Cyber and E&O: Pricing Holds, but Market Momentum is Shifting

Cyber and E&O: Pricing Holds, but Market Momentum is Shifting
October 6, 2025 10 mins

Cyber and E&O: Pricing Holds, but Market Momentum is Shifting

Cyber and E&O: Pricing Holds, but Market Momentum is Shifting

The global cyber and tech errors and omissions market continues to favor buyers — for now. As AI-driven threats, privacy litigation and supply chain exposures intensify, forward-thinking organizations are using this window to build resilience.

Key Takeaways
  1. The cyber and tech E&O pricing remains favorable, but signs of market moderation are emerging in some global areas.
  2. Cyber attacks remain the top global risk concern in 2025, with evolving threats prompting closer scrutiny from insurers.
  3. Risk managers are using advanced analytics to align coverage with risk tolerance and build long-term cyber resilience.

Cyber and tech errors and omissions (E&O) risks continue to evolve — not just in frequency, but in complexity. As threat actors adopt new tactics, insurers are adjusting their stance and early signs of market moderation are emerging. For risk leaders, the challenge is no longer just managing volatility, but anticipating how the risk environment will shape coverage decisions ahead.

Cyber Volatility Continues to Be Leading Global Risk Concern

Cyber risk continues to dominate the global risk agenda. Aon’s 2025 Global Risk Management Survey confirms that cyber attacks and data breaches remain the top concern for business and risk leaders worldwide. The rapid adoption of artificial intelligence (AI) and digital platforms is reshaping cyber risk — introducing new efficiencies, but also new vulnerabilities. These shifts are already influencing insurer behavior and underwriting scrutiny.

With pricing still favorable, risk managers have an opportunity to stay ahead of emerging threats. Aon recommends reinvesting capital to strengthen cyber controls and expanding cyber liability and E&O program limits now to prepare for the future.

Pricing Remains Competitive, but Market Appears to Begin Moderating

Cyber: Buyer-friendly pricing continues across North America and Europe, Middle East and Africa (EMEA), supported by low loss ratios and a well-capitalized marketplace. In North America, price reductions are slowing — with moderation beginning to take hold. In the EMEA region, competitive pressures are keeping rates soft, though insurers are increasingly advocating for firmer pricing.

Tech E&O: Globally, tech E&O pricing continues to stabilize. Through the first half of 2025, average global premium changes remained flat, driven by a 2% increase in primary layers and a 2% decrease in the first excess layer. Buyers continue to optimize their programs by expanding coverage, increasing limits and adjusting retention levels according to their risk tolerance.

Businesses Face Similar, Yet Different Markets in Regions

North America:

Pricing remained favorable in the first half of 2025, supported by a well-capitalized and competitive marketplace. Rate reductions slowed, with an average decrease of 4% in Q2 2025. Buyers continued to optimize their programs by expanding coverage, increasing limits, and adjusting retention levels to match their risk appetite.

Looking ahead, we expect to see flat to minimal premium decreases through 2025. However, certain industry classes, including healthcare, airlines and financial institutions, may face firmer conditions depending on controls and loss history.

U.S. Cyber 5-year Premium Change by Quarter
28457 Cyber EO 2025 H2 - Web charts 01

Source: Aon data

Coverage enhancements and program structure stability, including long-term pricing agreements and rate guarantees, are helping insurers stand out in a competitive market. Given insurers’ desire to maintain their books of business and a well-capitalized excess marketplace, we expect buyer-friendly market trends to continue through the remainder of 2025.

“We continue to see carriers wanting to innovate, including bodily injury and property damage resulting from a cyber incident,” says Greg Sparacio, Middle Market Leader for Aon’s Cyber Solutions Practice in the United States. “There’s an appetite for that instead of offering more coverage for the same premium previously offered. It’s a favorable trend and good for buyers as they can cover more of their risk that was previously uninsurable as part of cyber.”

In Canada, the market remains highly competitive. Rate reductions averaged 19% in Q1 2025 and 16% in Q2, with insurers continuing to offer attractive terms across most segments.

Canada Quarterly Cyber Pricing
28457 Cyber EO 2025 H2 - Web charts 03
28457 Cyber EO 2025 H2 - Web charts 04

Source: Aon data

“We have been hearing of loss developments across insurer cyber portfolios and believe more neutral market conditions are ahead,” says Katie Andruchow, Aon’s Cyber Broking Practice Leader in Canada. “We have heard about rate increases for large, complex tech E&O accounts. It seems that there may be some pockets being identified where rate erosion has been too great and flat to moderate increases are being asked.”

Europe, Middle East and Africa (EMEA):

Pricing remains soft and loss ratios low, although market conditions are beginning to diverge by country.

“There are insurers starting to have discussions around rate increases, although they don’t have the loss data to back that up,” says Søren Stryger, Chief Broking Officer for Aon in Europe, the Middle East and Africa. “Accordingly, there are no signs of moderation in market conditions in EMEA, however, we may have seen minimum rates for certain risks and excess layers being offered.”

The collective concern in EMEA is underinsurance. Aon data shows that 70% of EMEA businesses reported vulnerability scans covering less than 100% of their enterprise — compared to 58% globally.

“Underinsurance is almost as big a concern as having no insurance at all,” says Alistair Clarke, Aon's Managing Director of Cyber Broking in the United Kingdom. “It is important that clients are made aware of what a bad day looks like for them without proper coverage. With the market still soft, many are increasing limits while they can.”

Cyber insurance markets have generally been flexible with terms and conditions, working with the broker and client to build a program that is right for the business.

