Rates remain low, but one threat is rising again, pushing insurers to hold the line
Cyber
By Chris Davis
Dec 03, 2025ShareThe cyber insurance sector may have found some stability, but that doesn’t mean it’s on solid ground. According to Jacob Ingerslev (pictured), head of cyber and tech underwriting at Tokio Marine HCC – Cyber and Professional Lines Group, a member of the Tokio Marine HCC group companies based in Houston, Texas, the current soft market has deep roots - and isn’t going anywhere fast.
“We got here through a ransomware wave that started in around 2019,” he said. That surge triggered “really fast and hard, steep hard market conditions in the 2020 to 2022 period” as carriers raced to adjust their underwriting to account for unexpected loss activity.
By mid-2023, the environment had softened - too much, in fact. “We’re still in soft market territory,” Ingerslev said. “But it’s not worsening.” While that brings some relief, the divide between buyers and carriers is clear. “If you’re a buyer, it’s good times. If you are an insurance carrier, stability and not volatility is the goal,” he said.
Ransomware, meanwhile, continues to trend upward. A brief lull in 2022 led some to think the worst was over, but that optimism has faded. “Everyone thought, OK, it’s over now, but it certainly returned,” said Ingerslev. He estimated a 20% to 30% year-over-year increase in ransomware activity, based on both internal portfolio data and ransomware group leak sites, where stolen data is posted if victims don’t pay.
“If you have that information and you know roughly the percentage of people paying extortion, you can kind of get to some rough numbers,” he said.
Ransomware targets small firms, but they’re still not buying
Despite rising threat levels, new customer acquisition has stalled - one of the key reasons rates continue to fall. “There just aren’t enough new buyers coming into the market,” Ingerslev said. With carriers fighting over the same pool of large-account renewals, pricing pressure has intensified.
He sees the biggest opportunity in the small business and lower-middle market segment. “That’s where there’s less penetration of cyber insurance,” he said. “There are about 30 million companies in the US and there are only 1,000 that make up Fortune 1,000 companies.” But the latter group still accounts for roughly a third of all cyber insurance premium volume.
More troubling, many small businesses aren’t even aware they’re at risk. While high-profile attacks against large companies dominate headlines, they don’t reflect the full picture. “Despite all the activity hitting the news stream, I think there’s this unfortunate sensation that it’s only big companies being impacted,” said Ingerslev. “But in reality, just given the sheer number of small companies out there, there’s a lot more ransomware activity in the small business space.”
Tech, AI, and international lag
Beyond the US, the global cyber insurance market is still underdeveloped. “The total cyber insurance premium market globally is estimated at about $15 billion, and two-thirds of that is the US,” said Ingerslev. He expects that balance to shift quickly, especially as artificial intelligence enables more sophisticated international cybercrime.
“AI will now make it much easier to get your foreign language attacks right, specifically when it comes to the social engineering piece,” he said, adding that deepfake voice calls will only accelerate the trend. “We will see a shift to more international attack activity for that reason.”
On the coverage side, cyber remains one of the more innovative product lines in the insurance space. “There really are no two exactly the same insurance policies out there in the cyber market,” said Ingerslev. “It hasn’t standardized much.” That variability gives insurers room to innovate but also adds complexity to comparison and pricing.
Holding the line as market shifts again
Longer claim resolution timelines due to increased litigation have added new challenges, but Ingerslev warned that market cycles in cyber will continue to move faster than traditional lines. “It probably is, over time, going to switch more rapidly because it’s still relatively short tail as a line of business - even though it’s becoming longer tail with some of the lawsuits happening,” he said.
That volatility leaves little room for error. “This is where you can make some serious mistakes,” Ingerslev said. “From our perspective, now is the time to stay disciplined and hold the line. If you have underperforming areas of your portfolio, you just need to address them and worry less about what everyone else is doing.”
Related Stories
- Why this soft market could be the most dangerous yet for cyber insurance
- How cyber insurers are adapting to the new ransomware playbook
Top-rated Choice