How 2026 premiums moved from 2023 and 2024
Premium rates have stabilized after the 2021-2022 correction cycle. Coalition's 2026 cyber claims report shows mid-market premium up 4% to 8% year over year for clean accounts, flat to up 3% for accounts with prior incidents, and down 5% to 12% for accounts that added EDR and MFA in the last 12 months. At-Bay's 2026 mid-year update reports similar trends with ransomware sublimits tightening to 25% to 50% of the total policy limit on most quotes.
The net effect for a clean mid-market account: premium is roughly what it was in 2024, but coverage is narrower. Expect sublimits for ransomware, business interruption, and funds transfer fraud to be more clearly defined, and expect a co-insurance clause on ransomware payments in some industries (typically 25% to 50% carrier share).
The questions carriers ask about your incident history
Carriers take the incident history section seriously because prior incidents are the strongest predictor of future incidents. Be ready to disclose:
- Any ransomware event in the last five years, whether you paid or not.
- Any data breach notification to a regulator or affected individuals.
- Any business email compromise or wire fraud loss, even if you recovered the funds.
- Any third-party breach that affected your data, including vendor notifications.
- Any pending litigation related to data privacy or security.
- Any regulatory investigation or fine in the last five years.
Material misrepresentation on this section is the leading reason claims get denied. If you had a 2023 incident that was not previously reported to a carrier, disclose it now. The underwriter can attach an endorsement or a higher retention; the alternative is a denied claim when you file.
Common denial triggers and how to avoid them
Underwriters consistently cite the same five triggers for 2026 declines and sublimits. Work through this list before you submit.
- No MFA on email or admin accounts. This is still the number one decline trigger. If you cannot enable MFA on a specific account because of a legacy system, document the compensating control and the remediation plan.
- Backups that share a network with production. If a ransomware actor can encrypt your backups, the carrier cannot pay the ransom sublimit. Use immutable or air-gapped backups and test quarterly.
- EDR present but not monitored. Carriers want 24/7 monitoring, not just EDR installation. If you do not have a SOC, contract a managed detection and response (MDR) provider.
- Prior incident not disclosed. Disclosure beats non-disclosure every time. If the underwriter finds the incident in a public source after the policy binds, the carrier can rescind coverage.
- No incident response plan or plan older than 12 months. A one-page plan with named owners is enough to start, but test it annually and update after any real incident.
What to expect after you submit
The carrier's triage team will review the application within 5 to 10 business days. If the account clears the controls checklist, you receive an indication in 2 to 3 weeks. If the underwriter has follow-up questions, the cycle extends to 4 to 6 weeks. Most mid-market accounts see 2 to 4 rounds of follow-up questions before a final quote.
The quote includes the base premium, the retention (deductible), the sublimits for ransomware, business interruption, funds transfer fraud, and reputational harm, and any endorsements. Negotiate the retention and the sublimits before negotiating the premium — the retention has a larger impact on your total cost of risk than the premium itself.
Renewals in 2026
Renewal applications are shorter than new business applications but require the same controls and the same disclosure. Carriers will ask whether anything changed since the last bind: new offices, new lines of business, any incidents, any change in controls. Plan the renewal 90 days ahead of the bind date to leave time for follow-up and a clean transition. If you have had a claim since the last bind, expect higher retention and a tighter sublimit structure; the best way to keep coverage broad is to demonstrate the controls you added in response to the incident.
Source: Coalition 2026 Cyber Claims Report; At-Bay 2026 Mid-Year Update; CISA Cybersecurity Insurance Resources; NAIC Cybersecurity Insurance Resource Center.
Cyber insurance application checklist 2026 buyer FAQ
What is the most common reason a cyber insurance application gets declined in 2026? No MFA on email, VPN, or admin accounts. Carriers treat this as a binary control: either it is on everywhere or the application is declined. The second most common reason is backups that share a network with production, which makes them vulnerable to ransomware.
How long does a carrier take to quote in 2026? Plan on 2 to 6 weeks for a mid-market account. Renewals move faster, usually 1 to 3 weeks. If the underwriter has follow-up questions, the cycle can extend to 4 to 6 weeks.
What is the average premium for a small business in 2026? A $2M to $5M revenue account with a clean application typically pays $3K to $8K in annual premium for $1M in coverage. A $20M revenue account with 100 employees typically pays $12K to $25K for $1M in coverage, with ransomware sublimits adding 30 to 60 percent.
Do I need EDR to get cyber insurance in 2026? Yes, effectively. EDR or XDR deployed on 100% of endpoints, with 24/7 monitoring, is a baseline requirement for most carriers. If you do not have a SOC, contract an MDR provider.
Can I get cyber insurance if I had a ransomware incident last year? Yes, but expect a higher retention, a tighter ransomware sublimit, and additional underwriting questions about the controls you added after the incident. Disclose the incident fully and be ready to show the post-incident remediation.
What is the difference between a retention and a deductible in cyber insurance? They mean the same thing in cyber insurance: the amount the insured pays before the carrier pays. The retention is set per claim, not per year, so a $25K retention means you pay the first $25K of every covered claim.
Fazlur Rahman
