Analysis: insurers significantly raised cyber coverage premiums in 2021, after high profile hacks; direct-written premiums by the largest insurers rose 92% YoY
Context & Ripple Effects
The repricing was already visible before this analysis landed: ransomware accounted for 41% of cyber insurance claims filed in H1 2020, with average ransom demands climbing, and by mid-2021 the ransomware wave had upended the cyber insurance industry, pushing costs and underwriting requirements up just as more companies sought cover.
The WSJ's 92% YoY jump in direct-written premiums among the largest insurers is the clearest quantification of that turn — and the arc continued, with US premiums surging another 50% in 2022 as policyholders claimed $7.2B, triple the level of three years earlier.
First-order effects
- Corporate buyers of cyber coverage faced materially higher premiums from the largest direct writers in 2021, alongside tightened underwriting requirements that made policies harder to obtain without demonstrated security controls.
Second-order effects
- Insurers' loss experience from ransomware forced them to shift from broad appetite to selective underwriting, effectively transferring part of the security burden onto customers who must meet insurer-mandated controls to qualify for cover.
Third-order effects
- If the pattern holds — rising claims feeding sustained premium growth toward the ~$30B global volume projected by 2030 — cyber insurers become de facto setters of minimum corporate security standards, with pricing power concentrated among the largest carriers.
The trend: Cyber insurance is repricing from a soft, growth-at-any-cost market into a loss-driven one where ransomware claims dictate premiums, underwriting rigor, and who can buy cover at all.