Cyber Risk Trends 2025: Seeking Stability for the Future

Competition remains fierce in the cyber risk marketplace, with new insurers focused less on efficiencies for their policyholders and more on providing cybersecurity benefits to limit exposures. Added policy benefits, better pricing, and increased coverage allow insureds to get exactly what they are looking for, and with ample capacity and limits, their options are boundless.

“While we are nearing stabilized pre-hard market rates, there is a concern that a series of events could trigger another hard market, as has happened in the past,” said Spencer Timmel, Head of Cyber Insurance Underwriting at Safety National. “Insurers could drastically reduce capacity, limit coverage, and increase premiums. However, applying small, consistent changes over a longer period of time is the approach that insurance carriers need to create long-lasting positive change in the industry.”

Here, Timmel discusses changes to the marketplace, the impact of developing cyber claims, and evolving cyber risks on the horizon.

Marketplace Expectations

Declining premium rates and limited policy count growth led to a continued soft market throughout 2024, benefitting policyholders. Ample capacity and limits expanded competition amongst carriers, creating additional favorability for insureds. While hopes for stability in pricing and coverage were not achieved, insurers still expect a return to pre-hard market rates soon. With increased competition, managing general agents (MGAs), focused on revenue versus bottom-line profitability, may be more apt to underwrite business from policyholders looking for more favorable pricing and coverage. MGAs are less risk-averse than traditional insurers with reinsurers typically absorbing their exposures.

Developing Cyber Claims

Cyber claims can take years to mature due to risks like class action lawsuits and changes in the regulatory environment. For an insurer, this delayed maturation can cause loss ratios to appear positive in the short term but then drastically differ two or more years later. After the close of an accident year, loss development on a cyber line can increase 50% or more in addition to initial payments and case reserves that year. This results in initial reported loss ratios being understated.

On the flip side, some types of events can mature more quickly, like ransomware without a data leak. Since organizations are typically quick to pay extortion demands following an event, these losses can mature rapidly, causing cyber risk insurance to transform into a shorter tail line of business, especially if there is no data leaked, which leads to longer tail liability and regulatory concerns. Recently, more incidents have resulted in business income loss, with organizations becoming more hesitant to pay cybercriminals’ extortion demands.

Broadening Cyber Risks

Many of the trends discussed for 2024 will continue throughout 2025, including long-term liability issues involving regulatory fines and penalties. Pixel-tracking technologies, while still a concern, may not be a considerable risk leading into this year. State-specific biometric laws, like the Biometric Information Privacy Act (BIPA) passed in Illinois, are likely to trend outwards with other states grappling with the privacy risks of biometric identifiers. AI has created a flurry of what-ifs in the cyber liability space. How are organizations using it? Are they tracking usage? Where does insurance for this liability fall? Many of the companies developing and using AI are not currently taking accountability for the outputs of the technology, which could lead to devastating implications.

Lloyd’s Market Association (LMA) and some reinsurers are still demanding defined terms around war exclusions. Some US cyber insurance companies are maintaining a more flexible approach around war exclusions, taking into consideration an insured’s risk profile as opposed to a blanket approach. Insurers are all working to determine their position on war exclusions based on war events occurring over the last few years. Should they take a legacy approach or create their own? While some exclusions, like natural peril, utility outages, bodily injury, and property damage, are fairly standard, flexibility in underwriting allows for a carrier to take a tailored approach and consider what exposure they are comfortable with based on an insured’s risk profile.