In Partnership with
Is cyber’s soft market about to harden?
Falling rates are colliding with rising losses – and the market may be approaching a turning point
Kevin Casey
QBE
Industry experts
Jennifer Coughlin
Mullen Coughlin
Jessica Klipphahn
Cowbell
Kevin Merchant
Wholesure
Kevin Casey leads cyber wordings and product innovation for QBE’s Global Cyber Center of Excellence, where he is responsible for the development of cyber insurance products, policy wordings, and strategic coverage innovation across QBE’s global cyber portfolio. With more than 15 years of experience spanning cyber claims and product development, Casey works at the intersection of underwriting, claims, cyber services, and emerging technology, helping shape solutions for evolving cyber and technology risks. His work includes the development of innovative coverage enhancements and risk transfer solutions designed to address the changing needs of clients operating in an increasingly digital economy.
QBE
Kevin Casey
Jennifer Coughlin is a founding partner and managing member of Mullen Coughlin. She focuses her practice solely on providing organizations of all sizes and from every industry sector in first-party breach response and third-party privacy defense legal services. Coughlin has counseled thousands of clients in investigating and responding to an event compromising information and systems security, working closely with client resources, third-party forensic consulting experts, and law enforcement to identify the nature and scope of a compromise. Coughlin relies on her knowledge of state, federal, and international laws, as well as industry-specific guidance and standards to assist organizations in identifying and complying with legal obligations to disclose the incident to certain audiences and provide certain services to impacted populations.
Mullen Coughlin
Jennifer Coughlin
Jessica Klipphahn is head of North America mid-market at Cowbell, leading strategy and growth for middle-market accounts and a national underwriting team dedicated to large retailers. She brings 15 years of commercial insurance experience, with deep expertise in cyber and technology E&O. Prior to Cowbell, Klipphahn was the North American head of mid-market cyber/E&O at Willis, leading a national brokerage team and managing complex middle-market placements. She holds CPCU and certified cyber insurance counselor designations and earned a BA in administration of justice from the University of Pittsburgh. Outside of work, Klipphahn serves in various volunteer roles.
Cowbell
Jessica Klipphahn
Kevin Merchant, MBA, is cyber national practice leader at Wholesure. With insurance experience dating back to 2014, he specializes in cyber liability, technology errors and omissions, management liability, and professional liability. Merchant helps retail agents evaluate emerging exposures, understand changing market conditions, and identify effective coverage solutions for their clients. Before joining Wholesure, he held leadership and production roles across executive lines, wholesale insurance, and risk placement. An active industry voice, Merchant recently shared his cyber market insights with The Insurer TV at the NetDiligence Cyber Risk Summit. He holds degrees in public policy and administration and a Master of Business Administration.
Wholesure
Kevin Merchant
“We’ve all realized through losses over the last handful of years that there’s a direct correlation between not having certain controls in place and experiencing a ransomware attack”
Jessica Klipphahn,
Cowbell
Cyber insurance has rarely been more competitive, but the conditions behind that competition may be starting to change. An influx of capacity has driven rates down for eight consecutive quarters, even as ransomware losses and increasingly interconnected risks continue to mount.
But is this level of softening really sustainable? As far as Kevin Merchant, cyber national practice leader at Wholesure is concerned, he’s not so convinced. In a recent roundtable hosted by Insurance Business, he told IB he sees a hardening market in the near future.
“We’re seeing some decreased capacity in the market, finally,” he said. “Part of the reason we’ve seen a reduction in price is that there have been more entrants to the cyber market. Now, [however], we’re starting to see some contraction, some consolidation among carriers, which I believe is going to lead to a stabilization in pricing in 2026 Q4, early 2027 Q1, and Q2.”
“[What’s more] a lot of the realized losses from major events in the last 18 to 24 months are finally starting to hit those loss runs,” Merchant added. “That will continue to either stabilize or drive up prices – but I’d be shocked if we’re having this conversation next year, and we’re still talking about a soft market. I think that in 12 months we’re going to be talking about how hard the market is.”
