Cybersecurity insurance in 2026 amounts to a $20B annual market, with the typical enterprise paying $50K-$500K per year for the coverage, with the coverage paying out roughly 40% of the time the enterprise has a claim, with the payout typically running at 30-50% of the claim. The insurance buys the enterprise some financial protection, the insurance does not buy the enterprise the security program, the insurance does not buy the enterprise the breach response. The honest guide covers what the insurance buys and what it does not.
The 2024 Change Healthcare breach cost the insurer $1.5B in payouts. The 2025 Snowflake credential theft cost the insurers $400M in payouts. The 2026 Okta support account compromise cost the insurers $200M in payouts. The insurers have responded to the losses by raising premiums, raising deductibles, and excluding more attack types from the coverage. The 2026 state of the cybersecurity insurance market amounts to a market where the insurance costs more, the coverage excludes more, and the deductible sits higher than the insurance did 5 years ago.
What the insurance buys
Three things, in roughly that order of how much they cost. The first runs as the breach response cost category, with the insurance covering the cost of the incident response firm, the forensic firm, the legal counsel, the notification cost, the credit monitoring for the affected customers. The breach response cost typically runs at $1M-$5M per breach. The second runs as the business interruption category, with the insurance covering the lost revenue from the systems that sit down during the breach, the lost margin from the customers who cannot transact during the breach. The business interruption cost typically runs at $2M-$10M per breach. The third runs as the liability category, with the insurance covering the third party liability from the customers who sue, the regulators who fine, the partners who claim damages. The liability cost typically runs at $5M-$50M per breach. The three categories together produce the typical insurance payout.
What the insurance does not buy
Three things, in roughly that order of how often they sit assumed. The first runs as the security program category, where the insurance does not pay for the security tools the enterprise should have had, the insurance does not pay for the security team the enterprise should have hired, the insurance does not pay for the security program the enterprise should have built. The second runs as the reputational damage category, where the insurance does not pay for the customer churn from the breach, the insurance does not pay for the stock price drop from the breach, the insurance does not pay for the executive departures from the breach. The third runs as the regulatory action category, where the insurance does not pay for the regulator fines (in many cases, the insurance specifically excludes the regulator fines), the insurance does not pay for the consent decree costs, the insurance does not pay for the long term compliance work. The three things together amount to the cost the insurance does not cover, the cost the enterprise has to cover, the cost that often exceeds the insurance payout.
How to actually use the insurance
Three moves if you have cybersecurity insurance. Read the policy, because the exclusions (the acts of war exclusions, the nation state exclusions, the ransomware payment exclusions) sit as the exclusions the enterprise assumes do not apply until the claim gets denied. The enterprise that reads the policy knows the exclusions, the enterprise that does not read the policy finds out at the claim. Maintain the controls the policy requires, because the insurance policy requires the enterprise to maintain the multi factor authentication, the endpoint detection, the backup, the security awareness training. The enterprise that does not maintain the controls has the claim denied at the renewal. Use the insurance as a backstop, because the insurance amounts to a financial backstop, the insurance does not amount to a substitute for the security program. The enterprise that uses the insurance as a backstop invests in the security program, the enterprise that uses the insurance as a substitute does not invest in the security program. The CISO who reads the policy, maintains the controls, and uses the insurance as a backstop stands as the CISO who gets the value from the cybersecurity insurance.
The bottom line
Cybersecurity insurance in 2026 amounts to a real financial protection that does not replace the security program. The three things the insurance buys (breach response, business interruption, liability) cover the typical breach cost. The three things the insurance does not buy (security program, reputational damage, regulatory action) sit as the cost the enterprise has to cover. The CISO who reads the policy, maintains the controls, and uses the insurance as a backstop stands as the CISO who gets the value from the insurance.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
