The Cyber Insurance Gap: What Businesses Pay vs. What Breaches Actually Cost

Cyber insurance premiums fell for 2 straight years while claims surged 40%. That contradiction- insurers charging less at exactly the moment losses are climbing is what’s underneath every other number in this article, and it is about to reverse.

S&P Global Ratings expects premiums to rise 15% to 20% in 2026, ending the softest pricing cycle the cyber insurance market has seen since it began tracking losses in 2015.

What follows lays out where premiums actually sit today, country by country, against what a breach actually costs, and which nations carry the heaviest attack load regardless of how well they’re insured against it.

The Market Softened for Two Years, Then Claims Caught Up

Global cyber insurance premiums reached an estimated $15.6 billion in 2025, on track for $16.4 billion in 2026, according to Swiss Re.

Munich Re’s independent tracking lands close behind: $15.3 billion in 2024, rising to $15–16 billion in 2025. Both trackers agree on the shape of the curve even where the totals diverge slightly.

That growth carefully concealed a pricing collapse. Premium rates fell 22% from their 2022 peak, and 6% in 2025 alone, according to Howden.

Annual premium growth, which ran above 30% a year between 2017 and 2022, slowed to roughly 6% CAGR by 2024.

In the US specifically, direct written premiums actually contracted by 7.1% to $9.14 billion in 2024, the first annual decline since the NAIC began tracking the line in 2015.

AM Best’s own measurement, using a narrower “standalone cyber” definition, found a 2.3% year-over-year drop to $7.075 billion.

Meanwhile, claims moved in the opposite direction. The NAIC recorded almost 50,000 US cyber insurance claims in 2024, a 40% jump from 33,561 the year before.

Ransomware alone still drives 60% of large cyber claims by value, per Allianz Commercial’s 2025 cyber risk update, even as overall claim severity actually fell roughly 50% in the first half of 2025, and Coalition’s data shows average claim loss easing to around $116,000.

Two trends that shouldn’t coexist- falling prices and rising claim count- did, for two years.

Insurers Are Getting Stricter, Not Just Cheaper

What’s important is that the softer pricing didn’t come with softer underwriting.

Marsh McLennan reports 41% of cyber insurance applications are denied on first submission, a figure that sits awkwardly next to falling average premiums, and explains why “insurance is getting cheaper” doesn’t mean “insurance is getting easier to buy.”

What’s changed is what insurers demand before they’ll quote at all:

1. Multi-factor authentication across all remote access and privileged accounts
2. Endpoint detection and response (EDR) tooling, not just antivirus
3. Documented, tested incident response plans
4. Immutable or offline backup systems
5. Employee phishing-awareness training with measurable completion rates

Businesses that can’t show these controls aren’t just paying more; increasingly, they’re not getting quoted at all.

That underwriting tightening is arguably the bigger story for 2026 renewals.

What a Breach Actually Costs, Globally and In the USA

The global average cost of a data breach fell 9% to $4.44 million in IBM’s 2025 Cost of a Data Breach Report.

The US average moved the opposite way, climbing to $10.22 million, a new all-time high, driven by regulatory fines, escalation costs, and litigation exposure that has no real global equivalent.

That US/global split matters for the premium comparison below: American businesses face the highest breach costs in the world, yet pay relatively modest premiums by global standards.

Premium Comparison in Developed Markets

Small and mid-sized business premiums across major developed economies, converted to a common annual figure where source data allows:

Country	Typical annual premium (SME)	Range	Source basis
United States	~$1,000–$1,750	$400–$8,000+ depending on size and sector	NAIC, MoneyGeek, Insureon, multiple broker datasets
United Kingdom	Varies widely by data exposure	£175 (micro) to £100,000+ (large corporate); typical SME £350–£5,000	Get Indemnity broker data
Australia	~AUD $1,200	AUD $400–$2,100 typical range across 700+ policies	Upcover, reviewed August 2026
Germany	No clean per-policy benchmark publicly available	—	Aggregate market and claims data only (BSI, Munich Re)
France	No clean per-policy benchmark publicly available	—	Aggregate market and penetration data only (Howden)
Japan	No clean per-policy benchmark publicly available	—	Featured in attack-target rankings; premium data not publicly benchmarked
Singapore	No clean per-policy benchmark publicly available	—	Not covered in current source set
Canada	No clean per-policy benchmark publicly available	—	Breach notification volume tracked (Privacy Commissioner); premium data not publicly benchmarked

The gap in the table is worth stating plainly rather than papering over: US, UK, and Australian brokers publish granular, policy-level premium data because those markets are mature and competitive enough to generate it.

