Survey: 47% of enterprises across a variety of industries now have cyber insurance, up from 34% in 2017, as execs concerns over cyberattacks increase
Business leaders have grown more nervous about cyberattacks over the past two years. — Cyberattacks are now considered by most execs …
Context & Ripple Effects
This 2019 survey captured cyber insurance crossing from niche to mainstream: nearly half of enterprises held a policy, up from about a third in 2017, with executive anxiety rising over the same two-year window. It was an early read on demand that later data confirmed and then stressed — CISOs went on to report near-universal expectation of a damaging attack after remote work spread (over 60% of 1,400 CISOs expected a damaging attack within 12 months), and UK businesses have since absorbed tens of billions in attack-related revenue losses (Howden's estimate of ~£44B lost by UK businesses over five years).
What matters for this story's arc is what happened downstream of adoption: the buyer base grew first, then the loss experience caught up.
First-order effects
- A larger pool of insured enterprises means risk that boards previously absorbed internally is now being transferred to carriers — and execs naming cyberattacks as a top concern pushes insurance into the standard procurement stack alongside other enterprise risk cover.
Second-order effects
- As policyholders grew and ransomware losses followed, carriers repriced sharply — US premiums jumped 50% in a single year while payouts hit $7.2B, tripling in three years (the 50% premium surge) — so the same adoption wave documented here eventually made coverage costlier and harder to obtain for laggards.
Third-order effects
- If adoption keeps climbing toward universality, insurers become de facto security gatekeepers: underwriting requirements start dictating enterprise security baselines, shifting the industry's center of gravity from buying tools to proving insurability — a pattern consistent with the sustained breach rates governments still report years later (43% of UK businesses hit in a single year).
The trend: Cyber insurance is evolving from an optional hedge into a core enterprise control whose underwriting standards increasingly shape how companies defend themselves.