Cyber insurance at a crossroads: Al threats, pricing and resilience

Most cyber incidents are as a result of human error. Cyber by nature doesn't really sit neatly in just one box. Hello everyone and welcome to the return of our cyber insurance power panel for 2026. This time around we welcome returning favourites Ethan Godlieb, head of cyber, tech and fintech at Concilium Insurance Brokers and Daniel Wynn, development broker, technology, media and cyber sciences at Genston London Markets. So let's start with an overview, gents, with 62% of businesses worldwide now carrying cyber insurance, so up sharply year on year. How is this increased penetration changing pricing approaches in the UK market, if at all? Ethan, I'll start with you. Yeah, I think it's an interesting statistic because my experience in the UK, particularly among smaller enterprises and mid-market firms, is a cyber insurance uptake is still relatively low. So I think there are very mixed statistics in circulation. A recent broker report from Bieber basically highlighted that while a majority, 59% of UK businesses had a cyber incident last year, actually only a minority of 35% actually carry standalone cyber insurance. So I think from a broker perspective, there's still significant work to do on both education and adoption, rather than calling it a fully saturated market. On pricing, the UK has now experienced, I think, around 10 or 11 consecutive quarters of rate reductions, which has been driven by strong capacity, competition and improving loss ratios. However, I think we're approaching the latter stage of that market cycle. And in the US, which typically precedes the UK, we're starting to see earlier signs of rate stabilisation or plateauing in certain segments. As I say, historically, London tends to follow the US with a lag of roughly six to 12 months. So while pricing remains very competitive today, I think we may be nearing the bottom of the cycle, rather than the start of another prolonged soft phase. So for now, clients have still been benefiting from low rates and broad access to capacity. So it's good news. But I'd expect the pace of reductions to slow and flatten rather than continue indefinitely. Okay. And would you agree overall, then, with Ethan's point, Daniel, that perhaps that statistic that I quoted is not the case in the UK SME space? It's certainly not in the UK SME space. I think more so with your large multinationals, the larger corporate clients, billion pound revenue and above is probably where we're seeing the higher penetration on cyber insurance, and the SME space is much lower at the moment. But see, insurers are doing everything they can to try and improve that with regards to pricing, bringing that down, more competitive coverage, widening the limits that are available, and also the additional services as part of the cyber offering as well. So it's not just an insurance policy that responds in the event of an incident, it's there to help and guide them through their cyber security journey from the initial outlay of the policy premium. Like Ethan said, prices are coming down a little bit more slowly this year than they have done in past. I think this is due to, there's a lot of capacity out there at the moment, especially in the SME space. So they're just trying to make it more accessible for clients. But I think it's our job as brokers just to be able to convert this. Insurers are seeing the most amount of quotes they're seeing on a month-by-month basis. I think after the Jaguar Land Rover incident, one insurer saw about 6,000 quotes in a month. So the quotes are being done. I think it's our job as brokers to try and not necessarily convince, but advise our clients better on what the coverage offers because each policy is going to be different and everything's covered. So why are they different between insurers? So we just need to do our job in explaining that to our clients to convert those over the line. Talking about understanding what is covered and what isn't, I think we should talk about AI. Of course, AI-powered attacks are growing more sophisticated and accessible. So Daniel, what new exclusions, sublimits, security prerequisites are you seeing carriers introduce in 2026? So with regards to exclusion, I'm not really seeing anything. Insurers are generally just endorsing the policy to show that the cover is there. It is something that's always been covered under cyber insurance. At the end of the day, behind the AI is a cyber criminal. We are sometimes seeing on different policies, though, like directorates and officers, management liability policy, where it is given an AI exclusion under there. So it's just working around that to make sure the cyber policy is going to pick up in the event of an incident. We're seeing a little bit more regarding, obviously, deep fakes, quite a big thing around at the moment. So it's just the same way with a payment processing, just we need to make sure everything's checked. Most cyber incidents are as a result of human error. So it's just all about training of staff and make sure that's done on a regular basis so everyone's up to date with the new risks that are constantly evolving to make sure they're in the most secure place possible. Do you feel, Ethan, that the cyber insurers out there have properly got their heads around AI? Yeah, I think, obviously, it's something that continues to evolve, as Dan says, but definitely over the last 12 to 18 months, a number of couriers have introduced affirmative AI coverage. But I think, in reality, this is largely