Germany, France, Japan, Singapore, and Canada don’t have an equivalent public benchmark; their public reporting focuses on total market size, claim volume, and breach notification counts rather than what an individual business actually pays.

That’s a genuine finding, not a research gap to hide: it says something about market maturity and transparency on its own.

Premium Comparison In Developing Markets (in Local Currency and USD)

Country	Typical annual premium (SME)	Converted to USD	Notes
India	₹80,000–₹3,00,000	~$950–$3,570	One insurer offers ₹1 crore coverage starting at ₹95,000 (~$1,130)
Indonesia	IDR 5,000,000–50,000,000	~$335–$3,350	Only 15% of Indonesian SMEs understand cyber insurance’s value, despite representing over 99% of businesses in the country
Philippines	No clean per-policy benchmark publicly available	—	Market valued at $75.2 million in 2025, projected 17.57% CAGR through 2034; multiple market reports cite premiums as “unaffordable for small enterprises and start-ups” without a hard figure

The more interesting number here isn’t the raw premium — it’s what that premium represents relative to exposure. In India, ransomware demands against SMEs average ₹15–80 lakh (roughly $18,000–$95,000), with 16 days of average downtime. A ₹95,000 premium against a potential ₹80 lakh ransom demand is a coverage ratio most US or UK buyers never have to think about in the same terms, because their exposure-to-premium math looks completely different.

The Premium-To-Exposure Ratio, by Country

Country	Typical SME premium (USD)	Typical single-incident exposure	Ratio (rough)
United States	~$1,300	$10.22M average breach cost	1:7,800
India	~$1,700	Up to ~$95,000 ransomware demand	1:56
Indonesia	~$1,000	Not independently benchmarked in this research	—

This is presented as an illustrative, order-of-magnitude comparison rather than a precise actuarial figure — the US number reflects a mega-breach average across large enterprises, not a like-for-like SME exposure figure, so the ratio should be framed in the article as directional, not a certified statistic.

Cyber Insurance Coverage Data

Premium levels only tell half the story. Take-up rates tell the other half, and they’re low almost everywhere outside North America.

• Only 47% of eligible organizations globally carry cyber insurance at all, according to Munich Re, and the firm’s 2026 survey of over 9,500 respondents across 20 countries found nearly 9 in 10 C-level executives don’t feel adequately protected against cyber risk.
• Less than 5%, possibly as little as 1%, of total global cyber risk currently carries any insurance coverage, per the same Munich Re research.
• In Italy, just 22% of businesses carry cyber insurance. The UK does better at 39%, but Howden’s research still found more than 70% of companies across France, Germany, Italy, and Spain combined remain uninsured for cyber risk.
• A separate Howden report on the same European cohort found the UK’s uninsured share specifically sits at 61% — lower than its continental peers, but still a majority.

There’s a clear return on closing that gap: a company with €500 million in annual revenue could save €16 million over 10 years by holding a cyber insurance policy, a 19% return on investment driven by reduced attack severity that more than offsets the cost of cover, according to Howden’s modeling.

Where the attacks are actually landing

Insurance penetration and premium levels describe risk transfer. They say nothing about where attacks are actually concentrated, and pairing the two datasets is where this article earns its pitch angle.

The ten most targeted countries for cyberattacks in 2025, per aggregated threat-intelligence data from IBM X-Force, Radware, Acronis, and NordVPN:

1. the United States
2. Ukraine
3. Israel
4. Japan
5. the United Kingdom
6. Saudi Arabia
7. Brazil
8. India
9. Germany
10. Poland.

