Falling rates and rising losses are putting the cyber insurance soft market on borrowed time. Five industry experts gathered in an Insurance Business America roundtable to examine where pricing is heading and why the window may be closing faster than many expect. Kevin Merchant of Wholesure projects stabilization by Q4 2026 and a genuine hard market by Q1–Q2 2027, driven by carrier contraction and losses from major events over the past 18 to 24 months finally reaching loss runs. The urgency is underscored by claims data: QBE figures show 67 percent of US businesses experienced a cyber event in the past 12 months, while Jennifer Coughlin of Mullen Coughlin reports her firm is tracking nearly 500 new first-party incident response matters every month in 2026, putting it on pace for roughly 1,500 more incidents than just a few years ago. Threat actors are accelerating the problem by folding AI into their operations, from targeting and script-writing to AI-assisted ransom negotiations that use light data mining to demonstrate exactly what has been stolen. Third-party vendor risk is growing in parallel: Verizon's 2025 Data Breach Investigations Report found third parties involved in 30 percent of analyzed breaches, twice the prior year's proportion. Underwriters at QBE and Cowbell are responding by tying coverage access directly to controls such as MFA and endpoint detection, though incident responders warn that binary yes-or-no application questions fail to capture whether those controls actually work. Meanwhile, the question of where AI losses land, inside a traditional cyber policy or in a future standalone product, remains unresolved, with Merchant predicting major AI exclusions within two to three years.
The cyber insurance soft market is widely expected to harden, with Kevin Merchant, cyber national practice leader at Wholesure, predicting pricing will stabilize in Q4 2026 and harden by Q1–Q2 2027. He points to two specific drivers: a contraction among carriers following years of new entrants, and realized losses from major events over the past 18 to 24 months finally hitting loss runs. "I'd be shocked if we're having this conversation next year and we're still talking about a soft market," Merchant said. The trajectory is supported by claims volume data showing 2026 frequency trending close to the 2021 peak, according to Joe Tarraf, chief delivery officer at Surefire Cyber.
Cyber claims frequency in 2026 is approaching levels last seen at the 2021 market peak. Jennifer Coughlin, founding partner and managing member of Mullen Coughlin, told Insurance Business America that her firm is tracking nearly 500 new first-party incident response matters per month and nearly 100 new litigation matters monthly. The firm is on track to handle 5,500 incident response matters in 2026, roughly 1,500 more than a few years ago, and more than 800 litigation matters for the full year. Joe Tarraf at Surefire Cyber confirmed that 2026 frequency is trending close to the 2021 peak, a period that previously forced carriers to dramatically tighten terms and raise rates.
Ransomware actors are using AI at multiple stages of an attack. Joe Tarraf, chief delivery officer at Surefire Cyber, described two concrete applications: AI is helping criminals better target organizations before launching an attack, and once inside a network, attackers are using it to write malicious scripts. Tarraf's team has also observed ransomware groups using AI to generate negotiation messages and to conduct light data mining on exfiltrated data. That data-mining capability allows threat actors to demonstrate precisely what they have stolen, strengthening their leverage during ransom negotiations and increasing pressure on victims to pay.
Whether AI losses belong inside a traditional cyber policy or require their own standalone product is one of the most contested questions in the market right now. Kevin Merchant, cyber national practice leader at Wholesure, argued that AI exposures cannot be properly underwritten or priced within a traditional cyber policy because there is no historical loss data and the technology changes too quickly. He predicted insurers will introduce major AI exclusions from cyber policies within two to three years, pushing the risk toward standalone products. Kevin Casey, lead cyber wordings and product innovation at QBE, noted the market has not yet agreed on what affirmative AI coverage looks like, adding that industry discussions have already shifted from generative AI to agentic AI in under two years, illustrating how fast the exposure is evolving.
Third-party vendor exposure has become a defining risk in cyber insurance. Verizon's 2025 Data Breach Investigations Report found that third parties were involved in 30 percent of breaches analyzed, twice the proportion recorded the prior year. Jennifer Coughlin of Mullen Coughlin, whose firm has handled more than 25,000 data privacy and security incidents, said vendors are implicated in almost every matter her firm handles, whether as the origin of an incident or simply as participants in the affected environment. Jessica Klipphahn, head of North America mid-market at Cowbell, added that the market trend toward streamlining application question sets, a practice that emerged from the hard market, makes it harder for carriers to properly underwrite third-party vendor relationships.
Ransomware underwriting is increasingly tied to specific security controls, but experts disagree on how well the process captures real-world effectiveness. Kevin Casey at QBE confirmed the insurer underwrites to controls, describing ransomware coverage as "a core coverage cyber can't get away from," and noted that tools like MFA and endpoint detection have moved from best-in-class status to table stakes. Jessica Klipphahn at Cowbell said carriers are increasingly tying full coverage access to controls rather than applying a simple premium credit. The gap in the process, according to Joe Tarraf of Surefire Cyber, is that application questions remain binary, asking only whether a control exists without assessing whether it has been implemented effectively.
Recent data from two roundtable participants illustrates the scale of the problem. QBE data shows 67 percent of US businesses experienced a cyber event in the past 12 months, and 25 percent suffered a business interruption lasting more than one working day as a result. Cowbell data shows that average ransomware payments have fallen 44 percent, yet cyber insurance claims have risen 40 percent over the same period. The claims mix breaks down as data breaches at 33.5 percent, cybercrime at 31.8 percent, extortion events at 18.3 percent, and other categories at 16.4 percent, pointing to a broadening threat environment that extends well beyond ransomware alone.