Loading story…
Cyber insurance is increasingly seen as a critical safeguard against the financial fallout of cyberattacks, but many policies contain hidden exclusions and complex terms that can leave organizations unexpectedly exposed. Security leaders are cautioned to thoroughly review policy details, consult legal experts, and avoid assuming that all risks are covered, as coverage can vary significantly between providers and may include ambiguous terms or strict conditions that could limit payouts after an incident.
In response to evolving cyber threats and insurance claims data, insurers are recommending the deployment of specific security technologies to reduce risk and improve insurability. Role-based access controls have emerged as a top priority for 2026, as they help limit the damage from breaches by restricting attacker movement within compromised networks. Other recommended measures include strong processes, regular auditing of permissions, and comprehensive employee training, all of which can significantly reduce the impact of ransomware, data theft, and other cyber threats.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Security and insurance experts highlighted recurring policy gaps and exclusions that can leave organizations exposed, including hidden caps, retroactive date issues, misread policy language, and mismatches between required security practices and actual controls.
Based on 2025 claims analysis, cyber insurers and incident responders recommended several priority controls for 2026, including role-based access control, phishing-resistant MFA, retiring legacy systems, zero-trust remote access, MDR, and immutable or offline backups.
Cyber-insurance claims data for the first half of 2025 showed a major shift in loss drivers, with phishing-related losses increasing dramatically while claims tied to third-party or vendor outages fell sharply.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware continues to be the predominant cause of high-value cyber insurance claims in 2025, with attackers increasingly targeting small and mid-sized businesses as large enterprises bolster their defenses. According to Allianz’s Cyber Security Resilience 2025 report, 88% of breaches at smaller firms involved ransomware, compared to 39% at larger organizations, highlighting a shift in attacker focus toward easier targets. Ransomware accounted for approximately 60% of insurance claims exceeding €1 million in the first half of 2025, underscoring its financial impact. Attackers are evolving their tactics, moving beyond simple encryption to prioritize data exfiltration, which is often less resource-intensive and more likely to result in ransom payments. The value of stolen data is rising, and the average global breach cost is approaching $5 million, with privacy regulations and litigation risks compounding the financial exposure for affected organizations. Social engineering, phishing, and business email compromise remain prevalent, with generative AI making these attacks more convincing and credential abuse now the most common attack vector. Groups such as Scattered Spider exemplify the trend of using social engineering and credential theft to rapidly escalate attacks from account takeover to ransomware deployment. Retailers have become the most targeted sector in early 2025, following manufacturing and professional services in total losses, due to their large volumes of personal data and complex supply chains. Supply chain disruptions are also emerging as a significant source of cyber insurance claims, as interconnected business operations increase systemic risk. The evolving threat landscape is prompting organizations to reassess their cyber resilience strategies, with a focus on proactive defense measures and third-party risk management. The increasing sophistication of attacks, especially those leveraging AI and targeting operational technology, is driving a need for improved governance and contractual protections with suppliers. As attackers adapt, organizations must prioritize both IT and OT security, ensure executive support for resilience initiatives, and address hidden dependencies that could become blind spots in their defenses. The convergence of ransomware, data exfiltration, and supply chain vulnerabilities is shaping the cyber insurance market and influencing security priorities for businesses of all sizes in 2025.
Jun 29, 2026
Cybersecurity has evolved from a purely technical concern to a central topic in executive boardrooms, driven by escalating cyber risks, increased attack sophistication, and the integration of generative AI. Gurps Khaira, a cybersecurity and digital transformation expert, emphasizes the need for organizations to adopt resilient, strategic approaches to cyber risk management, highlighting frameworks like the "4D Delivery Discipline" to ensure clarity and consistency in complex security projects. He notes that successful transformation requires balancing technological advancement with the impact on customers, partners, and employees, and stresses the importance of proactive, not reactive, resilience in the face of regulatory and threat landscape changes. The insurance sector is also grappling with the surge in cyber threats, now considered the top risk for insurers according to France Assureurs’ 2025 Riskmap, surpassing even climate change. The sector faces challenges from increasingly innovative attack vectors and a fragmented market, particularly regarding the maturity gap between large corporations and SMEs in understanding and transferring cyber risk. High-profile incidents, such as the €2 billion loss from the Jaguar attack in the UK, underscore the financial and operational impacts of cyber incidents, which extend beyond immediate crisis management to long-term data loss and reputational damage. Both references highlight the urgent need for strategic, organization-wide engagement with cybersecurity to address the evolving threat landscape.
Jul 12, 2026
Cybersecurity experts warned UK organizations not to treat cyber insurance as a substitute for operational resilience after a Cohesity survey found that only **22%** of business leaders believed their policy would adequately cover breach costs and lost revenue. Respondents estimated that a cyberattack would cut revenue by an average of **15.17%**, while one in five organizations had never modelled the business impact of a cyber incident. The warning aligns with UK government breach-survey findings on uneven cyber-risk preparedness and insurance coverage across businesses. Although cyber-insurance adoption increased during 2025 and insurers paid **£197 million** in cyber claims, organizations are urged to review exclusions and coverage limits, maintain tested recovery plans, model attack impacts, and regularly test restoration of critical services.
Sep 3, 2026