comfort wording rather than a fundamental shift in the insurance itself. The core principle remains unchanged. The cyber insurance will respond to the loss itself rather than the attack vector, whether that loss arises from malware, from AI-enabled tools, deep fakes, or traditional social engineering. But, as Dan says, clients like to see the affirmative AI language, and some markets have leaned into that from a reinsurance and positioning perspective. I think where things get a bit more nuanced is around deep fakes and AI-enabled social engineering because AI is materially accelerating phishing, impersonation, manipulation, deception tactics. But those are actually fundamentally crime risks for the most part, not pure cyber risks, because they're involved with funds, theft or transfer of funds, or invoice manipulation. As a result, under cyber policies, those exposures are actually typically sub-limited, often in the region of, I would say, 250,000 to 500,000, and never really up to the full cyber limit. Whereas, in contrast, dedicated standalone crime policies are actually designed to respond to exactly that financial theft, invoice manipulation, funds transfer fraud, and impersonation losses, and can ensure those risks up to full limit. So, I think from a structuring perspective, anything that results really in a direct financial loss or theft of funds should be sitting within a crime policy with an appropriate social engineering extension or similar. Particularly for financial institutions, that distinction is even clearer because crime-style losses are generally not insurable under cyber at all, and the market expects those risks to be addressed under specialist crime programs. On security prerequisites, I haven't really seen insurers introduce AI-specific technical controls just yet, but I think there is a stronger focus on AI governance rather than the tooling, having visibility over the AI usage and how that's being governed. Not to toot my own horn too much, but I've done an article on how to prevent shadow AI and the risk that evolves to companies, basically where AI has been deployed without appropriate governance or control, and what that can result in. So, yeah, to bring it back around, I think Affirmative AI cover is largely window dressing, but the cover is there. The real issue, I think, is that AI is supercharging crime losses like social engineering. So, if it leads to financial loss, it belongs in a standalone crime policy, I think, rather than stretched cyber sublimits. Well, just to continue that theme a little bit with you, Ethan, cyber and AI, of course, are now identified as cross-industry red-thread risks by London market leaders. So, what differentiates a cyber program that is genuinely future-proofed from one that is not? Yeah, I think it's a good question, because cyber by nature doesn't really sit neatly in just one box. Actually, cyber risk increasingly bleeds into multiple other lines of insurance, and that's exactly why it's now viewed as a red-thread cross-industry, like you say, rather than a standalone issue. And you can see that convergence quite clearly with motor, modern vehicles being effectively computers on wheels. You can see it with property and physical damage, where cyber events can disrupt critical infrastructure, power grids, industrial systems, and that leads to physical loss. You can see it in bodily injury, the way in modern conflicts, quite obviously, relevant recently, what with the conflict in Iran, show how digital attacks can have real-world consequences there as well. Cyber is also a DNO exposure, so directors and officers are increasingly held accountable for cyber preparedness and governance. And we've seen lots of high-profile cases where senior executives have lost their roles following major cyber incidents. Capita springs to mind, and more famously, TalkTalk as well. And also for technology and software-driven businesses, cyber also racks directly into PI or technology E&O. So, if you're providing digital services, a cyber incident is often inseparable, really, from professional liability. So, from my perspective, a genuinely future-proof cyber program recognizes all of that interconnectedness and is structured accordingly. And that often means placing cyber and tech with the same insurer, or at least making sure the wording's deliberately aligned. That avoids coverage disputes and finger-pointing at the time of a claim, when each policy argues the other should respond. I also think that future-proofing also means thinking beyond the cyber itself, thinking about the AI-driven losses that we just spoke about. Many of those are fundamentally crime losses. Is that insured properly? A strong program basically ensures that crime is picking those up properly. So, yeah, I think, broadly, the role of a good broker here is critical. It's about weaving the program together across the lines and not just buying a cyber policy in isolation, whether that's aligning insurers, adding the right endorsements and extensions, and making sure there are no structural gaps as new risks emerge. So, yeah, I think it's about coherence, alignment, and foresight across the entire insurance tower. Yeah, and to that point, Daniel, of course, cyber insurance policies, as always, whether we're talking about AI or not, they're going to evolve over time, aren't they? That's it, exactly. And I think as brokers, we need to understand our clients are constantly evolving and growing, changing their business. So, we need to understand where their risk is before they