The race to secure large insurance towers for data centres may be leaving many organisations over-insured, Willis, a WTW business, warns. The more useful question, the broker says, is not how much capacity the market can provide but how much each project actually needs.
The broker said the global insurance market can provide up to US$15 billion in capacity for large-scale data centre risks. Willis argues that figure has become a ceiling to aim for rather than a benchmark to question. Organisations often secure more coverage than their exposure warrants because underlying risks have not been properly modeled.
The warning comes as digital infrastructure investment accelerates globally. Global insurance premiums tied to data centres are expected to nearly double by 2030, from US$10.6 billion to US$24.2 billion, according to Swiss Re Institute. Hyperscale facilities now routinely reach US$30 billion to US$40 billion in construction value before technology is installed.
Willis says data centre risk profiles vary considerably based on site selection, power infrastructure, construction methodology, supply-chain dependencies, climate exposure, and cyber vulnerabilities. Two projects with similar footprints can carry very different actual loss exposures depending on where they are built and how they are engineered.
Alastair Swift, head of the global digital infrastructure group at Willis, said the focus should shift from securing capacity to understanding what is being covered. "The capacity is there," Swift said. "The focus should be on using data-led analysis to quantify and differentiate exposure to secure appropriate insurance limits."
Data centre risk does not sit neatly within a single line. A large campus carries property, construction, business interruption, supply-chain, and cyber exposure, often simultaneously.
Natural hazard risks have also grown as construction moves into secondary markets. In 2026, 64% of data centre capacity under construction sits outside traditional hubs such as Northern Virginia. Zurich reports that many of those sites face elevated tornado and hail exposure.
Willis said resilience investments made early in the development lifecycle can reduce actual exposure more than simply buying more coverage. Flood protection, seismic design, heat adaptation, and wildfire mitigation built in from the outset can lower the risk profile before insurance is structured. When risks are properly mitigated, the appropriate insurance limit often falls below what the market would otherwise offer.
Jackie Bolig, North America placement lead at Willis, said the sector needs to move from chasing capacity to justifying limits with evidence. "The goal should be to buy the right amount of insurance, supported by evidence, analytics, and a thorough understanding of risk, not simply seeking the largest capacity available," Bolig said.
Willis said lenders and equity investors are also a driver of this shift. When coverage is structured around verified exposure modeling rather than market convention, it can support stronger credit ratings and more favourable financing terms. A more precise risk picture gives capital providers greater confidence that coverage reflects actual exposure.
Swift said the result should be insurance programs that hold up under scrutiny. "When risks are properly modelled, understood and mitigated, clients can build more efficient, resilient insurance programs that reflect their actual exposures," he said. "This is especially important where lenders and equity partners expect robust protection; a more tailored approach can often deliver greater value."
Willis launched its global digital infrastructure group in February 2026. The group covers construction, energy, climate, cyber, and supply chain risks across the data centre lifecycle. It supports Willis' eight-point digital infrastructure risk framework, which guides exposure assessment from site selection through to operations.
