Swiss Re’s latest cyber reinsurance report, covered by Risk & Insurance on September 2, puts global cyber premium on track for $16.4 billion in 2026, growing about 5% a year since 2022. Rates fell for a fourth straight year, but the cut shrank: roughly −13% globally in 2025 versus about −5% in 2026, with the U.S. stabilizing faster than Europe. North America is still about two-thirds of the market at $10.7 billion.
That is a buyer’s tape. It is not a “risk went away” tape.
Losses are creeping while prices fall
AM Best, as reported by Insurance Journal in July, said the U.S. cyber loss ratio in 2025 rose for a second year to 53 — the first time above 50 since the pandemic ransomware spike. Direct premium looked roughly flat after adjusting for a Beazley book moving onshore. Third-party claims were trending up about 30%. The first quarter of 2026 was the eighth straight quarter of U.S. price cuts.
Fitch, in a May monitor, said U.S. cyber premiums had increased after a two-year slide, while losses also rose and the line stayed profitable. Those two houses are not describing identical clocks. One is looking at a 2025 loss ratio and early-2026 rates; the other at a premium rebound in its May sample. For a CFO, the usable sentence is simpler: you can still shop the renewal, and the application will still ask whether backups are immutable and whether MFA is actually on.
A cheaper policy that assumes controls you do not have is not a bargain. It is a denial waiting for a claim.
Where the gap is
Swiss Re’s segment split is the part boards skip. Micro-SMEs and SMEs remain thinly insured (about 5–10% and 10–20% penetration) but are still expected to throw off $4.9 billion in premium this year. Mid-market sits at 40–50% penetration and about $4.1 billion. Large corporates dominate at 60–70% penetration and $7.4 billion — and may be under-limited. Swiss Re’s claims database, as cited in that coverage, shows an average of 10 losses a year above the typical U.S. purchased limit of about $120 million.
If you are a mid-market operator, you are in the layer insurers still want. Use that. Raise limits if a cloud or payments outage would take a quarter. Do not skip the hygiene that the questionnaire already priced in: MFA, EDR that someone watches, tested restores, a named incident retainer.
AI is not a new line item yet
Swiss Re argues AI is amplifying known cyber loss types — faster vulnerability hunts, more convincing phishing — more than inventing a clean new peril. Many AI incidents may already sit inside existing “computer system” wordings. Claims of that flavor are still limited, the report says. That is a reason to read the policy, not a reason to assume you are covered for a model leaking customer data into a vendor you never listed.
Take the rate cut. Keep the controls. Put finance and IT in the same room in month nine of the policy, not month twelve. The cheap years do not last if loss ratios keep walking up while prices walk down.
Sources
- Risk & Insurance, Swiss Re cyber report coverage, Sept. 2, 2026 (Swiss Re report: Building a sustainable cyber market in the AI era)
- Insurance Journal, AM Best U.S. cyber market, July 27, 2026
- Fitch Ratings, “U.S. Cyber Insurance Premiums Increase,” May 27, 2026
Operator guides: Cyber insurance checklist for mid-market IT budgets (2026) and What a cyber insurer will still ask. If a public customer is on the policy, the disclosure clock is Before the Form 8-K clock.