“You can’t underwrite for historical data that doesn’t exist. And it’s changing so rapidly that what’s true today is not going to be true 12 to 24 months from now”
Kevin Merchant, Wholesure
“We’ve seen time and time again is that the nuance matters. Until we bridge that gap, I don’t think we’re going to see a drastic change in security posture that’s driven by insurance”
Joe Tarraf,
Surefire Cyber
Read on
Cowbell is an AI-native adaptive cyber and specialty insurance company that redefines risk transfer and management for small and medium-sized organizations worldwide. Powered by the Cowbell Platform and OMNI, its AI-native decision intelligence system, Cowbell combines risk intelligence, underwriting, claims, and resilience services for better decisions across the insurance lifecycle. Its risk-rating platform draws on data from 55M+ entities globally to continuously assess risk and improve insurability. Cowbell offers adaptive cyber, Tech E&O, and management liability coverage across the US, UK, and Australia, backed by 25+ global (re)insurance partners, plus Cowbell Resiliency Services for cybersecurity advisory, incident response, and risk mitigation.
With more than 140 years of experience helping businesses manage risk, QBE is a leading international insurer and reinsurer serving customers around the world. QBE’s cyber practice combines underwriting expertise, cyber risk services, and incident response support to help organizations strengthen their cyber resilience. Through every challenge and opportunity, QBE remains committed to being “at the heart of it” for its brokers and customers.
Wholesure is one of the largest groups of wholesalers, binding authorities, and MGAs in North America. We bring speed, expertise, and personal service enabled by tech. We serve P&C, specialty, life, and employee benefits with broad market access. Our agency portal offers retailers access to exclusive rating tools, direct market access for instant binding, and traditional account submissions. The platform generates more than 2,000 opportunities each day and connects carriers with over 40,000 retail agencies, representing more than 100,000 users. Through its growing digital marketplace, Wholesure supports nearly $300 million in written digital premium while helping carriers and retailers transact more efficiently.
Share
Published Oct 19, 2026
Surefire Cyber delivers expert-led, AI-powered incident response with quality, consistency, and speed. It uses experience and automation to help clients manage cyber incidents decisively, reducing impact, so an incident is a manageable event, not a defining moment. Built to support insurance-driven response at scale, the company’s end-to-end incident response platform enables faster outcomes, consistent quality, transparent pricing, claims-ready reporting, and data-enriched insights. Surefire Cyber is creating the future of incident response and changing how clients experience cyber events, helping them plan, respond, and recover with greater confidence.
Founded by John F. Mullen, Jennifer A. Coughlin, James E. Prendergast (deceased), and Christopher J. DiIenno, Mullen Coughlin is an international law firm widely recognized as the data privacy and security thought leader for organizations of all sizes and across all industry sectors, as well as for the cyber insurance industry. With its unmatched knowledge of data privacy and security laws, and unparalleled experience in handling over 25,000 data privacy and security incidents and thousands of resulting third-party actions, Mullen Coughlin services organizations in incident response, regulatory investigation, single-plaintiff and class-action privacy litigation, and pre-incident data privacy and information security advisory compliance.
“There’s certainly both capacity and appetite in the market, but it’s early days. It’s growing, but it’s nascent”
Kevin Casey, QBE
Joe Tarraf
Surefire Cyber
“The number of losses we’re seeing this year is unprecedented. We’re seeing almost 500 new first-party incident response matters [each] month”
Jennifer Coughlin,
Mullen Coughlin
As Surefire Cyber’s chief delivery officer, Joe Tarraf partners with insurance carriers, brokers, and law firms to support executive and technical teams at organizations impacted by cybercrime. Tarraf and his team guide clients through complex cybersecurity incidents. Before joining Surefire Cyber, he served as managing director at S-RM, a global risk consultancy, where he spent nearly a decade helping clients prepare for and respond to cyber incidents. Tarraf began his career at Big 4 consulting firms as a senior manager, working on projects spanning cybersecurity, from large-scale security transformations and cloud security implementations to managed security services and incident response.
