Cyber Insurers Move Beyond Underwriting to Continuous Security Support
Summary
Cyber insurers are expanding beyond annual underwriting, requiring controls such as MFA, EDR and immutable backups and offering security services. Experts say AI-driven threats and systemic cloud risks challenge historical loss models; NAIC data show US claims rose by 0
Key points
- Insurers increasingly require multifactor authentication, endpoint detection and response, immutable backups and privileged-access controls; some are moving from annual attestations to continuous telemetry.
- Experts quoted in the article say AI may increase the speed, scale and credibility of phishing and impersonation, challenging underwriting models based on historical claims.
- A 2025 NAIC report cited nearly $15 billion in cyber insurance premiums in 2024, including roughly $9.14 billion in US direct written premium.
- The same report cited nearly 50,000 US claims in 2024, up nearly 40% year over year; the article says this may reflect more insured customers, more aggressive attackers, or both.
- Some insurers offer security services such as automated detection and response, risk-management tools, assessments, penetration testing and training.
- Coalition claims its “Active Insurance” model resulted in 73% fewer claims than the industry average and says 56% of claims reported in 2024 were resolved with no out-of-pocket expense for insured customers.
- Experts warn that a major cloud or identity-provider outage or compromise could create systemic losses; insurers are adjusting policy language with exclusions, event carve-outs and sublimits.
Article Details
- Event Type
- Cyber insurance market shift toward continuous underwriting and active cybersecurity support for policyholders.
- Impact
- Insurers are moving beyond point-in-time questionnaires toward ongoing assessment and requirements such as MFA, EDR, immutable backups, privileged access controls, and continuous telemetry. Some also provide or recommend security services and products. The article cites nearly $15 billion in US cyber insurance premiums and nearly 50,000 US claims in 2024; it also notes that policy exclusions and limits may leave organizations exposed to losses from widespread events or major provider disruptions.
People
Daniel WoodsHead of emerging risks at Coalition; discussed limitations of point-in-time underwriting and insurers' role in ongoing customer protection.George GerchowIANS faculty and chief security officer at Bedrock Data; discussed insurer security requirements, claim denials, and systemic-event risk.Jeremiah GrossmanCEO of Root Evidence; discussed insurers' increasing requirements and organizations' difficulties measuring risk.Thomas PytelVice president at Cowbell; discussed how AI changes phishing and impersonation risks and the need for adaptive underwriting.
Vendors
Arctic Wolfproducts and incident response services. While on the other end, traditional security vendors like Arctic Wolf offer products specifically for insurability.AXA XLransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.Chubbsome cases, ransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.Coalitionand, in some cases, ransomware payments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.Cowbellpayments. Some of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.CrowdStrikeconflict, widespread-event carve-outs, and small sublimits for dependent business interruption. CrowdStrike in 2024 was a bad update with no attacker anywhere in it, and it still grounded flights and stalledResilienceSome of the names you'll see pop up around this space include Coalition, Chubb, AXA XL, Cowbell, and Resilience.Root EvidenceJeremiah Grossman, CEO of cyber loss prevention vendor Root Evidence, says insurance carriers are requiring more to be implemented, steadily, year over year, and "it seems to be working well for many." However, he says,
Industries
Cyber insuranceThe relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defenseCybersecuritythreat landscape has pushed cyber insurance companies to follow suit with a continuous expansion of cybersecurity posture requirements as well as taking an active hand in the defense process.