rather than exploiting system vulnerabilities. Using stolen credentials makes it far easier to access a victim’s systems and harder to detect unauthorized access. Credential theft and abuse of authentic access paths are now central to many intrusions.³ Strong identity governance is essential to resist these attacks.

Cyber intrusions are increasingly driven by stolen identities, making identity governance a front-line defense.

The Ransomware Scourge Continues

In the first quarter of 2026 ransoms were paid in only 23% of attacks.⁴ While that is good news, the average ransom was $680,081, a 15% increase over the average in Q4 2025.⁵ Today, attackers are prioritizing data theft as the basis for extortion. Such theft took place in 77% of attacks in 2025.⁶ This shift changes the nature of loss toward legal, regulatory, and reputational consequences tied to data exposure.

Supply Chain Risk Continues to Grow

Organizations are increasingly affected by cyber incidents involving vendors and service providers. An attack on a vendor that affects an organization’s ability to conduct business can do great damage to its financial performance and reputation. The same is true of a cyberattack against an organization that affects its vendors. A clear example is the Jaguar Land Rover cyber incident in 2025, which forced production to shut down for several weeks.⁷ The disruption affected thousands of suppliers and partners that were temporarily unable to do business with the company.

Cyber risk is no longer contained within a single organization — vendor incidents can quickly become ecosystem-wide business disruptions.

Cyber Risk Environment

Attacks Are Faster and More Automated
Cyberattacks now progress at a speed that makes detection and response extremely difficult. The average time between initial compromise and lateral movement has fallen dramatically, with some incidents unfolding in minutes or even seconds. In documented cases, attackers have begun exfiltrating data within minutes of access.⁸

The window between initial compromise, lateral movement, and data exfiltration has compressed dramatically, with some attacks progressing in minutes or even seconds.

This speed gives threat actors time to steal or corrupt data and damage computer systems before the attack is discovered and a patch is created and applied. The compression of timelines increases the importance of rapid detection and response.

Artificial Intelligence Is Amplifying Threat Activity
AI is now a vital tool for threat actors to mount and scale cyberattacks. Its uses include creating phishing emails, deepfakes used in social engineering attacks, and developing malware. Perhaps the most stunning example is a cyber espionage attack launched against 30 global targets by Chinese hackers in September 2025. The attack was carried out by AI agents instead of by the hackers themselves, and was successful in some instances.⁹ AI-enabled attacks increased significantly in 2025.¹⁰

AI is not just improving attacker efficiency —
it is helping threat actors scale and automate
complex operations.