“It’s no longer a binary yes or no,” says Catalina Esteban Loring, Aon's Executive Director for Cyber and Commercial E&O in the United Kingdom. “Insurers are more open to negotiation, and this is a direct result of the soft market and its move toward maturity.”

Q2 2025 Cyber Analytics: Global Cyber Loss Trends

Ransomware Payments Increase:

After three years of increasing frequency and declining severity, trends flipped in early 2025. Global ransomware incident volumes fell 6% in Q2 2025, but average demand payments jumped 104% to $1.13 million, according to Aon data.

“Even though ransomware frequency is down, the actual average ransomware demands are up, and it is a major loss driver on insurers’ books of business,” says Matt Chmel, Aon's Chief Broking Officer, Cyber Solutions in North America.

Ransomware attacks grab the headlines — not just for their scale, but for their ability to disrupt lives and critical systems in real time. It’s this intersection of operational impact and public exposure that keeps ransomware front and center for business and cyber security leaders. Globally, the U.S. continues to harbor most of the incidents, according to Aon data.

28457 Cyber EO 2025 H2 - Web charts 02

Source: Aon data

Threat Actors Embrace Artificial Intelligence:

AI is accelerating defense capabilities while simultaneously arming threat actors with new tools to automate and scale attacks. It’s this dual-use nature that makes AI one of the most disruptive forces in cyber today.

It is certainly a growing concern among business and risk leaders. AI is now a top-10 future risk according to Aon’s 2025 Global Risk Management Survey. More than 70% of global businesses report an increased AI exposure, especially in social engineering and ransomware.1 By 2027 nearly one in five cyber attacks is expected to employ generative AI.2

Insurers are watching closely — not just how AI is used by attackers, but how organizations are deploying it to strengthen cyber resilience.

“If you are developing AI technology you need professional liability or tech E&O coverage to protect your organization,” adds Chmel. “Businesses also need to look at how they are using AI, ensuring business practices, processes, safeguards and compliance measures are strong.”

Supply Chain Cyber Risk Remains a Top Global Concern:

More than half of large organizations identified supply chain challenges as the biggest barrier to achieving cyber resilience,3 and for good reason. Several high-profile incidents, including CrowdStrike, CDK and Change Healthcare, have exposed the scale and severity of systemic risk, prompting heightened scrutiny from underwriters.

Supply chain or distribution failures continue to be among the top global risks in 2025, according to Aon’s Global Risk Management Survey of global business and risk leaders. The concern is not just operational — it’s financial, reputational and increasingly insurable.

“From a claims perspective we are seeing higher severity, but frequency remains stable,” says Pablo Constenla, Aon's Head of Cyber and Financial Lines Coverage and Claims in Europe, the Middle East and Africa. “Attacks against supply chain continue to be a concern. When claims hit, they’ve hit big. Threat actor groups are very aggressive at the moment.”

Underwriters Have Privacy Litigation Concerns:

As privacy regulation tightens globally, litigation risk is rising, especially in the U.S. where class action lawsuits related to tracking technologies and wrongful data collection continue to impact the market. Insurers are responding by reassessing policy language and narrowing coverage around wrongful or unlawful data collection.

“Wrongful collection is a growing concern and many insurers are taking a firm stance on it,” adds Clarke. “We’re seeing a widening gap between insurers willing to offer coverage and those pulling back. It’s a signal to clients to review their exposure and ensure their programs are fit for purpose.”

How the CrowdStrike outage still serves as a wake-up call to build cyber resilience

Case Study

How the CrowdStrike Outage Still Services as a Wake-Up Call to Build Cyber Resilience

The CrowdStrike outage revealed that insurance coverage was not as comprehensive as organizations believed due to the language and stipulations within policies, including directors and officers (D&O), cyber and business interruption, among others.

Building Resilience, Making Better Decisions through Data and Analytics

Leading organizations and risk leaders are using enhanced analytics to make better and faster decisions — building cyber resilience that’s both sustainable and scalable.

By moving beyond traditional benchmarking, brokers are helping risk managers align their insurance programs with actual risk tolerance.

“Data and analytics are helping risk managers think more about limits and adequacy vs. just limits and budget,” adds Andruchow. “Historically they have relied on benchmarking, cause of loss reports, publications and what peers were doing. We are able to enable them to make accurate decisions to protect their assets and build resilience.”

Aon’s Cyber Risk Analyzer and Cyber Quotient (CyQu) Evaluation tools offer the quantitative insights needed to understand exposure and optimize program structure.

“We’ve already seen around 20% of our clients increase their limits to capitalize on the soft market,” adds Chmel. “Others are proactively taking on high retentions after realizing through the tool that they have more risk tolerance.”

If you are ready to evaluate your cyber risk program, contact us to discuss tailored, actionable approaches for protecting your organization from cyber attacks and data breaches.

Aon’s Thought Leaders

Katie Andruchow
Cyber Broking Practice Leader, Canada

Matt Chmel
Chief Broking Officer, Cyber Solutions, North America

Alistair Clarke
Managing Director, Cyber Broking, United Kingdom

Pablo Constenla
Head of Cyber Coverage and Claims, Europe, Middle East and Africa

Catalina Esteban Loring
Executive Director, Cyber and Commercial E&O, United Kingdom

Greg Sparacio
Middle Market Leader, Cyber Solutions, United States

Søren Stryger
Chief Cyber Broking Officer, Europe, Middle East and Africa

General Disclaimer

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

More Like This

View All
Subscribe CTA Banner