Cyber Risk is Growing Faster Than Risk Transfer

Cyber Risk is Growing Faster Than Risk Transfer
June 29, 2026 10 mins

Cyber Risk is Growing Faster Than Risk Transfer

Closing the Cyber Risk Protection Gap

Cyber investment has grown rapidly, but insurance remains a marginal share of total cyber spend. As cyber losses drive larger operational and financial outcomes, many organizations continue to retain significant volatility on their balance sheets.

Key Takeaways
  1. Cyber losses increasingly stem from operational disruption, not just data compromise, exposing earnings and liquidity impacts that extend beyond traditional security planning.
  2. Many uninsured cyber losses reflect decision timing, capacity expectations and legacy perceptions of coverage, rather than a lack of available risk transfer solutions.
  3. Cyber insurance delivers the most value when used deliberately to manage financial volatility, informed by scenarios, analytics and capital tolerance, alongside sustained investment in controls.

Cyber risk has evolved from a narrow technical concern into a material enterprise risk. What once focused primarily on data breaches and notification costs now encompasses operational disruption, supply chain dependency and sustained revenue impact across entire organizations. 

This shift is driven by deepening technology reliance. Cloud platforms, shared infrastructure and third-party software ecosystems now underpin core business operations. As a result, a single cyber event can trigger cascading failures that extend well beyond the affected system, disrupting production, service delivery and cash flow. 

The nature of loss has changed with this dependency. Many of today’s most severe cyber events do not center on data theft alone. They manifest instead as prolonged downtime, impaired operational capability and delayed recovery across interconnected systems. 

Artificial intelligence (AI) is accelerating change across the cyber risk landscape. It increases threat actor speed, scale and sophistication, while also offering organizations new ways to strengthen detection, response and resilience. For leaders, the issue is not whether AI changes the risk landscape, but how quickly they can adapt their security strategy to capture its benefits while managing the additional exposure. 

Quote icon

Cyber risk can no longer be managed solely as an IT or information security issue. Instead, stakeholders managing the risk and those managing the financial performance of the organization need to collaborate. Cyber must be addressed as an enterprise-wide concern with direct relevance to financial performance, liquidity resilience and capital allocation decisions.

Brent Rieth
Global Head of Cyber Solutions

Uninsured Cyber Losses in Practice 

Recent cyber events illustrate how retained exposure can translate into material operational and financial outcomes when risk transfer decisions do not keep pace with evolving loss potential.

  • Global Manufacturing Organization

    A multinational medical technology manufacturer experienced a major cyber event that disrupted production and distribution across multiple regions for several weeks. The incident resulted in a material financial impact for the quarter and required extensive system restoration across a large number of assets. The organization did not have confirmed cyber insurance coverage in place at the time of the event, and the financial impact was therefore largely retained. 

    The event highlights how significant operational disruption can translate directly into retained financial exposure when risk transfer decisions are not aligned with loss potential.

  • Automotive and Industrial Operator

    A global automotive and industrial manufacturer was forced to halt production for several weeks following a cyber incident affecting core operational systems. The disruption resulted in a loss for the period, with revenue down significantly in the first reporting quarter of the incident. 

    While the organization had previously assessed cyber insurance on more than one occasion, cover was not in place at the time of the event. The financial impact, which ran into hundreds of millions, was therefore largely retained. Although government support was considered, the organization ultimately did not draw on external funding. 

  • Health Services and Payments Business

    A global health services and payments organization experienced a cyber attack that disrupted core transaction processing across its network. The incident halted billing and reimbursement flows for an extended period, creating widespread operational and financial disruption. Total losses have been estimated in the billions, with no cyber insurance in place to offset the impact. 

    The scale and duration of disruption illustrate how cyber events can create systemic financial impact across critical services when risk transfer is absent. 

Taken together, these examples illustrate a consistent pattern. Severe cyber losses frequently sit outside insurance programs, not because coverage is unavailable, but because the decision to transfer risk was not aligned with the organization’s actual exposure or tolerance to volatility.

The Adoption and Spend Picture Today 

Investment in cyber risk management has grown sharply over the past decade. Global spending on information security has more than tripled, reflecting the expanding scale, complexity and business reliance on digital infrastructure.1

Over the same period, cyber insurance has evolved and grown, but at a far slower pace. While premiums have increased as coverage broadened and limits expanded, insurance still represents only a small share of total cyber spend, typically around 4-5% or roughly $15-16 billion of the ~$300 billion global information security market.2 The remaining investment continues to be directed toward controls, systems and operational resilience.

Cyber Insurance Purchasing Patterns by Company Segment
 Company Segment  % with Cyber Insurance
 Large Enterprise (>$1B)  70-94%3 
 Mid-Market ($100M-1B)  40-66%4
 SME ($10M-100M)  10-20%5
 Micro-Business (<$10M)  5-17%6
Cyber Insurance Adoption Rate by Region
 Region  Estimated Adoption Rate
 Europe  50-55%7
 North America  45-50%8
 Asia Pacific  15-20%9
 Middle East & Africa  ~10%10
 Latin America  <10%11

Adoption rates demonstrate further imbalance: 

  • Large enterprises show relatively high penetration. 
  • Mid-market and smaller organizations lag significantly. 
  • Regional uptake varies sharply, with lower adoption across many emerging markets. 

