Australian cyber insurance has had a chequered underwriting history. Volatile claims, uncertain risk models, and a string of high-profile incidents involving ransomware and data breaches made the line one of the harder ones to price through the early 2020s. The APRA quarterly data released on May 29 2026 suggests the market has quietly found its footing, at least on the numbers.
The cyber class posted a positive insurance service result in each of the three most recent quarters in the dataset: $17 million in September 2025, $10 million in December 2025 and $10 million in March 2026. That run of consistent positive results follows a chequered history in earlier quarters, where the ISR alternated between small profits and small losses - $18 million positive, then $6 million negative, then $14 million positive, then $18 million positive, then $10 million negative - across the first seven quarters of the dataset.
The stabilisation represents a meaningful shift for a class that many market participants spent several years questioning. But the volume figures tell a different story.
Cyber gross written premium (GWP) has never exceeded $73 million in a single quarter in the Australian Prudential Regulation Authority (APRA) dataset. In the March 2026 quarter, it was $32 million. The class accounts for less than 0.2% of total industry GWP in any quarter. In a market where domestic motor alone generated $4.83 billion in a single quarter, cyber remains a rounding error.
The number of risks written confirms the picture. The cyber class recorded just 6,000 risks written in the March 2026 quarter. Compare that with 4.78 million domestic motor risks, 3.16 million householders risks, and 5.52 million CTP risks. In a country with hundreds of thousands of businesses carrying digital infrastructure risk, cyber insurance is reaching an extraordinarily small proportion of the potential insured population.
Australian cyber insurance: GWP, net claims and underwriting result ($M)
Quarterly, December 2023 to March 2026 — all APRA-authorised general insurers
Source: APRA, Quarterly General Insurance Performance Statistics Database, Sep 2023–Mar 2026, released 29 May 2026.
Net claims have been low and manageable across the dataset — rarely exceeding $20 million in any quarter, and occasionally negative as reserving adjustments are made. The loss ratio in most quarters is well below the levels that would threaten profitability. The product, as currently structured and priced in the Australian market, is working financially. The distribution challenge is the constraint.
Jeffrey Gonlin (pictured left), chief underwriter at Emergence Insurance, told Insurance Business that he’s worried by all the companies that are not buying cyber. However, he said explaining why they’re not is more complex than it might appear.
“It's a real mystery,” said Gonlin. “When people get animated about businesses not being insured for some natural peril, somehow when it comes to cyber - because it's less concrete, it seems less real - there's just no sense of urgency."
Gerry Power (pictured right), general manager of Cowbell in Australia agreed.
“For many SMEs, cyber remains an intangible risk.” Business owners can easily understand the consequences of a fire, theft or liability claim, he said.
“Cyber incidents are different,” said Power. “Many SMEs still believe they are too small to be targeted, despite the reality that cyber criminals often view smaller businesses as easier targets with fewer security controls.”
These reasons for low cyber take-up are actually well documented. SMEs - which represent the bulk of the potential market – do frequently underestimate their cyber exposure, lack the technical sophistication to complete underwriting questionnaires accurately and have historically treated cyber as an optional add-on rather than a core coverage. Awareness has increased following high-profile incidents, but awareness has not converted to purchase at the pace the industry expected.
As Insurance Business reported, ASIC and APRA have both signalled that AI governance in the insurance industry is inadequate and the intersection of AI risk and cyber exposure is an area of growing regulatory focus. Businesses deploying AI tools without robust security frameworks are creating cyber exposures that existing policies may not adequately cover.
Power said the rapid adoption of AI across Australian businesses is creating a new category of cyber and technology risk that organisations, insurers and regulators are all working hard to understand.
“While many existing cyber insurance policies will respond to certain AI-related incidents, there is a growing risk that businesses assume they are covered for exposures that may not have been fully contemplated when those policies were designed,” he said. “The reality is that AI itself isn't creating entirely new risks as much as it is amplifying existing ones.”
Which suggests that even for those with cyber insurance, dangerous gaps in cover are all but inevitable
The soft market conditions evident across commercial lines in 2026 have also brought cyber premiums lower. Insurance Business has reported that cyber insurance premiums fell approximately 10% through 2025 according to EBM Insurance and Risk's May 2026 market outlook. Lower prices should, in theory, stimulate demand. The APRA volume data does not yet show evidence of that effect.
A line that is consistently profitable, modestly priced, and covering a risk that is demonstrably growing is precisely the kind of product that brokers are positioned to distribute. The APRA data makes clear that the underwriting economics are sound. The challenge is not product quality, it is client education and distribution reach.
For commercial lines brokers with SME client books, the March 2026 APRA data is a useful prompt. The cyber market is in its healthiest underwriting position in years. Capacity is available, pricing has moderated, and the claims history in recent quarters is benign. The window of affordable, well-structured cyber coverage will not remain open indefinitely and the risk it covers is not going away.
Source: APRA, Quarterly General Insurance Performance Statistics Database, September 2023 to March 2026, released May 29 2026. All figures are in Australian dollars and based on APRA-authorised general insurers. Lloyd's Australian operations are not included
