A cyber policy that renewed easily two years ago may receive a much closer review now. Cyber insurance market trends are changing how carriers evaluate applicants, price coverage, and respond to risks such as ransomware, funds-transfer fraud, and third-party outages. For business owners, the practical question is not whether cyber coverage is still available. It is whether the policy reflects the way the business actually operates and the controls it can prove are in place.

For small and mid-sized companies, cyber insurance is no longer limited to technology firms. A contractor can lose access to project files and payment systems. A restaurant can face a payment-card incident. A professional services firm can have client data exposed through an employee email account. The financial disruption often goes well beyond the cost of restoring a computer.

Cyber Insurance Market Trends Are Becoming More Selective

The cyber insurance market has moved through a period of sharp premium increases and tighter underwriting, driven largely by frequent and costly ransomware claims. More recently, many well-managed businesses have seen more stable pricing and, in some cases, increased competition among insurers. That does not mean underwriting has become casual.

Carriers are still separating businesses with mature security practices from those with basic gaps. A company with multifactor authentication, secure backups, employee training, and a tested incident response process will generally present a different risk than a comparable company without them. Premium is increasingly tied to evidence of risk management, not just revenue, industry, and prior claims.

This creates an opportunity as well as a responsibility. Businesses that make meaningful security improvements may have more options at renewal. Those that cannot answer underwriting questions clearly may encounter higher rates, lower limits, restrictive terms, or a request to complete improvements before coverage is bound.

Security Controls Are Now Part of the Insurance Conversation

Multifactor authentication remains one of the most common underwriting requirements, especially for remote email access, privileged accounts, and financial transactions. Insurers also commonly ask about endpoint protection, patching practices, backups, network segmentation, and whether a managed service provider has access to critical systems.

The details matter. Saying that backups exist is different from confirming they are encrypted, separated from the primary network, and tested for restoration. Saying employees receive training is different from documenting recurring phishing simulations and escalation procedures. A broker who understands the application can help translate operational practices into clear underwriting responses without overstating what the business has in place.

Ransomware Still Shapes Coverage and Claims Planning

Ransomware remains a central concern because it can halt operations, expose sensitive information, and trigger extortion demands at the same time. The strongest policies can provide access to breach counsel, forensic investigators, public relations support, notification services, and business interruption coverage. But each policy has its own conditions, limits, waiting periods, and definitions.

Business interruption is a particularly important area to review. If a cyberattack shuts down scheduling software, point-of-sale systems, design files, or cloud-based business applications, how would the company measure lost income? Would extra expense coverage help pay for temporary equipment, outside specialists, or manual workarounds? The answer depends on the policy wording and the business’s operations.

Many policies also apply separate limits or sublimits to ransomware, computer fraud, social engineering, or dependent business interruption. These features are not necessarily a problem, but they should be understood before a claim occurs. A $1 million overall policy limit may not mean $1 million is available for every type of cyber event.

Social Engineering and Funds Transfer Fraud Need Separate Attention

A fraudulent email directing an employee to change vendor banking information can cause a major loss without a hacker ever entering the company network. This is commonly called social engineering, business email compromise, or invoice manipulation. It is one of the cyber risks that owners often underestimate because the transaction can look legitimate at first glance.

Coverage for this exposure varies widely. Some cyber policies include it with a modest limit, while others address it through a crime policy endorsement or separate coverage. Insurers may also require a callback verification process, dual approval for wire transfers, or written procedures for account changes.

The right limit depends on the size and frequency of payments the business makes. A company that regularly sends six-figure payments to suppliers, subcontractors, or payroll vendors should not assume a minimal social engineering limit will be sufficient. Operational controls and insurance should work together, not substitute for one another.

Third-Party Outages Are Receiving More Scrutiny

Businesses increasingly rely on cloud platforms, payroll systems, payment processors, managed IT providers, and software vendors. That convenience also creates dependency. If a key provider experiences a cyberattack or prolonged outage, the insured business may lose income even if its own network was not directly breached.

This is why dependent business interruption coverage has become more relevant. It may respond when a covered disruption at a technology provider interrupts the policyholder’s operations, but the scope can be narrow. Policies may define which providers qualify, require a direct connection to the business interruption, or exclude certain types of outage.

Owners should identify the vendors that would create the biggest operational disruption if unavailable for several days. For an Orange County restaurant, that could be its point-of-sale and online ordering platforms. For a contractor, it may be project management software, estimating tools, or payroll. For a professional firm, it could be a document management and email provider. That exercise helps clarify both the operational contingency plan and the insurance questions worth asking.

Artificial Intelligence Adds New Exposure, Not Just New Efficiency

Artificial intelligence is helping businesses automate customer service, summarize documents, create marketing materials, and streamline internal work. It is also making phishing messages, fake invoices, and voice impersonation attempts more convincing. Employees may receive an urgent call that sounds like an owner, executive, or vendor contact and asks for an immediate payment.

The insurance impact is still developing. Traditional cyber, crime, media liability, and professional liability policies may each address different parts of an AI-related loss. A business should be careful about assuming a single policy covers every mistake involving AI-generated content, unauthorized data input, impersonation, or a privacy allegation.

A practical starting point is to establish guidelines for approved AI tools, sensitive information, payment verification, and human review. The goal is not to prohibit useful technology. It is to prevent staff from placing client data, employee information, financial records, or confidential project details into tools the business has not evaluated.

Coverage Terms Matter More Than a Low Premium

As competition returns to parts of the market, a lower premium can be appealing. Still, cyber policies are not interchangeable. Comparing only the total limit and annual cost can leave meaningful differences hidden in the policy.

When reviewing options, look closely at the retention, business interruption waiting period, breach response expenses, privacy liability, regulatory defense, cyber extortion, computer fraud, social engineering, and dependent business interruption provisions. Also review the panel requirements. Some policies require the insured to use insurer-approved legal counsel, forensic firms, or vendors after an incident. That can be valuable because it provides immediate access to specialized responders, but leadership should know the reporting process before an emergency.

Industry also changes the analysis. A healthcare-adjacent business may have heightened privacy concerns. A manufacturer or contractor may rely heavily on operational technology and supplier payments. A technology company may need to consider contractual obligations, professional services, and client data. A nonprofit may have limited internal IT resources but hold donor and employee information that requires protection.

Prepare for Renewal Before the Application Arrives

Cyber applications can be a useful management tool rather than a paperwork exercise. Start the process early enough to resolve security questions or gather documentation. Waiting until the week before renewal can make it harder to compare carriers or address a control that an underwriter flags.

It helps to have a current list of critical systems and vendors, a simple written incident response plan, confirmation of backup testing, and documented payment-verification procedures. If the business uses an outside IT provider, ask that provider to help validate the technical answers. Accurate information is essential, since misstatements can complicate coverage when the business needs it most.

BearStar Insurance works with business owners to review cyber exposures alongside the rest of their insurance program, including crime, professional liability, and business interruption concerns. The objective is not simply to find a policy that checks a contract requirement. It is to help build a coverage structure that can support the business when a cyber event disrupts normal operations.

The most useful next step is a focused conversation before renewal: identify what data the business holds, what systems it cannot operate without, who can approve payments, and how quickly it could recover from an outage. Those answers turn cyber insurance from a generic line item into a practical part of the company’s continuity plan.