As the frequency of high-profile cyber-attacks continues to rise and threat actors become increasingly sophisticated, cyber-liability insurance has emerged as a critical element of organisational security strategies.

A new report from Artic Wolf, The Cyber Insurance Outlook, looks at recent data that reveals that more organisations are turning to cyber insurance to mitigate risk, despite challenges in navigating the complex market.

Cyber Insurance Adoption on the Rise

The report highlights that 62% of organisations currently have cyber insurance, while another 38% are evaluating or considering policies.

Of those insured, 69% have opted for standalone policies dedicated solely to cyber-coverage, while 31% rely on umbrella policies added to existing insurance.

Notably, many organisations are new to cyber insurance – 43% have held policies for over two years, while 34% are recent adopters with coverage lasting less than 12 months. The breakdown of adoption timelines underscores the growing demand:

• Less than three months: 5%
• Three to six months: 9%
• Six to twelve months: 20%
• Twelve to twenty-four months: 23%
• More than two years: 43%

The increase in cyber insurance adoption coincides with escalating concerns about the proliferation of cyber-threats.

Organisations face a relentless surge in cyber-attacks, with 29% reporting incidents within the past year. Security professionals are feeling the strain, as well-equipped threat actors continue to target vulnerable systems.

Premiums, Policy Coverage & Barriers to Entry

While premiums for cyber insurance remain high, the rate of increase is slowing.

In Europe, 53% of organisations reported rising premiums over the past year, but 47% noted increases of 10% or less. This stabilisation comes as insurers offer more comprehensive policies, with half of all respondents reporting enhanced coverage and 48% indicating consistent policy terms. Only 3% reported reduced coverage.

Obtaining cyber insurance is not without challenges, the report finds. Organisations often face drawn-out application processes, with insurers requiring extensive security controls and best practices before granting coverage. Top requirements include:

• Multi-Factor Authentication (MFA): 51%
• Managed Detection and Response (MDR): 49%
• Security Information and Event Management (SIEM): 45%
• Endpoint Detection and Response (EDR): 45%
• Data Loss Prevention (DLP): 45%
• Anti-virus software: 44%
• Backup and recovery capabilities: 42%
• Firewalls: 41%
• Security awareness training: 38%
• Cloud monitoring: 36%

Despite meeting these requirements, many organisations struggle with lengthy and complex application processes. Nearly half (47%) find it difficult to determine appropriate coverage levels, and 41% face competing internal priorities that hinder the decision-making process.

As one UK-based survey respondent noted, “Our organisation’s cumbersome application steps create barriers to efficiently reviewing cyber insurance options.”

What Are The Benefits of Cyber Insurance?

For organisations that secure coverage, the benefits can be significant. In the event of a cyber-incident, 37% of respondents reported their insurers mobilised investigation and response teams, while another 37% recovered stolen internal data. Legal assistance was provided in 30% of cases to address lawsuits or regulatory compliance issues.

However, these benefits come at a cost. Following an incident, 42% of organisations experienced premium increases, 36% faced additional scrutiny, and 34% had coverage reduced. Insurers also imposed new requirements, with 46% mandating security awareness training and 44% requiring updated incident response plans.

Forward-thinking organisations are finding ways to lower premiums while enhancing their security posture. Strategies include:

• Implementing MDR: 63% of European respondents reported premium savings of at least 10%.
• Incident response retainers: 64% achieved similar savings.
• Replacing end-of-life systems: 56% saved over 10%.
• Security awareness training: 44% saw reductions exceeding 10%.

Investing in additional cybersecurity measures – such as cloud security monitoring (45%), logging and network protections (43%), and security awareness training (42%) – not only strengthens defences but also reduces insurance costs.

Recommended reading

• Two-thirds of CISOs Have Had Budgets Slashed Due to AI
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• Cyber Leaders Reveal Compliance and Boardroom Struggles

The survey also revealed a nuanced relationship between cyber insurance and warranties. In Europe, 30% of respondents reported having warranty coverage alongside insurance, while 50% opted for warranties instead of insurance.

While warranties can offset some costs, they lack the comprehensive protections offered by cyber insurance. Organisations relying solely on insurance may face increased premiums following incidents—42% reported higher costs and 34% experienced reduced coverage.

As cyber-threats continue to evolve, its hard to argue against the idea that cyber insurance is becoming a necessity rather than a luxury.

The report’s findings point to a market that is stabilising, with insurers offering more comprehensive policies and organisations taking proactive steps to improve their security posture, meaning now is as good a time as ever to look into cyber insurance, as the threats don’t appear to be going away any time soon.