On June 29, the US House of Representatives voted 373-15 to extend the Terrorism Risk Insurance Program through 2034. A Senate companion bill is pending. It's a routine-sounding vote on paper, but it's really Congress renewing, for the fifth time, a program built in direct response to a single morning in 2001 that changed more about how American insurance works than any event before or since.
Twenty-five years on, it's worth tracing exactly what changed, because the fixes Washington built in the weeks after the attacks are still the scaffolding the industry leans on today.
The attacks on the World Trade Center and the Pentagon killed nearly 3,000 people and produced, according to the Congressional Research Service, roughly $60 billion in insured losses in current dollars - spread simultaneously across property, aviation, life, workers' compensation and liability coverage.
No single prior event had done that. Underwriters had a rough test for what counts as insurable: can a loss be modeled with reasonable confidence, does it occur close to randomly, and does it stay independent of other losses rather than clustering into one another. A coordinated, deliberate attack fails more than one of those tests at once.
Nine years earlier, Hurricane Andrew had already forced a similar reckoning, wiping out several insurers that had badly underpriced correlated catastrophe risk and spurring the rise of modern catastrophe modeling. But Andrew's failure mode was still, fundamentally, random. Terrorism's wasn't, and reinsurers responded to 9/11 by pulling coverage from commercial policies almost overnight rather than trying to reprice something they had no data to model.
Congress moved fast, and on two separate fronts. Just eleven days after the attacks, it passed the Air Transportation Safety and System Stabilization Act. Per the Congressional Budget Office's own scoring of the bill, the act capped each airline's liability for the September 11 crashes at the insurance coverage the carrier already held – a move that saw commentators at the time put the combined total at roughly $6 billion across the four aircraft. It also created the September 11th Victim Compensation Fund as a no-fault alternative to litigation. Victims could accept a federally funded payout instead of suing, trading their day in court for a faster, certain settlement funded by taxpayers rather than the airlines' own balance sheets.
The bigger, longer-lasting fix came a year later. When commercial insurers found they could no longer buy reinsurance for terrorism risk, real estate lending nearly seized up, because lenders wouldn't extend credit against buildings that couldn't get coverage. Congress answered with the Terrorism Risk Insurance Act of 2002: a federal backstop that shares losses from a certified terrorist attack between insurers and the government once losses cross an annual threshold set by Treasury. For 2026, that threshold - the insurance marketplace aggregate retention amount - sits at $58.7 billion.
The remarkable footnote is that in TRIA's entire 24-year history, no certified act of terrorism has ever triggered a payout under the program. Rep. Mike Flood, who sponsored this year's reauthorization bill, told the House he hopes it stays that way but argued the backstop still needs updating "to protect taxpayers in the event of future claims." The American Property Casualty Insurance Association welcomed the House vote as preserving "vital economic protection against acts of terrorism that so many companies rely on," in the words of senior vice president Sam Whitfield. It was the trade group's clearest signal yet that the industry sees the backstop as permanent infrastructure rather than a lapsing emergency measure.
9/11 also left a stranger, more technical legacy in US courts. When the towers fell, the final policy wording for the World Trade Center's property cover hadn't actually been signed off. The complex's leaseholder, Larry Silverstein, had bound coverage just weeks earlier, and different insurers in his 24-member consortium were still working from different draft forms. That left one enormous question: did the two aircraft strikes count as one insured occurrence or two?
The answer split down the middle. In 2004, one jury found most of Silverstein's insurers liable for a single occurrence; a separate jury found nine of them liable for two, entitling him to nearly double the payout from that group. "This is a win for all New Yorkers," Silverstein said after the second verdict. The Second Circuit upheld both, oddly contradictory findings on appeal in 2006, in the case SR International Business Insurance Co. v. World Trade Center Properties LLC which is a ruling that still gets cited whenever a coverage dispute turns on the definition of a single "occurrence."
The episode also helped push the broader market toward tighter policy discipline - binding coverage informally and finalizing wording later became a much riskier habit to keep.
The strange result of 24 years without a TRIA claim is that terrorism coverage in the US is now remarkably cheap. Willis's US Terrorism Insurance Index recorded a 10.4% average price drop for standalone terrorism placements in the fourth quarter of 2025 alone. "There has not been a market-moving loss in the U.S. in 25 years," Peter Bransden, Willis's head of crisis management for North America said to reporters, pointing to supply-and-demand dynamics as standalone US terrorism capacity has grown past $2 billion.
Falling prices alongside rising geopolitical instability is the kind of gap that makes underwriters nervous, and the same tension is now playing out in cyber, where AI-enabled and state-linked attacks are hitting the same insurability wall terrorism hit in 2001: losses that cascade through thousands of unrelated policyholders via a single shared vendor, in ways current models still struggle to price.
There's no federal cyber backstop equivalent to TRIA yet, though the idea keeps resurfacing whenever a major incident makes headlines. What 9/11's aftermath does offer is a template: cap the immediate liability, stand up a public compensation mechanism where litigation would be too slow, and build a federal reinsurance backstop for the systemic tail the private market can't hold alone. Three separate legislative tools, built inside a single year, are still doing that job today.
Twenty-five years later, the number people remember from 9/11 is the loss total. The number that matters more to underwriters renewing terrorism and cyber lines today is zero – that’s how much TRIA claims have paid since 2002. That's not proof the risk disappeared. It's proof that a backstop built in a hurry, and repeatedly extended since, has done exactly the job it was built for.
