Skip to main content

What Is Cyber Insurance, and Why Is It In High Demand?

Posted on June 01, 2021

Large-scale cyberattacks—like those on Colonial Pipeline earlier this month and SolarWinds in September—have highlighted the growing threats these hacks pose to U.S. businesses. As threats grow, so do the number of businesses turning to cyber insurance for protection from financial losses.

Similar to auto or homeowners insurance, cyber insurance protects businesses from loses caused by an event covered under the user’s policy. What’s covered, the costs of that coverage, and the terms of a policy can vary, but cyber insurance can help businesses manage cyber risks and recover from losses associated with attacks, including disruptions in business and legal expenses.

Today’s WatchBlog post explores our work on the increased demand for cyber insurance and the questions highlighted by this market’s growth. Also, tune in to our podcast with GAO’s John Pendleton about trends in the cyber insurance market.

Increase in demand

Between 2016 and 2019, the costs of cyberattacks to U.S. insurers almost doubled. During this same time period, the number of cyber policies increased by about 60%. Similarly, the number of insurers offering cyber insurance increased by about 35% between 2016 and 2019.

Figure: Cyber Insurance Take-up Rates for A Selected Large Broker’s Clients, 2016-2020


Bar chart showing the growing number of businesses taking out cyber insurance policies, 2016-2020


Growing pains in the cyber insurance market

As demand and supply for cyber insurance has increased, so has uncertainty about the market. For example, it’s become more challenging to price cyber risk and to make this coverage available. Just like the cost of car insurance is in part based on the number of accidents that a driver has been in, the cost of cyber insurance is based in part on the frequency, severity, and cost of cyberattacks, all of which have been increasing. The uncertainty about future threats also plays a role, and insurers have become more selective about who gets covered and what gets covered. Recently, a number of insurers reduced coverage limits or increased premiums for higher-risk organizations and industries, such as academic institutions or the health care and public sectors.

Insurers have also tightened policy terms and conditions to reduce unexpected losses from cyberattacks. Traditionally, commercial property and casualty policies could include limited cyber coverage, but now, carriers are becoming less likely to include it, and are instead offering cyber coverage separately. For policyholders, these changes translate into fewer coverage options, stricter standards, and more exclusions. For insurers, this translates to less exposure to risk and lower likelihood of having to pay claims. 

Challenges in measuring risk and the costs of cyberattacks

In the insurance industry, incorrect pricing can lead to losses that carriers may not be able to cover, which could lead to insolvency. Cyber insurance companies face a number of challenges when trying to estimate the costs and risks of cyberattacks, and when creating policy prices.

First, insurance companies rely on data to forecast risks and determine policy rates for coverage. However, because the cyber insurance market is fairly new, there isn’t a lot of data available. Without good data, insurers struggle to create accurate policy cost estimates.  As a result, current prices for cyber policies may not accurately reflect the risk the insurers are taking on, or the potential losses that they are covering.

In addition, cyberthreats are constantly evolving, which means the risks organizations face also evolve. This makes it difficult for the insurance market to keep up with trends in cyber risks and for insurers to underwrite cyber policies.

Finally, cyberattacks have the potential to quickly escalate from one business to many businesses, which can translate into unpredictable losses. For example, in 2017, Russian hackers unleashed a cyberattack against Ukraine, which spread globally within hours. U.S. companies came to a halt as a result of this attack, which ultimately cost the companies billions of dollars.

To learn more about trends in the cyber insurance market and the challenges facing this market, check out our new report.

GAO Contacts

John Pendleton
John Pendleton

Related Products

About Watchblog

GAO's mission is to provide Congress with fact-based, nonpartisan information that can help improve federal government performance and ensure accountability for the benefit of the American people. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiences—Congress and the American people—where they are currently looking for information.

The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. Posts will tie GAO work to current events and the news; show how GAO’s work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things.

Please send any feedback on GAO's WatchBlog to