A few of these are worth unpacking individually:

• Poland has become one of the most consistently targeted EU nations, facing 20–50 attempted cyberattacks daily, largely from Russian state-linked actors probing power grids, water systems, and hospitals. Warsaw responded with a €1 billion cyber defense budget increase in 2025.
• Israel saw attack intensity roughly triple since the October 2023 escalation, with Radware logging 1,550 attacks in 2024 alone, concentrated on banks, media, telecom, and government infrastructure.
• Germany isn’t just on the targeted list; its BSI DDoS threat index hit 320 in June 2026, rated “very threatening,” and the country’s cybercrime and sabotage costs reportedly reached approximately €267 billion (~$298 billion) over the past year, a 29% increase.
• Indonesia, while absent from the “most targeted” list above, tops a separate and arguably more revealing ranking: a 2026 Check Point study found 47% of Indonesia’s internet-connected devices under active attack, the highest device-exposure rate of any country measured, attributed to weak baseline defenses (a score of 47.5/100) and heavy AI-driven attack automation.

The mismatch: targeted, insured, and exposed don’t line up

Being a top attack target, having meaningful insurance penetration, and facing the highest breach costs are three separate rankings, and almost no country tops all three.

• The US is both the most targeted country and carries the highest breach costs ($10.22 million average), but its insurance penetration is comparatively strong relative to Europe, and its premiums remain modest by exposure standards.
• Poland and Indonesia face some of the heaviest attack pressure in the world, yet neither appears in the developed-market insurance-penetration data at all; both effectively sit in the protection gap by default, under-covered against risk they’re disproportionately exposed to.
• Germany is simultaneously a top-10 attack target, a country with a “very threatening” DDoS index, and one of the four European nations where over 70% of businesses remain uninsured for cyber risk. That’s arguably the single most striking data point of this research: high exposure, high documented cost, low coverage, all in the same market.

Cyber insurance pricing spent two years moving in the opposite direction from cyber risk. Premiums fell, underwriting tightened, claims surged, and, outside a handful of mature English-speaking markets, most businesses still don’t have coverage at all. The countries facing the heaviest attack pressure are frequently the ones with the thinnest insurance markets, not the thickest. That gap is closing on the pricing side in 2026.

Sources referenced: 

1. https://www.swissre.com/risk-knowledge/advancing-societal-benefits-digitalisation/cyber-insurance-growth-shift.html
2. https://www.munichre.com/en/insights/cyber/global-cyber-risk-and-insurance-survey-2026.html
3. https://www.spglobal.com/ratings/en/regulatory/article/soft-market-hard-reality-cyber-insurance-is-at-an-inflection-point-s101693973
4. https://content.naic.org/sites/default/files/inline-files/2025_Cybersecurity_Insurance%20Report.pdf
5. https://commercial.allianz.com/news-and-insights/reports/cyber-risk-trends.html
6. https://www.coalitioninc.com/blog/cyber-insurance/making-active-cyber-insurance-the-global-enterprise-standard
7. https://app.stationx.net/articles/cyber-insurance-statistics
8. https://www.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
9. https://www.howdengroupholdings.com/reports/2025-cyber-report
10. https://www.howdengroupholdings.com/news/cyber-attacks-cost-europes-four-largest-economies-300bn-in-the-last-five-years-according-to-howden
11. https://www.moneygeek.com/insurance/business/cyber/cost/
12. https://getindemnity.co.uk/business-insurance/cyber/how-much-does-cyber-insurance-cost
13. https://www.upcover.com/blog/how-much-does-cyber-insurance-cost
14. https://mitigata.com/blog/cyber-insurance-cost-india/
15. https://www.dealplexus.com/blog/cyber-insurance-indian-smes
16. https://www.kenresearch.com/indonesia-cyber-insurance-market
17. https://deepstrike.io/blog/top-10-countries-most-targeted-by-cyber-attacks-in-2025
18. https://www.timesofisrael.com/israel-ranks-1st-among-countries-targeted-by-geopolitical-cyberattacks-in-2025-report/
19. https://www.digitaljournal.com/tech-science/revealed-top-five-most-vulnerable-countries-to-an-impending-cyberattack/article

Note: several data points above are drawn from industry and broker research rather than audited regulatory filings, and are flagged accordingly where the underlying methodology wasn’t independently verifiable (e.g., converted currency ranges, single-source premium claims, and the illustrative premium-to-exposure ratios). A fully sourced data briefing with links can be provided on request.