U.S. Cyber Insurance Premiums Near $7.5 Billion as Endorsements Drive Policy Growth

The U.S. cyber insurance market is expanding, but policy counts and premium tell different stories. Domestic direct premiums written reached nearly $7.5 billion in 2025, up from $2.75 billion in 2020. Yet endorsements accounted for almost 53% of policies in force and only 4% of premium, a sharp gap between how often this coverage appears and how much money it represents.

Those figures come from a new report by the National Association of Insurance Commissioners (NAIC). Including surplus insurers domiciled outside the United States, cyber direct premiums written totaled about $9.5 billion in 2025, a 3.5% increase from 2024. The wider figure captures a larger slice of the market, but the domestic total remains useful for seeing how coverage is distributed among U.S. insurers.

Policy growth is concentrated in endorsements

Domestic cyber policies in force climbed 33% year over year to about 5.8 million in 2025. Endorsement policies rose 53.8%, compared with 13.6% growth for primary cyber policies, while surplus policies fell 45.3%. The contrast suggests that much of the increase in policy count came from cyber protection attached to other commercial insurance, rather than from standalone policies.

The split points to two distinct parts of the market, according to NAIC: surplus lines insurers write primary and excess policies focused on cyber, while the admitted market largely adds smaller amounts of cyber protection to other commercial coverage. More than 60% of U.S. cyber premium comes from primary policies, even as endorsements dominate policy volume. Surplus lines carriers now hold nearly two-thirds of all cyber premium.

That distinction matters because a policy count doesn't show how much protection each policy provides. An endorsement can add cyber coverage to an existing commercial policy, but its low share of premium indicates that these policies account for a relatively small portion of the dollars insurers collect. The figures describe different measures of market reach, not interchangeable measures of protection.

Premium growth meets rising claim severity

Pricing continued to ease even as the loss ratio deteriorated. The first quarter of 2026 marked the eighth consecutive quarter of cyber rate reductions. The loss ratio rose to 53 in 2025 from 48.7 in 2024, indicating that claims consumed a larger share of premium than they had the prior year.

NAIC reported that claims frequency declined for medium and large businesses, while severity increased in both segments. Small-business claim severity fell. The association said the pattern may reflect stronger underwriting selection and security controls reducing the number of claims, while incidents at larger organizations are becoming more expensive to resolve.

Those trends can coexist. Fewer claims don't necessarily mean lower claims costs if the incidents that do occur produce larger losses. For insurers, that puts attention on both the likelihood of a claim and its potential cost; for businesses, it helps explain why coverage availability and pricing may not move in lockstep with incident frequency.

The numbers here are underwhelming as evidence of improving market economics: rates have declined, but the loss ratio has worsened. That doesn't establish what caused the change or how it will continue. It does make the relationship between pricing, claim size and underwriting discipline a central question for the market.

A large gap between cyber losses and insurance

The market’s growth also sits against a sizable coverage gap. NAIC cited estimates putting global economic losses from cyber incidents between $1 billion and $10 billion, with risks including artificial intelligence, ransomware, third-party dependencies and geopolitical factors. It said insurance covers about 1% of global economic cyber losses.

That estimate signals how much of the economic cost falls outside insured claims, though it doesn't mean every loss could be insured or that the estimate maps directly to demand for policies. Cyber incidents can affect businesses through interruption, recovery costs and harm that may be difficult to price or transfer. Similar systems of commercial insurance often address only some parts of a risk, leaving companies to manage the rest through their own controls and resources.

If you're working in this space, the distinction between broad policy growth and meaningful limits of protection deserves attention (and this is the part most people overlook). A rising count of policies can reflect wider access to some coverage without showing whether the largest exposures are adequately insured. The premium split makes that distinction especially relevant here.

What the next signals may show

For market participants, the headline premium expansion masks a split in how coverage is bought and where premium accumulates. The next signal to watch is whether falling rates can coexist with worsening loss performance, particularly as large and medium-sized claims become more severe.

That question will depend on more than policy totals. Changes in claim frequency, claim severity and the mix between endorsements and primary coverage will help show whether growth is broadening protection or mainly increasing the number of policies with relatively limited cyber cover. The available figures establish the tension; they don't settle how insurers or buyers will respond.

More policies. More premium. A harder test of whether pricing reflects the cost of claims.