Newsletters
Risk Central
Digital EditionCyber Insurance Market Reaches Decade-Low Pricing as Claims Surge 22%
Cyber insurance pricing continued its downward trajectory through the first quarter of 2025, declining 7% and marking the 10th-consecutive quarter of decreases for U.S.-based risks, according to new market analysis from Aon.
The cyber insurance marketplace remains firmly in buyers’ favor, driven by heightened global competition and ample capacity from insurers.
“The time is ideal for businesses of all sizes to enter the cyber insurance market, and this is of utmost importance for increasingly vulnerable middle-market companies,” stated Brent Rieth, Global Cyber Leader for Aon.
This pricing decline occurs against a backdrop of intensifying cyber threats. Aon’s data revealed 1,228 reported incidents across U.S. clients in 2024, a 22% increase year-over-year. Cyber events represented the majority of claims, with 776 reported matters in the U.S.—up one-third from the previous year.
Major systemic events dominated 2024’s threat landscape, according to Aon’s report. A February attack on Change Healthcare, a health care payments technology provider, resulting from failure to implement multi-factor authentication, affected approximately 190 million individuals’ private data and generated $3.09 billion in pre-tax financial impact. The July CrowdStrike outage crashed more than 8.5 million systems globally, with one airline reporting $500 million in revenue impact and $170 million in expenses.
Despite increased claims frequency, insurer loss ratios remained stable and even improved slightly, decreasing nearly 3% compared to 2023. This stability stems from organizations’ improved cyber preparedness and declining ransomware payment amounts, which dropped 77% among Aon clients, the report noted.
Ransomware incidents in 2024 increased 24% versus 2023, yet fewer companies are paying attackers. Industry data shows only 25% of companies paid ransoms—an all-time low. While average ransomware payments reached $553,959 in the fourth quarter 2024, median payments declined 45% to $110,890, indicating most organizations are successfully resisting extortion attempts, according to the report.
Middle-Market Companies Face Disproportionate Risk
The analysis reveals concerning vulnerability patterns among mid-sized organizations. Companies with $100 million to $2 billion in annual revenue filed more cyber claims than any other group, representing 52% of all matters, despite comprising a smaller portion of the market, according to Aon.
This disproportionate impact reflects inadequate preparedness levels. Among middle-market companies, 55% have not conducted cyber security tabletop exercises, while 45% maintain vulnerability scans covering less than 100% of their enterprise infrastructure, Aon’s Rieth noted.
The preparedness deficit extends beyond technical controls. Research from IBM demonstrates that organizations with incident response teams and formal response plans reduce breach costs by an average of nearly $500,000, the report noted. Yet many middle-market companies lack these fundamental safeguards, leaving them exposed to both direct attack costs and extended recovery periods.
Organizations that invested in cyber preparedness demonstrated measurably better outcomes. Aon clients with strong security controls and continuity plans were better positioned to respond to attacks, restore systems, and regain data access, the report stated. These companies showed 9% improvement in critical security controls that impact insurability, with notable gains in financial services (21%), professional services (12%), and manufacturing (11%) sectors.
The underwriting environment has evolved to reflect these realities. Insurance carriers have become more sophisticated in risk assessment while requesting less documentation than previously required. Rather than applying rigid control-based criteria, insurers now focus on overall cyber maturity profiles and accept organizational narratives around specific security measures, per Aon’s report.
Privacy-oriented controls emerged as a growing priority for cyber insurance carriers in 2024, responding to increasing legal scrutiny around personal information handling, according to the report. This shift reflects the rise of multi-plaintiff class action lawsuits, particularly in health care sectors following numerous breaches that allegedly violated patient privacy rights.
Regulatory changes amplify these concerns. More states are implementing laws similar to the California Consumer Privacy Act, while new technologies like AI create additional exposure through embedded tracking code and data collection practices.
Strategic Risk Management Becomes Essential
The intersection of rising cyber threats and favorable insurance pricing creates a unique opportunity for strategic risk management. However, the data suggests that cyber events increasingly translate into broader reputation risks that extend far beyond immediate technical impacts, according to Aon.
Analysis of 1,414 cyber events through 2024 shows that 56 developed into reputation risk events, causing average shareholder value declines of 27%. Malware and ransomware attacks proved most likely to generate reputational damage, accounting for 60% of reputation risk events despite representing only 45% of total cyber incidents.
The severity varies by attack type. Network and system attacks typically caused the most damage, resulting in 51% average declines in shareholder value. Even less severe categories like unauthorized access attacks still generated average impacts of 25% on shareholder valuations.
Companies that successfully navigate cyber events can actually enhance their reputation and shareholder value. Research shows that 17 of 47 studied cyber attacks resulted in average shareholder value increases of 18% when organizations demonstrated strong incident response. The remaining 30 events caused average 21% value declines.
According to Aon, five key factors drive successful value recovery: comprehensive preparedness including analytical insights for risk understanding; strong visible leadership during incidents; rapid, targeted and credible response actions; quick, open and honest communication about events and responses; and demonstration of genuine commitment to meaningful change following incidents.
View the full report here. &