do, really. We need to tell them, this is your current exposure. This is what we need to make sure it's covered for. Like I've said earlier, I think most cyber policies are going to be completely different. They've all got different inner limits, different meanings to certain areas. So, we need to understand what it is the client is doing, how much data they're holding, what's the cost going to be in the event of an incident. We can all go out and get a client a £2 million quote, but if they've got turnover of £50 million, what's their BI loss going to be? What are the data costs going to be in the event of a notification cost? I think the figure going around at the moment is about £5 per record. If they've got a million records, that's £5 million just on the notification costs only. So, I think, yeah, we need to make sure we are future-proofing their policies and we've got an insurer that's willing to work with our clients. I think AI as well. It's a bit of a buzzword going around at the moment. Obviously, everyone is looking where they can adopt AI in businesses to streamline principles, but it's also a danger of what data is being put in there, what controls are being put in by the business to govern what data is being used. And from there, really. So, I think we've just got to be in constant contact with our clients to find out how their online exposure is continually evolving to make sure we've got a policy that's correct for them. And Ethan said it's the role of a good broker to be able to do that for a client. Well, let me change pace with you a little bit, Daniel, if you don't mind. Let's talk a little bit about the fact that cyber reinsurance pricing has softened faster than expected. So, how are you seeing those primary cyber insurers balance the competitive pressure with concerns about potential accumulation risk? I think there's a lot more maturity in the market now. People understand what a claim is going to look like, what the value of a claim is going to be, the estimations that are going around all the time with regards to the costs that are involved. A lot of insurers have invested massively in in-house systems for incident response, so they're not always relying on third-party vendors for this. So, they can manage their outgoing costs in the event of an incident from there. I think there's a lot of pressure coming in from all insurers have large targets. They want to try and get as many risks on the bucket as possible to try and encourage new buyers into cyber insurance. I think as brokers, we are playing on that a little bit, but we'll go around the markets to try and find a quote, and then people are then going back around again just to try and push insurers down as much as possible. I don't think it's necessarily the best thing to do that all the time. The hard market will come back around again, and we need to make sure clients are not going to see 100% rate increase from one year to the next. If there is going to be increases, we need to make sure that's steady. Obviously, the costs of claims do increase just as inflation does for all other goods in the UK. So, we need to make sure that money is there to pay claims out in the long term and not just think about the short-term gains of the lower premiums for clients. I think insurers are managing it very well as well. Some insurers are quite strict on their rating, but they're offering a wider coverage for the same premium that were given maybe the year before at stricter coverage levels. Okay, so it seems that insurers are overall doing a good job, Ethan, but is the abundant capacity still there? Yeah, I'd agree with Dan's comments, really. Cyber insurance rates have continued to decline despite a quite real increase really in both frequency and severity of incidents over the years nationally. So, the National Cyber Security Centre said that as of August last year, organisations had experienced a 129% increase in significant cyber security incidents. But actually, the primary cyber market remains broadly favourable for clients, even against the backdrop of some very high-profile losses. Dan mentioned JLR earlier, M&S, Co-op, etc. You only need to see these large household names and the news to see that material cyber incidents are continuing to occur. But not all of those are insured and not always the full economic loss, but I think it's still meaningful from a risk perspective. So, then how have insurers managed to weather the storm? Well, as Dan said, underwriting and pre-loss risk selection, I think, have genuinely improved quite far in the last few years. That's partly driven by better data and partly by insurers either partnering with or becoming security providers and partners themselves, which helps to protect their downside through stronger pre-bind controls and also enables a better connection and stickier business because their post-bind partnership is strong as well. Now, none of that completely eliminates the risk of large ransomware or systemic events, but it does help explain why insurers have been comfortable deploying capacity, even in the soft market. And to that point, capacity remains very abundant. I think that's a key part of the story. The amount of reinsurance and primary capacity coming into the market means that the market can absorb quite a lot, which I guess raises the natural question of what kind of event would actually be required to upset that balance. Having said that, over the last couple of years, competition has arguably turned, in some pockets, into a bit of a race to the bottom on