What drives the cost of cyber insurance

Cyber insurance premiums are driven mainly by your revenue, your industry and the data you hold, the security controls you can prove, the limit and retention you choose, your claims history and the state of the market. Of these, controls are the factor an owner can change fastest. A business with multi-factor authentication, tested backups and endpoint monitoring is quoted on better terms than a peer without them, and sometimes the difference is whether it can get a quote at all.

We do not quote a typical premium here, because cyber rates vary too much by class, size and controls for any single number to mean much. What follows explains how underwriters build the price so you can read a quote.

The pricing inputs

Revenue is the exposure base. Most carriers start from annual revenue, banded into tiers, because revenue is a rough proxy for how much a business depends on systems, how much data it handles and how large a claim could become. Headcount, number of records held and number of locations may also enter the rating.

Industry and data sensitivity. Healthcare, financial services, education, professional services and retail draw more attention because of the records they hold or the way they are targeted. How many personal, health or payment-card records you keep matters, and so does whether you retain them longer than you need to.

Security controls. This is the largest underwriting lever. Carriers ask whether you use multi-factor authentication for email, remote access and administrator accounts, whether backups are offline or immutable and tested, whether endpoint detection and response (EDR) covers all devices, how fast you patch, and whether you run unsupported software. MFA, EDR and backups: the controls cyber insurers now require covers each control, and the cyber insurance application: what underwriters ask and how to answer covers the questions.

External scans. Many carriers run an outside-in scan of your domain and internet-facing systems before or during underwriting. Cowbell describes eight categories it measures for its rating factors: network, cloud and endpoint security, dark web exposure, funds transfer and extortion indicators, compliance and supply chain. At-Bay offers vulnerability scanning and dark web monitoring through its platform, and Coalition publishes a free risk assessment. An open remote desktop port or credentials for sale on the dark web can change the quote, or end the conversation, even if your application answers are clean.

Loss history and incidents. Prior claims, known incidents and recent breaches affect eligibility and price. So does a gap in coverage: if you have not carried cyber insurance, the retroactive date will start at the new policy.

Choices you make: limit, retention and terms

Limit. Premium does not rise in step with limit. The first dollars of loss are the most likely, so doubling the limit typically costs less than double the premium, though carriers set their own pricing curves. Choose the limit from your downtime cost and data exposure (does a small business need cyber insurance?), not from the premium.

Retention. A higher retention lowers the premium. The deductible and retention break-even calculator shows the break-even: how long a lower premium takes to be outweighed by the extra dollars you would absorb in a claim.

Sublimits and coinsurance. Quotes at the same headline limit can differ widely in what they give for ransomware, funds transfer fraud and dependent business interruption. A cheaper quote often has a ransomware sublimit or a coinsurance clause, meaning you share every ransomware loss. ransomware sublimits and coinsurance in cyber policies explains both. At-Bay's site, for example, says higher package tiers can bring reduced ransomware retentions and waiting periods, improved fraud sublimits and flat renewal, depending on the risk profile.

Waiting period. A shorter business interruption waiting period adds cost.

Credits for controls

Some carriers reward specific investments. At-Bay says qualified policyholders using an approved managed detection and response (MDR) service may get a premium credit, with savings depending on the business's risk profile. Ask whether your carrier offers similar credits, and whether a service you already pay for would qualify.

The market sets the baseline

Underwriters adjust everything above to the market's general direction. Marsh reported on July 23, 2026 that global cyber rates fell 4% in the second quarter of 2026, the twelfth consecutive quarterly decline, with U.S. rates down 2%. The NAIC's 2025 report on the cybersecurity insurance market notes that U.S. direct written premium fell about 7% in 2024 to roughly $9.14 billion and cites Howden's estimate that global rates were down 22% from the mid-2022 peak. That describes a soft market, but it can turn. AM Best said, as reported by Insurance Journal on June 30, 2026, that the 2025 loss ratio rose for the second straight year to 53, the first time above 50 since the ransomware spike during the pandemic. When loss ratios climb, rate cuts tend to slow. See the cyber insurance market: capacity, pricing and appetite for the cycle.

Another factor is who is writing the policy. AM Best told Insurance Journal that surplus lines carriers write nearly two-thirds of cyber premium. A quote from a non-admitted insurer can add state surplus lines tax and fees, and the policy generally falls outside state guaranty fund protection if the insurer fails. Ask whether the quote is admitted or surplus lines and what the total premium is after taxes and fees.

A hypothetical: two firms, same revenue

Say two 25-person engineering firms in the same state have the same revenue and the same limit request. Firm A has MFA on email and remote access, immutable backups it tests quarterly, EDR on every laptop and server, and a written incident response plan. Firm B has MFA only on email, backups on a network drive attached to the server and no EDR. Without any premium number, we can describe the likely differences:

• Firm A is quoted by several carriers, with the full ransomware limit and a standard retention.
• Firm B may get fewer quotes, a ransomware sublimit or coinsurance, a higher retention or a request to fix items within 30 to 90 days as a condition of binding.
• Both quotes will carry the same revenue band. The controls explain the gap.

This is an illustration, not a prediction for any carrier.

How to get a better quote

1. Turn on MFA for email, remote access and administrator accounts before you submit.
2. Test a restore from your backups and write down the result.
3. Run a scan of your own domain and close what it finds (an open remote desktop port, an unpatched VPN).
4. Fill out the application accurately and consistently; see insurance applications: why accuracy matters and what misrepresentation costs for why misstatements can void coverage.
5. Ask your broker to compare quotes on ransomware, funds transfer fraud and business interruption terms, not only total premium.
6. Use the cyber insurance readiness checklist to find gaps before the carrier does.

Key takeaways

• Revenue, industry, data held, controls and loss history set the premium, and the market cycle moves the baseline. Marsh reported U.S. cyber rates down 2% in the second quarter of 2026.
• Controls are the factor you can change fastest, and they affect not just price but whether you are offered terms.
• Compare quotes on sublimits, coinsurance, waiting periods and retentions, since a lower premium often buys narrower ransomware or fraud cover.
• Ask whether a quote is surplus lines and what taxes, fees and guaranty fund limits apply.
• Premium rises more slowly than limit, so decide the limit from your exposure and then price it.