Overview
The NAIC overhauled the cyber supplement to the annual statement for 2024 filings, changing from a two-way standalone/packaged split to a there-way primary / excess / endorsement split, according to AM Best’s Report. Beinsure analyzed the report and highlighted the key points.
This report is based solely on companies that have filed any NAIC cyber supplement. Any cyber business written by alien insurers is not included. Also, there were changes to the NAIC filing in 2024. As such, year-over-year comparisons may not always be applicable.
“Packaged” was intended primarily as an endorsement only, but some entities were not making that distinction, including a cyber policy as part of a package of policies.
The change in wording from the NAIC is now a clear distinction between policies covering only cyber versus policies for which cyber is an endorsement to another policy.
Key Highlights
- The NAIC shifted from a two-way (standalone / packaged) to a three-way classification—primary, excess, and endorsement—providing clearer insight into cyber policy structures and premium allocation.
- Direct premiums written for cyber insurance fell by 2.3% to $7.075bn in 2024, marking the first decline since NAIC began tracking in 2015. The drop aligns closely with a 1.6% pricing reduction, indicating stable demand.
- Surplus lines carriers maintained and slightly increased their share of cyber premiums, especially in complex and excess risk segments. Nearly all endorsement policies remain on admitted paper, while primary and excess are dominated by surplus lines.
- First-party claims account for 75% of all cyber claims. Increased litigation and ransomware activity have extended the claims tail, driving higher loss and defense costs.
- Roughly 50% of cyber premiums are ceded to reinsurers. While insurance-linked securities provide some capital (~$1bn), the sector remains vulnerable to reinsurance market shifts.
The result is a better picture as to what types of policies are being issued and the premium paid for cyber coverage.
For the first time since the NAIC began collecting data on cyber insurance, total direct premiums written (DPW) for the industry decreased.
The premium decline was nearly identical to the year-over-year decline in pricing, indicating there was little change in cyber risk exposure from 2023 to 2024 (see 2025 Global Cyber Risk Report).
With an increase in claims accompanying the drop in premium, the loss ratio, including defense and cost containment (DCC) expenses, did increase.
Direct Premiums Written for Cyber Insurance
In 2024, direct premiums written (DPW) for cyber insurance declined by 2.3% to $7.075bn, down from $7.244bn in 2023. U.S. cyber insurance premium rates decline in 2025. This marks the first annual decrease in cyber insurance premiums since the NAIC began collecting this data in 2015.
Despite this drop, the direct loss ratio remained below 50%, indicating continued profitability for insurers underwriting cyber risk, even with inflationary pressure on losses and lower premium levels.
The decline in DPW primarily reflects reductions in pricing rather than changes in exposure.
According to data from the Council of Insurance Agents and Brokers (CIAB), cyber insurance pricing decreased by an average of 1.6% during the final three quarters of 2024.
Surplus Lines as Share of all Cyber DPW
The similarity between the decline in pricing and the overall drop in premium suggests that demand for cyber coverage remained stable, according to Global Cyber Insurance Industry Trend.
The reduction in premium may also be linked to a trend among large organizations shifting their cyber risk coverage to single-parent captive insurers.
Firms with strong cybersecurity practices and favorable historical loss experience often prefer to retain premiums within their own corporate structure.
Admitted vs Surplus Cyber Paid Loss and DCC Ratio
By using captives, these organizations retain the financial benefit of their own performance. Since such captives typically do not report to the NAIC, this activity is not reflected in the cyber insurance supplement.
During the hard market phase, premium growth significantly exceeded pricing increases, indicating rising demand for cyber insurance.
In contrast, the current premium decrease aligns closely with the decline in pricing, further supporting the view that demand remains steady despite the overall market contraction.
Cyber Insurance Market Totals
| Category | Premiums 2024 ($mn) | Chg (%) | Market Share (%) | Comb Ratio |
| Top 5 | 2,153.1 | -5.8 | 30.4 | 71.6 |
| Top 10 | 3,509.2 | 2.3 | 49.6 | 75.2 |
| Top 20 | 5,393.3 | 2.7 | 76.2 | 78.1 |
| Total P/C Market | 7,075.2 | -2.3 | 100.0 | 72.7 |
Surplus Lines Carriers Increase Market Position
Much of the new capacity during the hard market came from surplus lines writers. Those carriers have held—and marginally increased—their market share even as the total premium slightly contracted. This increase in market share is not from any new growth.
Total DPW among surplus writers was essentially unchanged, down by less than 0.1%, leaving most of the decrease to the admitted carriers.
Surplus lines paper remains the prime vehicle for complicated cyber risks, and this is evident through the split among primary, excess, and endorsement coverage.
Endorsement coverage, which is typically coverage added to the insured’s existing policy, is almost exclusively on admitted paper, 97%.
Comparison of Surplus Lines Writers vs. Admitted Carriers
| Category | 2020–2022 Hard Market | 2023–2024 Market Conditions |
|---|---|---|
| Market Entry | New surplus lines writers entered with favorable pricing | No significant new entrants reported |
| Legacy Losses | Not applicable to new writers | Ongoing for existing carriers |
| Pricing Trend | Elevated pricing across most commercial segments | Pricing leveled off or decreased |
| Target Market | Larger commercial entities | Continued focus on large entities |
The larger risks tend to buy surplus lines coverage for policy language tailored to the insured’s needs. On primary cyber policies, surplus writers account for a majority of the premium.
