2026 MARKET TRENDS

Cyber

Key Takeaways

While overall market rates are stable, organizations in high-risk sectors like healthcare or those with poor security controls may face stricter underwriting and higher pricing
Systemic risks — interconnected, unpredictable events like cloud outages or widespread software vulnerabilities — pose threats that extend far beyond individual organizations
The rise of sophisticated, AI-powered cyberattacks, including deepfake fraud and "shadow AI" exposures, demands stronger internal governance and advanced defensive strategies
Underwriters are increasing their focus on privacy protocols, data collection practices and third-party risk management, influenced by both domestic litigation and global regulatory trends

Carriers are actively managing exposure and exploring tools such as catastrophe bonds to help support long-term market stability.

Overview

At a high level, the cyber insurance market remains relatively stable. Many organizations continue to see steady primary pricing and softer conditions in excess layers. That said, this overall stability masks meaningful differences based on industry, size and security posture.

A clear divide continues to exist between large organizations and small to medium-sized enterprises (SMEs). Larger organizations are more likely to have the security controls carriers require. Many smaller organizations lack the resources or internal knowledge to implement these measures and may view cyber insurance as inaccessible until a loss occurs. This protection gap matters, as weaknesses among smaller vendors can create downstream risk across larger supply chains.

Systemic risk is playing a larger role in underwriting decisions. Events such as major cloud outages or vulnerabilities in widely used software can affect thousands of businesses at the same time. Carriers are actively managing this exposure and exploring tools such as catastrophe bonds to help support long-term market stability.

Market Conditions

While the cyber market is not broadly hardening, underwriters are tightening requirements in targeted areas to address evolving threats:

High-profile disruptions, such as the ransomware incident affecting Jaguar Land Rover and the cyberattack on United Natural Foods, have reinforced the financial impact of supply chain dependencies

Risks tied to tracking technologies and improper data collection are receiving increased scrutiny

While U.S. regulation remains fragmented, global frameworks such as European data and AI regulations are influencing underwriting standards

Carriers are focused on unauthorized employee use of AI tools, often referred to as shadow AI; employees may unintentionally expose sensitive data or proprietary information through public AI platforms

Ransomware incidents involving both system encryption and data theft are now common, increasing severity and complexity of claims

Rate Outlook

Impacts & Considerations

Brown & Brown expects generally stable market conditions to continue into the first half of 2026. Improved cybersecurity practices and increased carrier competition are supporting flat to slightly lower pricing for standard risks. Organizations in higher-risk industries or those with weaker security controls or prior losses may face limited competition and higher pricing as a result.

Here are several steps organizations can take to help strengthen their risk profile and improve renewal outcomes:

Implement core controls

Underwriters expect foundational controls such as multifactor authentication for remote access and privileged accounts, endpoint detection and response and secure backup access across organizations of all sizes.

Strengthen third-party risk management

Formalize vendor vetting and contractual requirements and review contingent business interruption coverage to address losses tied to vendor outages.

Plan for systemic disruptions

Recent outages have highlighted the need for operational contingency planning beyond insurance coverage.

Address AI and privacy risk

Establish clear governance around AI usage and reinforce employee awareness of data handling expectations, and regularly review privacy practices to reflect both domestic and international requirements.

Secure cyber coverage

The financial impact of a cyber event typically exceeds the cost of insurance; coverage options are available for organizations of all sizes, including programs designed to support smaller businesses.

Download this report

Go to Employee Benefits Report

Go to Personal Insurance Report

Ready to find your solutions?

Let's chat

Brown & Brown, Inc. and all its affiliates, do not provide legal, regulatory, tax guidance and/or advice. If legal advice, counsel or representation is needed, the services of a legal professional should be sought. The information in this document is intended to provide a general overview of the topics and services contained herein. Brown & Brown, Inc. and all its affiliates make no representation or warranty as to the accuracy or completeness of the document and undertakes no obligation to update or revise the document based upon new information or future changes.