Security Report · github.com/jacobdjwilson

NetDiligence 2026 Study Finds Ransomware and BEC Drive Cyber Insurance Losses

Oct 21, 2026 · Original Report (PDF) ↗

Summary

NetDiligence analyzed 10,309 cyber claims from 2021–2025. Ransomware and business email compromise accounted for nearly 64% of SME claims of at least $1,000 in 2025, while large companies represented 56% of total incident costs.

Key points

The study covers 10,309 claims for incidents occurring in 2021–2025; cost analyses use 9,519 claims reporting incident costs of at least $1,000.
Ransomware and business email compromise accounted for 51% of qualifying SME claims over five years and nearly 64% in 2025. The study defines SMEs as organizations with annual revenue below $2 billion.
Large companies accounted for only 3% of claims but 56% of the $5.7 billion in total incident costs analyzed. Average incident costs were $11.2 million for large companies and $266,000 for SMEs.
Reported ransom demands reached $500 million, payments reached $90 million, and 59 ransom payments were at least $10 million.
Ransomware accounted for 77% of SME claims reporting business interruption. These ransomware incidents averaged $1.4 million in interruption costs and $2.3 million in total incident costs over five years.
Insurance payouts covered 67% of reported SME incident costs and 20% of large-company costs.
The dataset is a convenience sample, not a statistically representative measure of all incidents. Fourteen percent of submitted claims remain open, and the study cautions that reported costs are likely understated.

Article Details

Publisher: NetDiligence
Report Period: 2021-01-01 to 2025-12-31
Scope: Cyber insurance claims, causes of loss, incident costs, and payouts across organization sizes and business sectors. Convenience sample; reported costs are lower bounds and include costs to date for open claims.
Sample Size: 10,309 claims for demographic analysis; 9,519 claims with incident costs of at least $1,000 for financial analysis. Includes 4,825 new and updated claims supplied by 13 organizations.
Key Statistics: Large companies represented 3% of claims but 56% of total incident costs ($3.2B of $5.7B) during 2021–2025.
Average incident costs during 2021–2025 were $266K for SMEs and $11.2M for large companies; insurance payouts covered 67% and 20% of their respective total incident costs.
Ransomware and business email compromise accounted for 51% of SME claims with incident costs of at least $1,000 during 2021–2025, rising to nearly 64% in 2025.
Reported initial ransom demands reached $500M and payments reached $90M; 59 ransom payments were at least $10M.
SME claims involving business interruption had average incident costs more than 500% greater than claims without business interruption during 2021–2025; ransomware accounted for 77% of SME claims with a business interruption component.
Recommendations: Establish an incident response team, rehearse response and recovery plans, and define stakeholder communications and third-party escalation paths.
Maintain isolated, current, tested backups and segment critical environments to contain compromise and reduce recovery time.
Use phishing-resistant multi-factor authentication and conditional access; independently verify payment instructions and bank-account changes, preventing unilateral changes by one person.
Inventory approved AI systems and establish governance covering ownership, permitted uses, data handling, vendor diligence, human oversight, monitoring, logging, and incident procedures.
Assess cloud configurations and access controls, and protect and monitor API keys, AI accounts, and cloud identities.