pricing, which isn't particularly sustainable. But I think, hopefully, we're now at or near the bottom of that curve, as we talked about earlier. I think one thing the market still needs to experience off the back of these last few years is probably the liability tail risk. Perhaps there are reserves being held for that in the actuarial functions and reinsurers, but class actions and third-party claims take time to work through the courts, and the financial impact of those incidents often emerges years after, not immediately. So I think there may well be a sting in the tail from some of those major events that we've already seen, which hasn't fully fed through to loss ratios yet. So yeah, despite those concerns, competitive pressure remains strong. I think, as we talked about right at the start, cyber is still, in our experience, relatively under-penetrated, and it's fast becoming the number one risk for lots of clients, beading into other lines like DNO and PI. So as a result, there's not really any widespread pullback from the market. Insurers still want to put on good new business and grow. Naturally, appetite does tighten in certain more complex or volatile sectors. Think US healthcare, biometrics, crypto, digital assets, that kind of thing, where capacity is a bit more selective. But for most sectors and geographies, capacity remains plentiful, even as we start to see the early signs of the soft market coming to an end. So yeah, we'll see what the liability tail risk brings, but for now, it's still good news for new buyers. Well, let's wrap up with a brief discussion about the regulatory situation as well, if we can, Ethan. Of course, regulators have been increasing scrutiny of cyber resilience and governance across multiple jurisdictions. So what compliance factors would you say are now most influential for UK domicile firms? Yeah, I think as of early 2026, we're seeing a clear shift in the UK from best practice for cyber to mandatory governance and accountability, particularly at board level. I think cyber risk is now being treated much more explicitly as a core business and governance issue, on par with financial operational risk, which is, you know, it's good news for me, a very positive development for awareness and resilience. And a key driver of that is the cyber security and resilience bill, which is coming into function and updates and expands the 2018 NIS regulations. And the idea of that basically is to regulate more traditional operators of essential services like energy, transport, healthcare, and now managed service providers and critical suppliers as well, which is, I think, quite highly relevant given how dependent most businesses are on third parties and supply chain. So, you know, that new bill will mean much stricter instant reporting, earlier notification is required, higher penalties, and also, you know, board accountability needing to be sharpened as well, and directors now being explicitly responsible for ensuring appropriate cyber expertise. So I think, you know, once personal accountability is on the line, cyber stops being an IT problem, which we know it's not, it's a business risk, and starts to be taken properly as a governance issue as well. And alongside that, I think firms are still navigating existing regulatory frameworks, be that, you know, GDPR, data protection obligations, sector specific rules. But I think the direction of travel is quite clear here. Regulators are becoming less tolerant, I think, of poor cyber hygiene, and far more focused on governance of oversight, demonstrable controls, not just policies on paper. You know, from a practical perspective, the compliance factors that matter the most, I think, are evidence of board level ownership, clear instant response, and escalation processes, strong third party and supply chain oversight, and increasing governance around, you know, emerging risks like AI, we spoke about earlier. And hopefully, you know, a good cyber insurance policy to go alongside all of that work, is not to replace the kind of security tooling and efforts to go into creating a good cyber posture, but is to complement it. So I think those are the key things to focus on from a compliance perspective. Would you say then overall, Daniel, that the reporting obligations have got a bit stronger now? That's right, definitely. I think it's more so obviously, over the last few years, it's about building these policies in place. Now I think regulators want to know that you can definitely prove that resilience, you have a clear path of what will happen. Like Ethan said, quicker reporting times at 24 hours, expanding the scope now to MSPs and data sensors, and stronger enforcement powers. I think the supply chain is always going to be a big one, as we've seen in recent incidents with Marks and Spencer's, the supply chain was hit there. And also with the Jaguar Land Rover as well. So just because one client has had a cyber incident, we need to understand what's going to affect around it, the businesses that rely on supplying to those businesses as well. So yeah, there's just a much more look on the compliance of it all from a board level, rather than like Ethan said, rather than it just being an IT problem, it needs to come from top down rather than just the IT department, really. I think that's an ongoing message, isn't it? Well, great thoughts and indeed huge thanks to you both for your time. Remember this group, along with a couple of additional faces, will be back every quarter during 2026. So keep it right here on Insurance Business TV.