Articles - Cyber Insurance Update for H1 2025

 By Simon Basham, Head of Cyber Broking GB and Adrian Ruiz, Head of FINEX Cyber & Tech, WTW

 Delivering an acute juxtaposition and highlighting that the decision of how much cyber insurance capacity to purchase is undoubtedly a c-suite responsibility.

 How to utilise these insights

 The impact of these incidents being so severe that it is already publicly reported to have resulted in hundreds of millions of profits being lost as a result, and the incidents being constantly reported across mainstream media channels.

 Worryingly the techniques at play are not new, nor are they overly sophisticated. As with so many frauds they have been deploying phishing techniques, in recent instances to obtain access credentials from IT helpdesks, making two things clear;

 Phishing has been prevalent for well over a decade (Sony Pictures hack and leak in 2014 as an example, Colonial Pipeline in 2021 yet another) yet it cannot be neutralised, only risk mitigation is possible against this ever-evolving threat vector

 No amount of investment in fantastic security tooling and the very best information security teams can stop malicious actors from bypassing the same by manipulating employees and/or partners business rely on to operate
 Scattered Spider criminals and affiliates have been using these techniques for some time, however, the severity and impact only becoming more severe.

 In addition to tried and tested techniques such as phishing, threat actors are ever resourceful in finding new techniques to circumnavigate security measures, developing tooling such as those to bypass Endpoint Detection and Response (EDR) systems, which businesses have invested significant sums in to reduce their exposure to malicious cyber events.

 Cyber incident response provider S-RM, who handled over 600 cyber incidents in 2024, comment that the more organisations have adopted EDR tooling, the more threat actors have focused on the development of bypass tools and techniques and that these techniques will be particularly attractive to financially motivated groups looking to spend as little time inside a network as possible to act on their objectives.

 It's clear that threat actors are not letting up in finding any new opportunities to monetise their efforts and/or further their or their master’s ideals.

 Cyber insurance market capacity
 Capacity remains in very plentiful supply, with insurers seeking to make their proposition as appealing as possible, pushing boundaries of their historic comfort zones to try and outpace their peers.

 In the wake of the retail cyberattacks, clients have been utilising the plentiful supply of capacity to increase limits both at renewal and mid-term.

 In the wake of the retail cyberattacks, clients have been utilising the plentiful supply of capacity to increase limits both at renewal and mid-term.

 Many insurers secured very favourable outcomes when renewing their reinsurance programmes, emboldening their respective plans to grow in a highly competitive market.

 Premiums and self-insured retentions
 H1 has delivered results for a swathe of clients that were previously unachievable, resulting in brokers needing to caution clients that the sustainability of such terms feels less certain come next renewal.

 Given the events in the public domain, such generous terms are resonating with many new buyers, allowing them to purchase large limits immediately.

 Many clients are tactically utilising the extremely appealing premiums on offer to either enter the cyber market or to increase the limits they purchase. Such astute decisions are unsurprising, with capacity pricing often (specific pricing is tailored to individual clients and many variables) assuming it will not be subject to claim in the next 50 to 200 years (5,000 to 20,000 per million of capacity).

 Given the events in the public domain, such generous terms are resonating with many new buyers, allowing them to purchase large limits immediately.

 Policy coverage
 During H1 Willis’ cyber team has continued to work with clients and insurers to break new ground in a number of innovative areas, including Artificial Intelligence.

 While expanding and tailoring coverage are critical, H1 has showed why our longstanding efforts on key policy efficacy areas, such as the ability for claim payments to be made at break-neck speed due to affirmative policy provisions are just as, if not more important when a client is reliant on the cornerstone of insurance, the ‘promise to pay’.