This divergence highlights more than a coverage gap. It reflects how organizations prioritize spending on cyber risk. Most capital continues to flow toward prevention and mitigation, while comparatively little is allocated to transferring financial volatility. In effect, many organizations are self-insuring a growing portion of cyber risk, often without explicitly framing that choice as a capital decision. 

How Coverage Has Evolved 

Cyber insurance has changed materially in response to how losses have emerged. Early policies were designed for a narrower risk environment and placed limited emphasis on operational disruption or financial severity. 

Over time, loss experience exposed those limits. Coverage expanded beyond breach response and regulatory investigation to address business interruption, dependent system failures, ransomware, privacy liability and regulatory defense. Capacity also increased through facility based structures designed to support higher severity loss scenarios. 

These changes reflect a market that has responded directly to real-world loss rather than theoretical risk. The more difficult question is whether buying decisions, expectations and program structures have kept pace with what today’s coverage is designed to address. As potential cyber losses grow in scale, assumptions around limits and retained risk are increasingly being tested.

How Buying Decisions Have Changed 

Cyber insurance purchasing has matured from a largely transactional exercise into a more deliberate decision-making process. Where coverage was once driven primarily by peer benchmarking or contractual requirements, decisions now reflect broader organizational input and a more explicit consideration of potential loss. 

Risk, technology, finance and executive leadership are increasingly involved in these discussions. Organizations are drawing on loss experience, benchmarking and a growing range of risk quantification approaches to inform decisions around limits, retention and program structure. Board-level engagement has also increased as cyber risk is more often framed in operational and financial terms. 

This evolution reflects greater sophistication in how cyber risk is understood and analyzed. However, improved decision frameworks alone do not determine outcomes. How those decisions translate into risk transfer depends on how organizations interpret exposure, tolerance for volatility and the role insurance plays alongside controls.

Underutilized Transfer or Unmet Demand 

Despite more mature decision making, uninsured cyber loss remains prevalent. This reflects two realities: 

  1. Cyber insurance continues to be underused as a tool for managing financial volatility relative to the scale of risk retained on organizational balance sheets.  
  2. At the same time, some organizations still perceive gaps between available coverage and the risks they face. 

Framing this as a choice between underutilized risk transfer or unmet demand oversimplifies the issue. In practice, both conditions often coexist. Some organizations default to control investment over financial hedging. Others hesitate due to pricing sensitivity, capacity expectations or legacy perceptions of coverage that no longer reflect current market design. 

What unites these outcomes is not a lack of insight, but decision context. Cyber insurance choices are often shaped by precedent and budget constraints rather than by an explicit articulation of risk tolerance and volatility appetite. As a result, retained cyber exposure is frequently implicit rather than strategic, even when potential losses are material. 

Closing the gap requires shifting the conversation from whether cyber insurance is sufficient to how risk transfer fits within broader financial and operational decision making.

Moving Toward Better Cyber Risk Decisions 

Cyber risk will continue to grow more complex, systemic and financially consequential. Insurance capacity and capability have advanced substantially, but adoption depends on engagement from both sides. 

For the insurance market, this means continued innovation, transparency and responsiveness to real loss drivers. For organizations, it means approaching cyber insurance as a strategic financial decision, informed by scenarios, tolerance for volatility and capital priorities. The opportunity is not to argue whether cyber insurance works, but to make it work better through informed, collaborative decision making.

Cyber Risk

Enhance Your Cyber Risk Strategy

Aon can help organizations move toward clearer cyber insurance decisions by quantifying cyber risk in financial terms, stress testing retention and transfer strategies and structuring insurance programs around volatility tolerance rather than precedent. Honest feedback will also return to the market, allowing coverage to continue evolving in line with real loss experience.

Learn More

1 IDC Worldwide Security Spending Guide, Gartner Market Databooks (2017-2026) and Statista Market Insights
2 IDC Worldwide Security Spending Guide 2025 and Cyber Insurance: Risks and Trends 2025, Munich Re
3 Cyber Insurance Market Size, Share, Trends and Forecast by Component, Insurance Type, Organization Size, End Use Industry, and Region, 2026-2034, IMARC, Cyber Insurance Nears an Inflection Point, American Academy of Actuaries
4 Cyber and E&O: Market Remains Soft but Volatility Grows, Aon, Cyber Insurance Nears an Inflection Point, American Academy of Actuaries
5 Cyber Insurance: Risks and Trends 2026, Munich Re, Cyber Insurance Statistics 2025: Market, Threats, and Claims Data, DeepStrike
6 2026 Cyber Claims Report, Chubb, Cyber Insurance Statistics 2025: Market, Threats, and Claims Data, DeepStrike 
7 Cybersecurity Insurance – A Burgeoning Global Market, Morgan Lewis
8 U.S. Cyber Insurance: Market Trends and Opportunities, Aon
9 Cyber Insurance Market Outlook 2025: Cycle Management Will Be Key To Sustaining Profits, S&P Global
10 2026 Cyber Insurance Statistics and Trends, Openkoda
11 Cyber Insurance Market Outlook 2025: Cycle Management Will Be Key To Sustaining Profits, S&P Global

Aon’s Thought Leader
  • Brent Rieth
    Global Head of Cyber Solutions

With contributions from Ady Sharma, Aileen Eaves, Carl Shanks, and Duncan Morrison.

