The recent surge in ransomware attacks has upended the cyber insurance industry, increasing costs and requirements just as more companies need it
Cyber insurance carriers are raising premiums and limiting coverage in the face of severe ransomware attacks, just as organizations are clamoring for more protection
Context & Ripple Effects
The economics of cyber insurance have been bending toward this moment for years. A 2020 report found ransomware already accounted for 41% of claims filed in the first half of that year, with average ransom demands climbing sharply, and a 2019 investigation showed carriers had often preferred to simply pay the ransom rather than fund recovery — a practice that effectively subsidized attackers' business model.
What changed by mid-2021 is that those claim patterns collided with a wave of severe attacks hitting everyday consumers and critical operations, pushing carriers from quietly absorbing losses to actively repricing. The squeeze this article describes was not a blip: direct-written premiums at the largest insurers had jumped 92% the following year, and US premiums went on to surge another 50% in 2022 as policyholders claimed $7.2B.
First-order effects
- Organizations buying cyber coverage now face materially higher premiums and tighter policy terms at exactly the moment ransomware's visibility is driving more of them to seek insurance for the first time.
- Carriers shift from paying claims after the fact to screening risks before binding coverage, making an applicant's security posture — not just its size — the deciding factor in whether it gets insured at all.
Second-order effects
- Demand for security talent spikes as insured firms race to meet underwriting expectations, with companies paying higher salaries and offering more autonomy to attract cybersecurity professionals.
- The ransom-payment habit documented by ProPublica comes under pressure: as carriers reprice, funding attacker demands stops being the cheap default and backup-and-recovery investment starts competing with ransom checks inside the same claim budget.
Third-order effects
- If the pattern holds, insurers become de facto regulators of corporate cybersecurity — underwriting checklists, not government mandates, end up defining which controls companies must run to operate insurably.
- The market structurally splits: firms that can evidence strong defenses keep affordable coverage while weak ones are priced out, turning cyber insurance from a growth product into a sorting mechanism across the economy.
The trend: Cyber insurance is repricing from a fast-growing line of business into a gatekeeping force that sets the security baseline for insured companies.