Cyber Insurance's Re-Underwriting Cycle: What CFOs Are Seeing in 2026 Renewals

The US cyber-insurance market has been through three distinct phases since 2019. First, a soft market when carriers competed to write cyber cover as a growth line. Then, from 2020 through 2022, a hard reset driven by ransomware loss frequency, in which premiums rose sharply, sub-limits tightened, and ransomware coverage was in some cases withdrawn entirely. From 2023 into 2025, the market softened again as loss ratios improved and new capacity entered. What is happening at 2026 renewal is different from any of those three, and CFOs bringing renewal papers to audit committees should expect a materially harder conversation than last year prepared them for.

Carriers are quietly re-underwriting rather than repricing. The premium ask at renewal is often close to expiring, but the coverage form is not. Ransomware sub-limits are being reintroduced or lowered on policies that had them removed. Coinsurance is appearing on business-interruption sections that were previously written on a full-limits basis. War and infrastructure exclusions, tightened following the joint carrier communications after the NotPetya litigation cycle, are being applied with less flexibility to incidents that involve nation-state attribution. And, most consequentially, the definition of a covered incident is being narrowed in ways that require a careful read against the specific incident-response playbook the CISO actually runs.

The National Association of Insurance Commissioners has, through its cybersecurity working group, encouraged carriers toward more granular underwriting questions and more explicit coverage language, and the market has taken that as license to ask questions that previously would have been considered intrusive. Attestations about multi-factor authentication, privileged-access management, backup segregation, and third-party assessment cadence are moving from broker questionnaires to material terms of the policy, meaning a breach in the attested control can be argued as a coverage defense. Boards that have not read the attestation their own company signed at last renewal are, in our experience, surprised by what it commits them to.

For a CFO, the practical implication is that cyber insurance can no longer be treated as a commodity purchase managed by risk and reviewed by finance for premium impact. The right posture is to treat the coverage form as a legal artifact reviewed jointly by the CISO, the general counsel, and the CFO, with a specific focus on three questions. First, does the ransomware section still respond to the scenario your incident-response tabletop actually modeled? Second, are the attested controls verifiably in place, and is there a documented process for notifying the carrier when they change? Third, if a nation-state or infrastructure exclusion were invoked, what portion of the loss would actually be retained?

CISOs will not be surprised by any of this, but they benefit from the CFO's attention. The organizations that will handle 2026 renewal best are the ones treating the policy as a control artifact rather than as a hedge. The organizations that treat it as insurance in the ordinary sense will find, in an incident, that the coverage they thought they bought is not the coverage they hold.