Surefire Cyber
Joe Tarraf
“[However], organizations that have a suite of security controls, with layers built in all the way from the perimeter and remote access through to backups, are better equipped to prevent incidents, detect and contain them sooner, or mitigate the damage much more efficiently,” Tarraf said.
Underwriting, he added, has evolved to recognize that. Insurers are increasingly asking questions about controls that may not have been featured in applications five or six years ago.
“That’s helping,” Tarraf said. “However, there’s a fundamental gap in the sense that these questions are very binary in nature. They’re yes-or-no questions: Do you have MFA? Do you have EDR? Do you have backup solutions?”
The problem is that having a control in place does not necessarily mean it has been implemented effectively.
“What we’ve seen time and time again is that the nuance matters,” said Tarraf. “Until we bridge that gap, I don’t think we’re going to see a drastic change in security posture that’s driven by insurance.”
Source: QBE
Widespread cyberattacks concerning US businesses
Two in three US businesses (67%) experienced a cyber event in the past 12 months
One in four US businesses (25%) experienced a cyber event in the past 12 months that resulted in a business interruption for more than one working day.
77% of businesses are concerned about cyber threats they may face over the next 12 months.
77%
25%
67%
Source: Cowbell
40%
44%
Ransomware payments drop as cyber claims surge
Average ransomware payments have fallen by
However, cyber insurance claims have risen by
Data breaches 33.5%
Cybercrime 31.8%
Extortion events 18.3%
Other 16.4%
33.5%
18.3%
16.4%
31.8%
‘We’ve never seen the activity that we’re seeing right now’ Jessica Klipphahn, head of North America mid-market at Cowbell, agrees, adding that they’ve already started to see some markets take a tougher stance on less profitable classes.
“The challenge has been that everyone is still driven by growth, but now we’re starting to see a firmer market headed into Q4,” Klipphahn said. “The losses aren’t slowing down – newer entrants may realize this less substantially at first than mature markets – but we’re all in the business of paying claims. That’s inevitable.”
“I would suspect that, headed into 2027, we’ll see more markets step forward and push rate. This may be by industry class and by individual book, but it will collectively send us toward a firmer market condition,” she said.
Those losses are rather substantial. And, according to Jennifer Coughlin, founding partner and managing member of Mullen Coughlin, the figures are of increasing concern.
“The number of losses we’re seeing this year is unprecedented. We’re seeing almost 500 new first-party incident response matters [each] month, and almost 100 new litigation matters or third-party claims every single month. That dwarfs what we’ve seen in years prior,” Coughlin said.
“We’re on track to hit 5,500 IR matters for the year, which is going to be 1,500 matters more than a few years ago. And as for litigation, we’re on track to have over 800,” she added. “We’ve never seen the activity that we’re seeing right now.”
From a responder perspective, while the action has slowed somewhat from a peak in 2021, winding down from 2022 to 2025, Joe Tarraf, chief delivery officer at Surefire Cyber, told IB that 2026 has seen another surge in activity.
“The first couple of months of 2026, we thought it was going to be similar to the last [few] years, but since then, the trend is very much up and to the right in terms of frequency of events,” Tarraf said. “[There’s] an increased flow of cases, [more] matters that we’re working on, and I think if it doesn’t beat 2021, it’s going to be very close to it.”
“It will be interesting to see, from my perspective, how the insurance market adapts to that. My view is that it’s always cyclical. You have a pretty bad year; it adapts, it softens. Then you have a bad year, and it hardens. I think we’re at that point [right now],” he said.
With the market at such a peak right now, the question remains: What exactly will happen if this softening continues? As Kevin Casey, lead cyber wordings and product innovation at QBE, told IB, it will mean an abrupt change to that cycle.
“[Similar to] a few years ago when insurers’ capacity retreated, coverage was restricted, premiums increased, limits were cut – we can certainly see that happening again in a fairly abrupt manner rather than a more deliberate hardening of the market,” Casey said.