General Disclaimer

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

Aon's Better Being Podcast

Our Better Being podcast series, hosted by Aon Chief Wellbeing Officer Rachel Fellowes, explores wellbeing strategies and resilience. This season we cover human sustainability, kindness in the workplace, how to measure wellbeing, managing grief and more.

Aon Insights Series Asia

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series Pacific

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series UK

Expert Views on Today's Risk Capital and Human Capital Issues

Client Trends 2025

Better Decisions Across Interconnected Risk and People Issues.

Construction and Infrastructure

The construction industry is under pressure from interconnected risks and notable macroeconomic developments. Learn how your organization can benefit from construction insurance and risk management.

Cyber Resilience

Our Cyber Resilience collection gives you access to Aon’s latest insights on the evolving landscape of cyber threats and risk mitigation measures. Reach out to our experts to discuss how to make the right decisions to strengthen your organization’s cyber resilience.

Employee Wellbeing

Our Employee Wellbeing collection gives you access to the latest insights from Aon's human capital team. You can also reach out to the team at any time for assistance with your employee wellbeing needs.

Environmental, Social and Governance Insights

Explore Aon's latest environmental social and governance (ESG) insights.

Q4 2023 Global Insurance Market Insights

Our Global Insurance Market Insights highlight insurance market trends across pricing, capacity, underwriting, limits, deductibles and coverages.

Global Risk Management Survey

Better Decisions Across Interconnected Risk and People Issues.

Regional Results

How do the top risks on business leaders’ minds differ by region and how can these risks be mitigated? Explore the regional results to learn more.

Impact Report 2025

Explore Aon's corporate sustainability impact and strategy.

Top 10 Global Risks

Trade, technology, weather and workforce stability are the central forces in today’s risk landscape.

Industry Insights

These industry-specific articles explore the top risks, their underlying drivers and the actions leaders are taking to build resilience.

Human Capital Analytics

Our Human Capital Analytics collection gives you access to the latest insights from Aon's human capital team. Contact us to learn how Aon’s analytics capabilities helps organizations make better workforce decisions.

Human Capital Quarterly Insights Briefs

Read our collection of human capital articles that explore in depth hot topics for HR and risk professionals, including using data and analytics to measure total rewards programs, how HR and finance can better partner and the impact AI will have on the workforce.

Insights for HR

Explore our hand-picked insights for human resources professionals.

Workforce

Our Workforce Collection provides access to the latest insights from Aon’s Human Capital team on topics ranging from health and benefits, retirement and talent practices. You can reach out to our team at any time to learn how we can help address emerging workforce challenges.

Mergers and Acquisitions

Our Mergers and Acquisitions (M&A) collection gives you access to the latest insights from Aon's thought leaders to help dealmakers make better decisions. Explore our latest insights and reach out to the team at any time for assistance with transaction challenges and opportunities.

Natural Resources and Energy Transition

The challenges in adopting renewable energy are changing with technological advancements, increasing market competition and numerous financial support mechanisms. Learn how your organization can benefit from our renewables solutions. 

Navigating Volatility

How do businesses navigate their way through new forms of volatility and make decisions that protect and grow their organizations?

Parametric Insurance

Our Parametric Insurance Collection provides ways your organization can benefit from this simple, straightforward and fast-paying risk transfer solution. Reach out to learn how we can help you make better decisions to manage your catastrophe exposures and near-term volatility.

Pay Transparency and Equity

Our Pay Transparency and Equity collection gives you access to the latest insights from Aon's human capital team on topics ranging from pay equity to diversity, equity and inclusion. Contact us to learn how we can help your organization address these issues.

Property Risk Management

Forecasters are predicting an extremely active 2024 Atlantic hurricane season. Take measures to build resilience to mitigate risk for hurricane-prone properties.

Technology

Our Technology Collection provides access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities of technology. Reach out to the team to learn how we can help you use technology to make better decisions for the future.

Trade

Our Trade Collection gives you access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities for international business. Reach out to our team to understand how to make better decisions around macro trends and why they matter to businesses.

Transaction Solutions Global Claims Study

Better Decisions Across Interconnected Risk and People Issues.

Weather

With a changing climate, organizations in all sectors will need to protect their people and physical assets, reduce their carbon footprint, and invest in new solutions to thrive. Our Weather Collection provides you with critical insights to be prepared.

Workforce Resilience

Our Workforce Resilience collection gives you access to the latest insights from Aon's Human Capital team. You can reach out to the team at any time for questions about how we can assess gaps and help build a more resilience workforce.

More Like This

View All
View All
Subscribe CTA Banner