This split is even more pronounced for the larger risks purchasing excess limit, where over three-quarters of the premium is written by surplus lines carriers.
Top 20 U.S. Cyber Insurance Groups
| Rank | Company | Premiums 2024 ($mn) | Chg (%) | Market Share (%) | Comb Ratio |
| 1 | Chubb INA Group | 560.6 | -2.3 | 7.9 | 60.5 |
| 2 | Travelers Group | 535.4 | 39.1 | 7.6 | 89.4 |
| 3 | Fairfax Financial (USA) Group | 360.6 | -22.1 | 5.1 | 71.3 |
| 4 | Tokio Marine US PC Group | 356.0 | -5.8 | 5.0 | 73.1 |
| 5 | XL America Companies | 340.4 | -30.1 | 4.8 | 62.1 |
| 6 | Arch Insurance Group | 285.0 | 1.0 | 4.0 | 74.0 |
| 7 | At-Bay Specialty Insurance Co. | 280.6 | 344.9 | 4.0 | 86.2 |
| 8 | American International Group | 272.6 | -0.6 | 3.9 | 74.0 |
| 9 | Sompo Holdings US Group | 262.7 | -0.1 | 3.7 | 83.9 |
| 10 | Starr International Group | 255.1 | -1.9 | 3.6 | 112.9 |
| 11 | CNA Insurance Companies | 240.3 | 5.2 | 3.4 | 103.7 |
| 12 | AXIS US Operations | 204.6 | 12.9 | 2.9 | 53.8 |
| 13 | AmTrust Group | 202.5 | 19.1 | 2.9 | 84.1 |
| 14 | Berkshire Hathaway Insurance Group | 187.6 | -35.2 | 2.7 | 113.2 |
| 15 | Hartford Insurance Group | 185.6 | 6.1 | 2.6 | 43.4 |
| 16 | Beazley USA Insurance Group | 184.9 | 23.5 | 2.6 | 41.9 |
| 17 | QBE North America Insurance Group | 184.1 | 137.9 | 2.6 | 121.1 |
| 18 | Liberty Mutual Insurance Companies | 169.8 | -4.8 | 2.4 | 102.2 |
| 19 | Zurich Insurance US PC Group | 168.2 | -15.6 | 2.4 | 102.4 |
| 20 | Ascot Insurance U.S. Group | 156.8 | -10.2 | 2.2 | 77.5 |
The new NAIC cyber supplement provides detailed information along with the new separation of primary, excess, and endorsement coverage.
Excess policies, offering larger limits and typically covering larger entities with more exposure, are more expensive than either primary policies or endorsements to other policies.
Cyber Insurance Claims
Claims increased significantly in 2024 and are also consistent with the AM Best cyber questionnaire; first-party claims are about 75% of all claims.
Ransomware attacks began accelerating about 5 years ago, and data for traditional actuarial analysis in the form of early development patterns is now becoming available.
We believe there is still a tail on these losses, as litigation and discovery could be more protracted and hacks could be latent for a long time before they are exploited.
Rising litigation activity may extend the claims tail, even for first-party cyber claims, increasing both claim costs due to inflation and legal expenses.
Cyber Claims by Type
Third-party cyber risk presents growing challenges
Policyholders now face exposure not only from their own operations but also through vendor relationships.
Subrogation against a vendor responsible for a loss can be difficult if the vendor lacks sufficient assets, making recovery efforts uneconomical.
Additionally, pursuing subrogation may strain the insured’s vendor relationship. As part of effective cyber risk management, insureds should conduct thorough due diligence on third-party vendors and prepare for such contingencies.
Support from the insurance-linked securities (ILS) market signals some confidence in cyber risk models, but total capacity remains limited, with only around $1bn in coverage.
The cyber insurance market remains heavily reliant on reinsurance, with approximately 50% of direct premiums written ceded to reinsurers.
This reliance leaves the primary market vulnerable to shifts in reinsurance capital allocation. If reinsurers redirect capital elsewhere, the cyber market may face supply constraints and disruption.
FAQ
The NAIC replaced its previous two-way classification (standalone vs. packaged) with a three-way split: primary, excess, and endorsement, improving clarity on policy types and premium allocation.
Due to changes in the NAIC reporting structure and exclusions of cyber business from alien insurers, direct year-over-year comparisons may not be fully reliable.
Direct premiums written declined by 2.3% to $7.075bn, mainly due to a 1.6% drop in pricing, indicating steady demand rather than reduced exposure.
Surplus lines writers have maintained and slightly increased market share, focusing on complex risks and holding the majority of primary and excess cyber policy premiums.
Claims rose significantly in 2024. About 75% are first-party claims, with ransomware and litigation contributing to longer claims development and increased costs.
Insureds are exposed through vendors. Subrogation is often not pursued due to vendors’ lack of assets or business relationships, stressing the need for vendor due diligence.
About 50% of cyber premiums are ceded to reinsurers. While ILS participation is growing, coverage remains limited (~$1bn), leaving the market exposed to reinsurance capacity shifts.
AUTHOR: Steve Robinson – Area President & National Cyber Practice Leader for Risk Placement Services