‘There’ve been lessons learned from Silent Cyber’ One area that could test that balance is artificial intelligence. As insurers struggle with an upended risk outlook and limited claims history, questions around
where AI-related losses should sit are beginning to emerge and whether existing policies were ever designed to absorb them in the first place. And new ISO endorsements allowing carriers to exclude certain generative AI exposures from commercial general liability policies have only brought those questions into sharper focus.
“There’ve been lessons learned from Silent Cyber,” Klipphahn said. “We’ve now seen this position consistently from other lines over the years as cyber has developed. GL, property, D&O have all moved to affirm their triggers and intent to not pick up cyber events. To me, it’s somewhat expected now with these AI exclusions. I think we’re moving toward clarity.”
“I don’t think that Silent AI will be a problem in the cyber market specifically,” she added. “[However] I think the topic is top of mind for markets and insurers, and they’re taking their desired approach.”
That movement toward transparency is something that Casey hopes will continue into 2027, adding that in general he sees the market moving toward greater clarity where needed.
“Outside of GL and [other] lines of business, [we’re] seeing more affirmative language covering AI – especially in the cyber and tech E&O world … we’re seeing clarifying language, and we’re also seeing coverage enhancements filling gaps that wouldn’t be covered under a traditional cyber policy,” Casey said.
However, Tarraf was quick to point out that AI isn’t the root cause of all cyber insurance woes. Notably, he believes that the main driver of incidents today is tied to basic hygiene – or a lack thereof. “Organizations are still not fully putting multi-factor authentication (MFA) on remote access and similar items,” he said.
‘What’s true today is not going to be true 12 to 24 months from now’ “Where we’ve seen threat actors use AI is in a couple of specific places, whether it be AI enabling their toolkit to better target certain organizations or, once they get in, we’ve seen concrete evidence that they’ve used AI to write certain scripts and [carry out] malicious activity.”
“We’ve [also] seen them use AI on the negotiation side. It’s very clear to us that, as we’re going through the negotiations with these threat actors – specifically the ransomware ones, they’re using AI to generate the messages to us, as well as to do a form of light data mining on the data they have exfiltrated.”
That hidden data mining allows the threat actors to add yet another layer of pressure to the negotiations. Criminals can use that internal analysis during ransomware negotiations to demonstrate what they have stolen and strengthen their position. For Merchant, this is a case in point as to why clients should look at standalone cover.
“I believe that standalone cover is going to be the way the market goes,” he told IB. “Everybody has understood the AI threat for the last three to four years. We’ve known this is a real problem – and it’s become more of a known problem due to those recent ISO exclusions.
Now, agents that typically play in the GL space are starting to understand that there’s a true risk,” he said. “I don’t believe that it should be covered broadly on a traditional cyber policy. I don’t believe that’s a cyber policy’s intent [because] I don’t believe that a carrier can properly underwrite or price the AI exposure that we’re seeing.”
“AI is in a constant state of flux,” he added. “You can’t underwrite for historical data that doesn’t exist. And it’s changing so rapidly that what’s true today is not going to be true 12 to 24 months from now.”
Third-party vendor: a hidden risk? But while insurers are still working out how to quantify emerging AI exposures, another worrying source of risk is already firmly established – third-party vendors. As businesses become more reliant on external technology providers and interconnected digital supply chains, incidents originating outside an insured’s own network are creating awkward questions around both underwriting and coverage.
“It’s challenging because vendors are used by almost every single organization out there,” said Coughlin. “And with the use of vendors comes risk, but the risk isn’t 100 percent in the control of the organization utilizing the vendor. There’s a lot that can go into a robust vendor management program to identify what the risk is and ascertain its impact on the downstream organization.”
“There are contractual ways to negotiate shifting some of the risk, but the reality is vendors are involved in almost every single matter that we see in some way, shape, or form,” she added. “Sometimes, the incident arises out of an issue at the vendor; other times, it’s not. But there’s still vendor involvement in the matters.”
