CYBER insurance is moving beyond simple risk transfer to a more active cybersecurity stance. In a landscape intensified by AI-enabled attacks, social engineering and cloud‑service risks, underwriters are expanding posture requirements and even engaging in customers’ security programmes. The piece notes that premiums for cyber insurance reached nearly $15 billion in 2024, with direct written premium in the US around $9.14 billion, per a 2025 NAIC report.
Claims data remain striking: almost 50,000 claims in 2024, the highest on record and up about 40% year on year. The takeaway is clear: growth in coverage has outpaced traditional threat‑modeling, forcing carriers to recalibrate how risk is assessed and managed.
Insurers are tightening and broadening requirements, pressing for multifactor authentication, endpoint detection and response, immutable backups, and privileged access controls, with some moving to continuous telemetry rather than one‑off attestations. Industry voices emphasise that AI accelerates the speed and scale of phishing and impersonation, underscoring that underwriting must evaluate how a business verifies identities, authorises payments, and uses AI itself.
Beyond just issuing policies, several firms have begun offering active security products and services, such as automated detection and response or risk‑management tooling, to improve resilience during the policy life cycle. Analysts warn that while risk transfer remains fundamental, the ecosystem increasingly relies on ongoing protection and prevention, and that in systemic crises (for example a major cloud or identity provider being compromised) the market may struggle to absorb losses.