Insurance is providing significant financial protection against cyber incidents, covering more than 95% of average data breach losses and 90% of average first-party losses, according to a study from Willis.

The study analysed 5,500 cyber claims across 95 countries between 2013 and 2026, representing the equivalent of around £740m in insurer payouts.

While data breaches remain the most common cyber insurance claim, ransomware generates the largest losses. The average ransomware incident lasts 25 days and costs £3.9m, with the largest recorded loss exceeding £370m.

Third-party suppliers are becoming a growing source of cyber losses, accounting for nearly 50% of data breach losses and 29% of first-party losses. The report highlights systemic cyber risk from single vendor incidents affecting multiple organisations as a key concern.

Peter Foster, chairman, global FINEX cyber and cyber risk solutions at Willis, said: "Cyber insurance cover varies widely, which is why organisations must understand what they have in place and ensure it aligns with their risk exposures. When cover doesn’t reflect reality, organisations risk critical gaps where protection is needed most, while paying for cover that offers little real value. To get the strongest value from cyber insurance, consideration must reflect the claims patterns seen across the market."

According to Willis, AI has yet to emerge as a standalone cause of claims but is increasing risk volatility by amplifying threats such as phishing, social engineering and ransomware.

---