Swiss Re’s 2026 cyber view, as reported September 2, still has global premium growing even as rates fall for a fourth year (about −5% in 2026 after −13% in 2025). AM Best, via Insurance Journal, had U.S. prices still cutting in the first quarter and a 2025 loss ratio of 53. Cheap paper does not mean a thin application. Underwriters lag the threat. They do not stop asking the same five things.
The five lines that stall a binder
- MFA everywhere that matters — email, VPN, admin, cloud consoles. “Rolling out” is not yes.
- EDR that is watched — installed is not monitored. Who gets the 2 a.m. alert?
- Backups that are immutable or offline, and restored — a screenshot of a backup job is not a restore test.
- Privileged access — who can disable the tools in item 2, and is that logged?
- A named incident retainer — counsel and a forensics shop you can call without a procurement cycle.
If you cannot answer those in a staff meeting, you do not have a control program. You have hope.
How to use a soft market
Shop limits if a payments or cloud outage would take a quarter. Put finance and IT in the same room in month nine, not month twelve. Do not skip hygiene to “save” on a premium that already assumes you have it. A cheaper policy written on controls you do not run is a denial at claim time.
Swiss Re also notes many AI-related incidents may already sit inside existing “computer system” wordings, with claims of that flavor still limited. Read the form. Do not assume a model leak into an unlisted vendor is covered because the market is soft.
Control checklist
| Control | What they ask | What fails |
|---|---|---|
| MFA | On for email, VPN, admin, cloud | “Rolling out” |
| EDR | Installed and watched | No named on-call |
| Backups | Immutable or offline, restore tested | A screenshot of a job |
| Privilege | Who can disable EDR, and is it logged | Shared admin |
| Retainer | Named counsel and forensics | A vendor list with no contract |
Sources
FAQ
Does a cheaper premium mean a lighter application?
No. Rates can fall while the questionnaire stays mean. Underwriters lag the threat. They do not stop asking the same five things.
What does “EDR that is watched” mean?
Someone is named, after hours, to the alert. Installed agents with nobody on call are a no.
Do we need a retainer if we have an internal IR team?
You still want counsel and a forensics shop on paper. Internal teams do not replace a call you can make at 2 a.m. without procurement.
Can we skip a control because the market is soft?
Not if you want the claim paid. A cheaper policy written on controls you do not run is a denial later.