The scale of exposure is already becoming apparent. According to Verizon’s 2025 Data Breach Investigations Report, third parties were involved in 30% of breaches analyzed, twice the proportion recorded a year earlier. Crucially, the impact on those organizations often depends on how the compromised vendor responds. While some vendors provide detailed information, handle notifications, and engage with regulators, others disclose very little.
As Tarraf told IB, his team has seen these third-party breaches for quite a while now, but they’re increasing in both speed and scale.
“There are a few different types of third-party breaches. [If an] organization uses a SaaS platform or software that is fully controlled by a third party and they have very little control over it. And there are other cases, [say] for example, the organization is using a managed service provider and a bad guy gets into the managed service provider’s toolset, they [can] hop into the organization’s environment through that and cause significant damage,” Tarraf said.
“The origination is from the third party, but the damage is on the organization’s platform as well … that’s where we get involved more, and we obviously do the response on the organization side,” he said. “Those instances are certainly ticking up. They’re increasing, and I think they’re only going to keep increasing with the more integrations happening and more service providers being onboarded.”
‘The questions we ask have evolved over time’ Supply chain risk is front of mind for firms, with Casey clarifying that while this type of claim isn’t anything new, the coverage available in the market has expanded significantly.
“The questions we ask have evolved over time as the market has shifted. Today, we recognize that this digital supply chain is really complicated, and coverage has evolved with that,” Casey said. “We’re recognizing and seeing markets introduce not only coverage for vendors that you rely upon, but customers that our insureds rely upon if they were to have an outage that could cause a business interruption loss.”
The threat of a large vendor outage, and what that would mean for underwriting efficiency, means there’s even more pressure on the industry to gather information quickly and efficiently. As Klipphahn told IB, it’s a tricky tightrope to walk.
“Coming out of the hard market, we’ve seen pressure to streamline the application process and to cut those question sets down, so underwriting to vendor relationships is a challenging thing to do,” Klipphahn said. “The average insured uses many vendors, and it’s not feasible to gather cyber hygiene information for each of them.”
“We’ve seen market conditions before where coverage got peeled back … I think the key here is expressing the critical nature of IT governance,” she added. “[It’s important that] IT departments are involved in the vendor vetting process to make sure that these things are reviewed and passed along into the underwriting conversation so that we can properly assess that risk.”
“The majority of events stemming from an organization’s use of AI are, for now - and I think the key words here are ‘for now’ – inadvertent data leakage,” Tarraf explained. “There are organizations that are implementing Claude or ChatGPT – and they’re probably not configuring them right. Then, you have employees using them on a day-to-day basis for their daily tasks. They’re putting in data that they shouldn’t, and that data gets leaked externally. We’re seeing a lot of that.”
“As organizations [become] more AI-enabled from an agentic point of view, they’re having agents perform their workflows, finance workflows, and operational workflows,” he said. “[But] are we going to see those agents go beyond their guardrails and start causing some sort of damage? Are we going to see organizations use AI to build software without the right supervision and the right gates? [Will that] software have security vulnerabilities because it’s not following a secure development life cycle? Those concepts are going to be interesting from my perspective, at least in the next six to 12 months.”
Those questions also raise a more immediate issue for insurers, namely, whether existing products are even equipped to respond as AI moves from a tool used by employees to technology capable of acting alone on an organization’s behalf. For the insurance market, however, defining that coverage is something of a moving target.
“There’s certainly both capacity and appetite in the market,” added Casey. “But it’s early days – it’s growing, but it’s nascent. [People have to consider] that technology is evolving so quickly. We haven’t, as a market, even landed on what we consider to be affirmative AI coverage or even what that looks like.”
“In the past 12 to 24 months discussions were all about generative AI and how that would be covered, how policies would respond, and whether there was a need for standalone cover,” Casey said. “Today, we’re talking about agentic AI and autonomous AI, where humans are ‘out-of-the-loop’. And, as the technology evolves, it’s difficult as a market to keep up. Is this the appropriate scope of coverage? And what do insureds need to do to address those risks?”
