Reality check on the future of the cyber insurance market

The cyber market has grown at an impressive rate of 32% annually from 2017 to 2022. The global premium doubled from 2017 to 2020 and again from 2020 to 2022. During this period, forecasts were projecting a continuation of these very strong growth rates.

Today a new market reality has settled in, with lower growth and a phase of reducing insurance rates. Market data from 2023 and 2024 indicates that many market participants have been overestimating the market growth and were too optimistic in their cyber premium projections.

However, forecasts of 20% annual growth in the future keep being mentioned, almost as if this was a law of nature. This may sound exciting, but is it also plausible? Swiss Re's market data helps uncover the underlying dynamics.

Up to 2019 the market premium was largely growing by adding new exposure in North America and Europe. More and more corporates were purchasing cyber insurance. The main growth driver changed substantially in the years 2020 to 2022 when a surge in ransomware led to significant losses. The market reacted with increased rates to reflect the heightened exposure.

To dive a bit deeper into this trajectory, the growth can be broken down into two main components: Organic exposure growth (clients purchasing new policies and existing clients purchasing higher limits) and rate growth (higher premiums for the same limits).

The fluctuation of both parameters shows the decisive and fast reaction of the cyber insurance industry to the ransomware surge. In 2019 and 2020 the increasing losses were impacting the profitability of cyber insurance. Consequently, many insurance carriers rigorously re-underwrote their cyber portfolios. They raised the bar for minimum cybersecurity requirements to obtain insurance, thus positively influencing the cyber resilience of their customers. Also, they reduced their deployed policy limits and increased cyber insurance rates to reflect the new level of risk.

While we observed double-digit rate hikes in cyber insurance in 2020, organic exposure growth was actually lagging. Still rate increases considerably outpaced the limit reductions. The resulting rapid premium growth phase culminated in 2022.

In 2022 the cyber insurance market hit a tipping point. Strong rates and improved profitability prospects of cyber portfolios increased the appetite of incumbent market participants and attracted a series of new entrants into the cyber insurance market. Increased competition – initially on excess layers and later primary business as well – reversed the rate and exposure cycle in 2023. And rate reductions counter-balanced a lot of the organic growth.

The pronounced upwards cycle until 2022, followed shortly by a downwards trend has been observed globally, however, with some regional nuances. Higher rate increases were observed in North America compared to the European cyber market. While the SME segment saw more modest changes, rate increases were most pronounced for large corporates.

Is this the end of the cyber growth story? When looking at market developments and exploring the Swiss Re Cyber Data Lake¹, we expect a continued phase of growth – however with different drivers and regional variation.

The cyber market is far from saturated. For 2025, Swiss Re is estimating a market premium of USD 16.6bn (+8% over 2024) and the cyber protection gap remains huge. On the one hand, there is significant geographical potential as can be seen in the uneven distribution of cyber premium across regions. According to Swiss Re data, North America dominates with 70% premium share followed by Europe (19%) and APAC (8%). This not only illustrates the varying cyber market maturity levels around the globe but also underpins the untapped cyber market growth potential of many economies in Europe and APAC.

On the other hand, there are distinct differences in cyber insurance penetration across customer segments. While according to Swiss Re estimation approximately 80% of Large Corporates (with annual revenue above 10bn USD) have adopted cyber insurance, only around 10% of SMEs (with annual revenue below 100m USD) have done so. As a result, organic growth in the Large Corporate sector is largely limited to clients purchasing higher limits, whereas the potential in the SME market remains significant through clients purchasing new policies. In short, there is a huge cyber protection gap for small and medium sized companies. The SME segment offers a major growth opportunity for cyber insurance globally. However, serving small and medium size businesses requires investment and adapted approaches.

The cyber insurance market continues to present a compelling growth opportunity, outpacing other lines of business. However, it's crucial to maintain realistic expectations for future growth.

Market data suggests that as from 2023 the cyber market moved from a rate increase-driven and double-digit growth trend to a rather single-digit exposure growth scenario. Going forward market participants need to focus on expanding the client base in order to grow their business sustainably.

The largest potential lies in the SME opportunity: To strengthen resilience against cyber threats, the insurance industry must not only broaden its geographic footprint, but also tailor risk transfer products and services to the specific needs of this client segment and find efficient ways to distribute them.

Swiss Re’s cyber reinsurance team offers global reach and has expanded its regional presence. We are committed to the long-term growth of this line of business and investing in people, data, modelling and underwriting. Our aim is to build a long-term, sustainable cyber market together with our clients around the globe.