Cybersecurity Insurance Premiums Climb as Insurers Price In AI-Accelerated Attack Sophistication

Cybersecurity insurance premiums have continued climbing through 2026 as insurers price in a threat landscape reshaped by AI-assisted attack tooling, which underwriters describe as having lowered the skill barrier required to execute sophisticated phishing campaigns and automated vulnerability discovery that previously required more specialized attacker expertise, expanding the pool of actors capable of executing an attack that would previously have required a more resourced or skilled adversary. The underwriting response has been twofold: higher base premiums across the board, and meaningfully tighter requirements for what security controls a business must demonstrate to qualify for coverage at all, with multi-factor authentication, endpoint detection tooling, and documented incident response plans increasingly treated as baseline requirements rather than premium-reducing extras. Mid-size businesses — large enough to be a worthwhile target but without the dedicated security team and budget of an enterprise — have felt the underwriting tightening most acutely, with several insurers reporting they've declined to renew coverage entirely for mid-size business clients that can't demonstrate baseline security control adoption, a shift from the more permissive underwriting standards that characterized the cybersecurity insurance market through the early 2020s when the product category was newer and less claims data existed to price risk accurately. AI-assisted defensive tooling has become a genuine underwriting consideration in the other direction: several insurers now offer premium discounts for businesses using AI-driven security monitoring and anomaly detection tools, treating them similarly to how physical insurers have long offered discounts for alarm systems, reflecting insurer confidence that AI-assisted defensive tooling measurably reduces claims risk even as AI-assisted offensive tooling drives the same insurers' overall risk pricing upward. The claims data insurers are drawing on shows business email compromise and ransomware remaining the two largest claim categories by dollar volume, with AI's most measurable impact so far concentrated in phishing email quality and volume rather than in more sophisticated attack categories like supply chain compromise, where the added expertise and access required still limits the pool of capable attackers more than AI tooling alone has been able to lower.