There Are More CVEs, But Cyber Insurers Aren't Altering Policies

There are more CVEs than ever, with MITRE listing roughly 33,000 by mid-September this year and an expected approach to 47,000 for 2025, according to MITRE. The article notes that many vulnerabilities are never assigned a CVE and that a backlog also awaits assignment, underscoring the expanding risk landscape.

It reports that some insurance carriers and brokers offer proactive services to address CVEs, such as network scanning and vulnerability alerts, while others—such as Chubb—penalise policyholders who fail to patch known threats promptly, a practice described by an industry insider who preferred to remain unnamed.

The penalty approach is framed around a “Period of Neglect” where coinsurance shares increase and limits are reduced as exploits go unaddressed, though these terms are often negotiated out of policies; Chubb did not respond to comment. Beazley, a UK-based provider, says risk awareness is rising among executives, with 29% citing cyber risk as their greatest threat in its Risk & Resilience report, up from 26% in 2024, and perceptions of resilience have grown to 83% this year.