‘There are too many unknowns to truly project where this is going’ That uncertainty over the scope of coverage is also prompting questions about whether cyber policies will remain the natural home for AI risk in the longer term.
“There are so many threats that AI and even AGI bring, that I don’t believe we can properly underwrite for,” Merchant said. “Yes, there is capacity; it exists currently on affirmative cover on a cyber basis, but also on a standalone basis. [However], right now, there are too many unknowns to truly project where this is going.”
“My personal opinion is we’re going to start to see major exclusions in two to three years on cyber policies because you cannot properly underwrite for it on a cyber policy,” he added. “I believe it has to be written on a standalone basis.”
As for Klipphahn, she told IB that there are a lot of unknowns and potential exposures to consider here, too.
“Part of the nuance is [due to the fact that] we haven’t seen the claims to date, and we certainly expect those,” she said. “It’s hard to put a policy to test without claims. It’s not singular or one-sided with AI. It could be first or third-party, it could act as the threat, it could be the point of exploitation. I think there’s such variance in the coverage, what we’re looking to affirm, and how it would respond that it’s more complex. It’s difficult to underwrite to as well. Until we start to see those losses, I don’t think we’re going to be able to intentionally craft coverage in the way that we might want to today.”
Coughlin believes that organizations now need to prioritize understanding how these threat actors are leveraging AI and build that into their prevention strategies.
“We’re not really seeing losses related to it yet, but we’re seeing AI come into play when we’re dealing with these incidents,” she said. “We’re seeing threat actors utilize it on the backend, too, once they’ve successfully gained access to the network. We’re also seeing a big need for organizations to appreciate the need for true information governance, especially around the use of AI applications.”
“Organizations have an opportunity to be better at understanding what AI applications they already have, what their workforce has access to, and also what their workforce is doing with these applications [in order to] really understand [whether] it’s an appropriate use of these applications,” Coughlin added.
‘No matter how good of a risk you are, you’re still at risk for ransomware’ And no conversation around cyber is really complete without a mention of ransomware – a threat that seems to be growing more dangerous and sophisticated by the day. Recently, Allianz’s Risk Barometer cited cyber incidents, specifically ransomware attacks, as the top global business risk for the fifth year in a row.
Ransomware remains the dominant loss driver, even as claims frequency broadens across other categories. But is underwriting actually differentiating based on security controls at this point, or is pricing still largely undifferentiated regardless of an insured’s security posture?
“Ransomware continues to be a huge driver of loss, even with all these fascinating and interesting discussions about AI and supply chain,” said Casey. “We always say, ‘no matter how good of a risk you are, you’re still at risk for ransomware’. And so, we certainly underwrite to security controls – that’s really important.
“The market has evolved over time. Years ago, ransomware started to take off, and controls that may have been considered best in class, [such as] MFA and
endpoint detection, are now table stakes,” he noted. “We underwrite your controls [because] it’s a core coverage cyber can’t get away from.”
And not having those controls in place could leave businesses more vulnerable to devastating attacks.
“We’ve all realized through losses over the last handful of years that there’s a direct correlation between not having certain controls in place and experiencing a ransomware attack,” Klipphahn told IB. “Right now, there aren’t many markets prepared to attach a specific premium impact to controls, but that’s what we’ve been asked for years.
“From an insurance perspective, [they ask], ‘If I implement X, how much premium will that save me?’ The better response from us is that they may not have access to full coverage without the controls in place,” she said. “Some carriers may look to sublimit coverage if they’re lacking, look to require implementation [to] maintain full coverage, or set the price and retention accordingly to try to offset the additional risk posed by not having those controls in place.”
The main concern for brokers, insurers, and their partners here is that ransomware, as long-standing a cyber risk as it may be, simply isn’t going anywhere. As Tarraf told IB, as long as ransomware is easy to execute and threat actors can do it without any threat of repercussion, ransomware will only increase.
