2026 Cyber Insurance Market Outlook
Our clients tell us cyber risk is one of the exposures that keeps changing fastest, and the insurance market is changing along with it. Below, we’ve shared what to expect from the cyber insurance market in 2026, plus two threats worth watching: tech support and help desk scams, and business email compromise. In over a century, we’ve seen risks change shape many times, and staying informed is the first step toward staying protected.
2026 Cyber Insurance Market Outlook
Following a period of volatile losses and complex underwriting dynamics, the cyber insurance segment has experienced softening conditions and greater stability over the past several years. According to industry data, average rate increases steadily fell from 2022-24 until they became nearly flat. In 2025, more aggressive retention strategies, expanded capacity and growing competition — primarily driven by new market entrants — fostered a buyer-friendly environment, with most insureds experiencing flat to low- or mid-single-digit premium decreases. As a result, average rate decreases hovered around 2% throughout the year, while some low-risk accounts even saw double-digit reductions. These favorable conditions are linked to stringent underwriting standards from insurers and increased cyber resilience among policyholders, which have helped stabilize loss ratios despite a continued rise in the severity of cyberattacks. Additionally, some insurers are now willing to offer broadened coverage, higher limits and reduced self-insured retentions to policyholders who demonstrate strong cyber hygiene and have documented mitigation steps in place. Although conditions are expected to continue softening in the coming months, it’s worth noting that various market developments — namely, an increase in artificial intelligence-powered attacks, business email compromise (BEC) scams and other advanced phishing incidents — could prompt a return to unpredictable claims patterns and threaten ongoing stabilization. As such, most insurers are upholding strict underwriting discipline and remaining vigilant in their approach to high-risk accounts to bolster profitability amid rising losses, ultimately signaling a sense of caution in the year ahead.
Barring an influx of catastrophic losses and associated capacity constraints, policyholders can expect continued pricing stability and milder conditions across the cyber insurance segment in 2026. Nevertheless, evolving cyberthreats and claims patterns could prompt a swift market reversal. Specifically, industry experts warn that a substantial systemic cyberattack, such as a global third-party data breach affecting a range of corporations and their stakeholders, could quickly harden the market. Even amid current market moderation, policyholders should be aware that their renewal experiences may differ significantly based on their internal cybersecurity controls. In an effort to bolster underwriting profits and avoid large-scale payouts, insurers are promoting further segmentation between low- and high-risk accounts, thereby rewarding insureds who showcase a clear commitment to solid cyber hygiene and documented incident prevention and response protocols. Well-managed accounts may continue to encounter flat to mild rate reductions, while those with limited controls and poor loss history could face steady premium increases. Going forward, risk management strategies such as multifactor authentication (MFA), endpoint detection and response (EDR) solutions, secure data backups, tested incident response plans and routine staff training will likely be considered minimum requirements for adequate cyber coverage. Policyholders who stay informed about the latest cyber exposures and adjust their mitigation strategies as needed will be best equipped to handle this evolving risk landscape.
Combating Tech Support and Help Desk Scams
Cybercriminals employ various techniques to infiltrate networks and steal sensitive data. Technical support scams, where fraudsters pose as major tech vendors, and help desk scams, where malicious actors impersonate internal IT staff, are two mechanisms they use to achieve their objectives. For tech support scams, malicious actors often use unsolicited pop-up ads, social media advertisements, or phishing calls or emails to try to convince an organization’s employee that there is a technical issue requiring immediate attention. The message then directs the employee to bogus support numbers that appear to be for a well-known cybersecurity vendor. The fraudulent actor may then run a fake “scan” of the computer and find nonexistent “issues,” claiming they need remote access to fix the computer. They may then install malware that steals sensitive information; request enrollment in a fake support contract; offer to sell phony services, software or programs; or request payment for their services. In help desk scams, cybercriminals seek to deceive staff by impersonating an organization’s IT help desk. They may use voice phishing (or vishing) tactics, impersonating legitimate IT employees by making calls claiming there is an IT emergency or that users’ login credentials need to be reset. Like tech support scams, these attackers aim to trick employees into granting access to their devices or networks. They may also utilize text message phishing (or smishing), illegitimate emails or phony collaboration platform messages to accomplish the same goals.
Through both of these scams, cybercriminals employ social engineering strategies to fool an organization’s staff. For example, they communicate with urgency and utilize technical jargon and scare tactics (e.g., stating it is a major system issue) to pressure employees into divulging sensitive information. There are several techniques that organizations can utilize to prevent tech support and help desk scams from happening:
Educate staff. Training workers to detect signs of tech support and help desk scams can prevent cybercriminals from accessing sensitive data. These training sessions should be provided regularly, both upon hire and periodically thereafter, and staff should feel comfortable asking questions and raising concerns during them.
Establish secure communication protocols. It’s imperative for organizations to have procedures that define communication protocols when working with tech support companies or IT services. These communications should be secure, and staff should be instructed to disregard messages that do not come through the proper channels.
Leverage technical safeguards. Organizations should utilize security software that is routinely patched and updated. It should be configured to block pop-up windows and known malicious behaviors. Email security solutions can also be used to filter out fraudulent emails and attachments.
Tech support and help desk scams can carry devastating consequences. By implementing robust prevention strategies, organizations can reduce their risk of these attacks being effective, safeguarding their security, finances and reputations.
Navigating Rising BEC Exposures
Email-led fraud also continues to run rampant across industry lines, particularly in cases involving unauthorized fund transfers and associated first-party losses. BEC scams have emerged as the costliest form of such fraud, with cybercriminals impersonating trusted corporate executives or business partners via spoofed email addresses and tricking targets into sharing sensitive information or initiating large wire transfers.
According to the Internet Crime Complaint Center, BEC scams have consistently ranked among the top contributors to cybercrime complaints filed with the FBI since 2022, generating over 20,000 complaints and more than $2.7 billion in total losses each year.
In light of ongoing BEC scams and fraud issues, many cyber insurers are tightening sublimits for social engineering losses and requiring policyholders to implement more advanced prevention measures as a prerequisite for coverage. These measures may include more robust email authentication technology and EDR solutions, MFA and least-privilege segregation for systems containing sensitive assets, and additional payment verification steps for wire transfers. It has also become more common for insurers to deploy questionnaires that probe policyholders’ vendor invoicing workflows, treasury controls and employee training efficacy (e.g., pass/fail rates for phishing simulations). Some may even ask for specific documentation, such as payee change verification playbooks and bank callback evidence, before releasing higher policy limits. In light of these trends, it’s crucial for organizations to review their specific BEC exposures and adjust their mitigation strategies as needed, to reduce the likelihood of large-scale losses. For additional risk management guidance and coverage resources, contact us today.
Want to talk through your cyber coverage heading into renewal? Explore our commercial risk services or reach out to our team. No pressure, just a conversation about what makes sense for your business.
This Cyber Risks & Liabilities newsletter is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel or an insurance professional for appropriate advice. © 2026 Zywave, Inc. All rights reserved.