The global cyber insurance market has grown from roughly $5 billion in annual premiums in 2020 to an estimated $25 billion in 2026, according to insurance broker Marsh McLennan — a fivefold increase in six years driven by the simple and alarming fact that cyber attacks have become one of the largest sources of financial loss for corporations worldwide. Ransomware payments alone exceeded $1.5 billion in 2025, and that figure captures only reported incidents.

The market's growth has not been smooth. Between 2020 and 2022, insurers were blindsided by the frequency and severity of ransomware claims, leading to premium increases of 100-300% and a wave of coverage restrictions. Many insurers simply stopped offering cyber policies altogether. The market has since matured. Insurers have developed sophisticated underwriting models that assess not just a company's stated security posture but its actual attack surface — evaluating third-party vendors, cloud configurations, and employee security awareness. Premiums have stabilized, and capacity has returned to the market.

The unresolved challenge is systemic risk. A single vulnerability in widely used software — as demonstrated by the 2025 hospital chain ransomware attack — can trigger losses across thousands of policyholders simultaneously. Insurers are increasingly concerned that the industry has not priced for correlated losses, a gap that has drawn attention from the National Association of Insurance Commissioners and the Federal Insurance Office. "Cyber insurance is the fastest-growing line of business in insurance history," said Marsh CEO John Doyle. "It is also the line where the gap between modeled risk and actual risk is widest."