Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Cyber Insurance Premiums Are Finally Dropping
Transcript
- Lucas: So here's something that would've sounded crazy about three years ago. Cyber insurance premiums are actually coming down. Luna: Wait — after that insane run-up from 2020 to 2023, where rates were doubling in some cases? That market is softening? Lucas: It is. And it's not just anecdotal. The latest data from Marsh — one of the big brokerages — shows average premiums dropped about 15 percent in the first half of 2026. That's on top of roughly a 10 percent decline in 2025. Luna: So two straight years of decreases after what, four years of brutal increases? That's a real shift. Lucas: Right. To put it in perspective, between 2020 and 2023, average cyber premiums more than doubled. Some sectors — healthcare, manufacturing — saw triple-digit increases. Carriers were basically panic-pricing because ransomware losses were exploding. Luna: And now they're not? Or is it more that they've gotten better at pricing the risk? Lucas: It's a combination of three things. First, the underwriting data has gotten a lot better. Carriers now have several years of claims history from their own books, plus they're using external threat intelligence to model risk more precisely. They're not just guessing anymore. Luna: That's the thing — in the early days, nobody really knew what to charge. It was almost like writing a blank check. Lucas: Exactly. The second factor: buyers have actually improved their security posture. Companies that want reasonable rates are implementing basic controls — multi-factor authentication, endpoint detection, regular backups, incident response plans. Insurers are demanding that stuff in the application, and it's working. Luna: So the good behavior is being rewarded. That's the carrot part of the stick. Lucas: And the third factor is competition. A bunch of new carriers have entered the market — some are traditional insurers expanding their cyber lines, others are pure-play cyber specialists backed by reinsurance. More supply means lower prices. Luna: But is this a sustainable trend or are we just in another soft market cycle? Because we've seen this movie before in property and casualty insurance — prices go down, underwriting gets loose, and then a big loss event blows everything up. Lucas: That's the billion-dollar question. And honestly, some analysts are already warning that the market might be getting too soft too fast. If there's a major ransomware attack that triggers a wave of claims, rates could spike again. Luna: What would that look like? One big event or a series of them? Lucas: Probably a series. The insurance industry is still wary of systemic risk — like a vulnerability in a widely-used software platform that gets exploited across thousands of companies simultaneously. That's the kind of scenario that could reset the market. Luna: Yeah, that keeps me up at night too. But in the meantime, it's good news for CISOs who've been getting squeezed. Lucas: It is. And look, this is a good place for a quick honest thing. This show is completely ad-free — we don't have sponsors, we don't run pre-rolls. A small group of listeners chips in monthly through buy me a coffee dot com slash fexingo, and that's literally what keeps us going. Luna: Yeah, it's a pretty lean operation. But it means we can talk about whatever we want without anyone pulling strings. Lucas: Exactly. So if these conversations are useful to what you're building or running, that's the way to keep them coming. No pressure, just the option. Luna: Alright. Back to the softening market — what does this mean for a CISO who's about to renew? Any negotiation tips? Lucas: Yeah, a few. First, don't just accept the renewal quote. Even if your current carrier offers a decrease, you can probably do better by shopping around. Get at least three quotes from different carriers. Luna: And make sure you have your security controls documented. The more evidence you can provide — like proof of multi-factor authentication, endpoint detection response, employee training — the better your rate. Lucas: Right. One thing I've seen: companies that invest in a formal risk assessment and share it with underwriters often get 10 to 20 percent better pricing. It signals that you understand your risk profile. Luna: Also, consider increasing your retention — the deductible — if your organization can absorb more risk. That usually lowers the premium. Lucas: Good point. And there's a newer option: cyber reinsurance sidecars. Some carriers offer policies where a portion of the risk is ceded to a reinsurer, which can reduce premiums by 5 to 10 percent. Luna: But you have to trust that the reinsurer is solid. If they fail, you could be left holding the bag. Lucas: True. But overall, the market is more favorable now than it's been in half a decade. The key is to be prepared and shop around. Luna: Let's talk about the elephant in the room: are there any sectors that aren't seeing these decreases? Lucas: Yes. Healthcare is still getting hammered. So are critical infrastructure sectors like energy and water utilities. Their risk profiles are higher — more regulation, more potential for catastrophic harm. Luna: And ransomware is still a huge problem for those industries. A hospital can't afford to be down for days. Lucas: Exactly. So premiums for those sectors are flat to slightly up. But even there, we're seeing some relief if they can demonstrate strong security postures. Luna: What about the role of government? Are any regulations affecting pricing? Lucas: Indirectly, yes. The SEC's cybersecurity disclosure rules have forced companies to be more transparent about incidents. That data feeds into underwriting models. Also, state-level privacy laws mean more breach notification requirements, which increases claims frequency. Luna: So more transparency might actually help carriers price risk better, which could stabilize rates over time. Lucas: That's the theory. And we're starting to see it. The loss ratios for cyber insurance have been improving — carriers are actually making money on the line again, which attracts more capital and brings rates down. Luna: Last thing: what's the one number or trend you're watching most closely over the next 12 months? Lucas: The frequency of large claims — those over $10 million. If that number stays low, the soft market likely continues. If we see a spike, everything reverses. Luna: So it's all about loss experience. Makes sense. Alright, I'll be watching that too. Lucas: Good. And if you're a CISO or risk manager, now's the time to lock in multi-year deals if you can. Some carriers are offering three-year policies with fixed rates. That hedges against a potential turn in the market. Luna: That's a smart move if you can get it. Thanks, Lucas. Good episode. Lucas: Thanks, Luna. See you next time.