Why now is a good time to review your cyber cover

Businesses can strengthen their cyber defences and still face significant financial exposure if a serious cyber event disrupts operations.

The quiet crisis in cyber insurance

Marsh’s latest report, ‘The quiet crisis in cyber insurance: Many companies carry more risk than they realise’, shows that 67% of UK clients purchase cyber limits that may not be enough for a 1-in-100-year loss scenario. That matters because a 1-in-100 event is no longer unrealistic. Today, an event of this size is considered a realistic stress test for businesses operating in a connected world. If firms do not buy enough protection, they may face severe balance sheet impacts, even when their security defences appear robust.

Businesses often grapple with a choice between investing in cybersecurity or purchasing cyber insurance. Some believe they already have sufficient controls in place and therefore do not need insurance. The reality is, as recent events have shown, cybersecurity and cyber insurance should not be seen as mutually exclusive — they are complementary.

When choosing what limit to purchase, companies can leave themselves more exposed because of default choices that may later prove regrettable.

Reviewing your cyber limit

To ensure your company’s cyber limit is accurate, it is advisable to take a comprehensive view of the financial consequences of a severe cyber event.

When planning with your broker, you may need to review:

• Lost revenue during outage periods, across hours, days, and weeks.
• The speed and resources needed to restore core systems under pressure, not just in theory but in practice.
• Contingent exposure, such as a key technology provider, outsourcer, or logistics partner suffering an outage first.
• The cost of rebuilding confidence, retaining customers, and stabilising operations after a public incident.
• Additional staffing and manual workarounds needed to maintain critical functions.
• Incident response and investigation costs, including forensic investigation, crisis consultants, and breach counsel.
• System rebuild and restoration, especially which critical systems and assets must be restored first.
• The potential impact of regulatory fines, penalties, or claims after a cyber event.
• Contractual liabilities, and the company’s position on customer compensation and goodwill gestures.
• Spending on reputational recovery and customer retention.

In many cases, the insured limit is exhausted long before the total economic damage is established. The insurer does not absorb that shortfall – it falls to your balance sheet. Ensure your risk transfer strategy reflects the true cost of operational disruption, not just headline breach expenses.

Market conditions remain favourable for buyers

Despite ongoing claims activity, the cost of cyber insurance has fallen materially from its recent peak. Primary cyber pricing is down approximately 42% from 2022 levels, driven by stronger insurer competition, broader capacity, and coverage for well-managed risks.

That decline creates a welcome opportunity for companies to capitalise on market dynamics. Organisations that reduced cover in the past to manage costs may now be able to secure higher limits for a similar premium, or in some cases a lower one, than in recent renewal cycles.

However, the market cycle may not stay favourable for insureds forever. If severe claims continue, pricing may rise and underwriting may tighten again.

Expert cyber risk advice and insurance

Given that cyber risk is constantly evolving, many businesses are now turning to cyber insurance, which helps them recover losses and associated costs, for instance, resulting from large–scale breaches, business interruption, ransomware, and other types of cyberattack.

We recommend working with your insurance broker or risk management experts to review your cyber risk preparedness, security controls, any insurance gaps, and your cyber insurability.