Cyber
Market Update

Q2 2025

Cyber Insurance Marketplace

Cyber continues to be a competitive market though the first quarter of 2025 and rates remain stable as carriers continue to look to take in premiums. Even when price declines are slowing, this is due more to stabilization than a hardening of the market. All of this is taking place despite the growing frequency and severity of cyber claims.

Good terms are readily available, especially for organizations with strong IT security and privacy policy compliance. Even for organizations who have yet to enact robust security measures, some carriers are looking to retain business by offering coverage enhancements if they cannot be flexible on rate.

Rates and renewals are steady across industries as IT security controls become standardized and the severity of claims is better managed by most markets. Contingent business interruption losses illustrate that vendor dependency creates as much exposure to cyber claims today as does direct cyber threats.

Organizations that have filed a cyber insurance claim will have additional scrutiny at renewal. Carriers will want to know what occurred and how, and they will want to see the steps taken and controls implemented to prevent recurrence.

Cyber Premium Pricing

The following survey response data from the Council of Insurance Agents & Brokers’ Commercial Property/Casualty Market Report covering Q1 2025. Cyber premiums decreased an average of 2.1% in the first quarter of 2025,the second-largest premium decrease for all P&C lines.¹

Cyber Risk Environment

Cyber insurers are taking long looks at their insureds’ management of risks presented by cyber events affecting vendors. Vendor dependencies are an increasing risk exposure which opens companies to vulnerabilities for criminals to exploit. In 2024, third-party related attacks were the leading cause of cyber insurance claims, accounting for 31% of all claims and 24% of material losses.² According to Coalition Insurance, the average third-party breach claim was $42,000.³

Exposure of wrongful collection can be an internal issue within an organization or through use of third- party technology, such as the ongoing litigation regarding Meta Pixel’s video tracking.⁴ Dozens of lawsuits have been brought against organizations in industries such as media and health care as a result of their use of Meta’s Pixel tracking. Organizations can be liable for issues including when trackers are not properly configured, or they are unaware of the data that these tracker tools are collecting.

Third party victims downstream from cyber-attacks can still be impacted by data breaches, even after events of the original breach are resolved. Incidents like the PowerSchool ransomware attack, which was discovered in December 2024, illustrate this aspect of third-party vulnerabilities. Even after PowerSchool paid $2.85M, the criminals continue to send extortion emails to third-party schools, proving they had personal data of children attending their institutions.⁵

Companies in consumer-facing and manufacturing industries such as agriculture, food and beverage, mining, and plastics, filed the most cyber claims while companies in the energy industry filed the largest cyber claim amounts.⁶ Overall, cyber claims of over $1M were up 14% in the first half of 2024 with the highest percentage occurring in the United States.⁷

Organizations are encouraged to take proactive steps to avoid becoming victims of their vendors’ cybersecurity incidents or at least minimize the impact of these incidents.⁸