Cyber insurance has become cheaper for most buyers, but not easier to get. Global cyber rates fell 4% in the third quarter of 2026, according to Marsh, while insurers continue to treat a core set of security controls as a condition of cover. For mid-sized companies, the renewal question is less about price and more about whether you can prove your defenses work.
Where Cyber Insurance Pricing Stands
The Marsh Global Insurance Market Index for Q3 2026, published October 21, reported that "cyber insurance rates declined by 4% globally." In the US, rates were flat "after an extended period of declines," while all other regions continued to see reductions. Across all commercial lines, global rates fell 5% on average.
Two caveats matter. First, Marsh measures renewal pricing for its own clients, so an individual firm's experience can differ. Second, a softer market does not mean lighter scrutiny. Marsh describes its 12 key cybersecurity controls as the measures that are "now a minimum requirement for insurers."
What Underwriters Look For
Insurers typically ask applicants to evidence a handful of controls before binding or renewing a policy. Marsh has named five as having the most impact on insurability, mitigation and resilience:
- Multifactor authentication (MFA) on remote access, email and privileged accounts.
- Endpoint detection and response (EDR) across workstations and servers.
- Secured, encrypted and tested backups that attackers cannot alter or delete.
- Privileged access management (PAM) to limit and monitor administrator accounts.
- Email filtering and web security to block phishing and malicious downloads.
There is evidence these controls do more than satisfy a questionnaire. A 2023 Marsh McLennan study found that organizations using automated hardening techniques were nearly six times less likely to have a cyber incident, and that broad MFA coverage made organizations 1.4 times less likely to suffer a successful attack. The same study found that patching high-severity vulnerabilities within seven days was among the most effective controls, yet only 24% of organizations studied did it.
The Threat Picture Behind the Questions
The FBI's 2025 Internet Crime Report recorded 1,008,597 complaints and $20.877 billion in reported losses, a 26% increase on 2024. Business email compromise alone accounted for more than $3 billion.
Ransomware complaints rose to 3,611 in 2025, up from 3,156 in 2024 and 2,825 in 2023, with reported losses above $32 million. The FBI stresses that this loss figure is artificially low, because it usually excludes lost business, downtime and remediation costs, and many victims report no loss amount at all.
Mid-market firms are squarely in scope. Of more than 1,400 ransomware complaints from organizations outside critical infrastructure, the most affected industries were legal services (18%), contracting services (17%) and engineering and architectural services (10%).
"Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats." (FBI, 2025 IC3 Annual Report)
Why This Is a Board Issue
Regulators now expect directors, not just IT teams, to own cyber risk.
- United States: Under rules adopted by the Securities and Exchange Commission, public companies must disclose a material cybersecurity incident on Form 8-K within four business days of determining that it is material. Annual reports must also describe how the board oversees cybersecurity risk and management's role and expertise in handling it.
- European Union: The NIS2 Directive introduces liability for people in senior management positions at in-scope entities. It requires an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. Maximum fines are at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities.
Private companies outside these regimes still face the same questions from insurers, lenders and large customers, who increasingly ask for evidence of security controls in contracts and due diligence.
A Practical Checklist for Boards
- Ask for evidence, not assurances. Request MFA enforcement reports, EDR coverage figures and the date of the last successful backup restore test.
- Check patching speed. Ask how quickly critical vulnerabilities on internet-facing systems are fixed, and whether the seven-day benchmark is met.
- Review the incident response plan. Confirm it names decision-makers, covers ransomware and business email compromise, and has been rehearsed in the past year.
- Map your reporting deadlines. Know which rules apply to you, such as SEC Form 8-K, NIS2 or sector regulators, and who decides materiality.
- Read the policy wording. Check exclusions, waiting periods for business interruption and any conditions tied to the controls declared on the application. Inaccurate answers can put a claim at risk.
- Use the soft market. With rates flat or falling, renewal is a good time to negotiate higher limits or better terms if your controls are strong.
The pricing cycle will turn again at some point. Companies that can document strong controls now are likely to be best placed to keep coverage on reasonable terms when it does.
