The inside cyber scoop: What brokers need to know in 2026

Cyber Insurance Crossroads

The cyber insurance market in the United States has shifted from the dramatic rate surges of the early 2020s hard market to a more competitive, softened environment by 2026. Premiums remain broadly flat or even slightly declining in many cases, reflecting abundant capacity, improved loss ratios for some carriers, and aggressive competition for market share. Yet this stability conceals underlying tensions: insurers have tightened underwriting standards significantly since 2024-2025, moving beyond basic questionnaires to require verifiable evidence of cybersecurity controls, including multi-factor authentication, endpoint monitoring, and robust patch management.

Businesses failing these checks increasingly face coverage restrictions, higher retentions, or outright declinations, particularly smaller firms and those in high-risk sectors. Ransomware remains a dominant peril, with supply-chain compromises and social engineering attacks driving claims, even as overall claim frequency and severity have moderated in some data sets. The average cost of a data breach continues to climb, surpassing $4.5 million in recent estimates, amplifying the financial stakes for uninsured or underinsured entities.

Artificial intelligence introduces a double-edged dynamic. On one hand, AI tools empower attackers to scale sophisticated campaigns; on the other, they enable better risk modeling for insurers. However, emerging AI-specific risks—such as losses from manipulative or high-risk AI systems—may fall outside standard cyber policy scopes. Insurers have begun filing exclusions for certain AI-related liabilities in commercial lines, potentially shifting such exposures to specialized coverage or leaving them uninsured. Meanwhile, privacy litigation persists, fueled by state-level laws and repurposed statutes, though some reforms like BIPA amendments have tempered class-action damages.

Regulatory scrutiny compounds these pressures. While no sweeping federal cyber insurance mandate exists, state privacy laws enacted in 2025 continue to take effect, and bodies like the NAIC monitor trends in data security and cyber insurance reporting. Emerging federal rules, such as DOJ bulk data restrictions, impose stringent cybersecurity obligations in certain transactions. Globally, the EU AI Act's prohibitions and high-risk requirements begin phasing in during 2026, exposing multinational firms to fines that may not trigger cyber policy responses.

Brokers navigate a delicate landscape: advising clients on hardening postures to secure favorable terms while highlighting coverage gaps in a market where capacity exists but conditions are stricter. The non-obvious tension lies in the potential overextension—intense competition could lead to underpriced risks, setting the stage for future corrections if AI-driven or systemic events materialize.