Insurers are filing fewer cyber claims and paying far more for the ones they do file, according to National Association of Insurance Commissioners data.
For businesses above $1B in annual revenue, the average claim reached $4.4M in 2025. That is double the 2024 figure and 586% higher than 2021. Meanwhile large firms filed 10 claims per 100 policies, down from 15 the year before.
Better underwriting, costlier incidents
NAIC reads the pattern as a sign that tighter underwriting and better security controls are thinning out the small claims. The incidents that still reach a payout are the ones that cascade, and those are getting noticeably harder to resolve.
Middle-market companies moved the other way on volume but up on cost: average claims hit $759,000, a 23% rise from $619,000. Firms below that line saw averages fall from $215,000 to $142,000.
Business interruption and breach litigation are named as the two forces pushing severity. Both have a common driver: an outage or a record set no longer stays contained to one organization.
Supply chain called the defining problem
The report labels supply-chain exposure the defining challenge of the current cycle, because mapping dependencies is hard and because one poisoned component produces correlated losses across many policyholders at once. Actuarial models built for independent events struggle with that arithmetic.
AI cuts both directions. Cheap offensive tooling could unsettle loss ratios for insureds on common software stacks. On the defensive side, carriers are starting to write coverage for cloud outages, a line AIG expanded in August.
The boardroom read
Frequency falling is not the same as risk falling. Two questions now matter more than the premium: what a single supplier failure would cost, and whether the policy’s limits survive an event that hits many insureds simultaneously.
