The global cyber insurance market reached 14 billion dollars in 2023 (Munich Re). It should exceed 22 billion in 2025. But this growth masks a structural shift: insurers no longer offer standardised cover. They now require documented evidence of compliance, formalised incident response plans, and third-party risk governance that meets NIS2 and DORA. For organisations that still see cyber insurance as a safety net rather than a framework of requirements, the wake-up call is harsh. In this article, you will learn how underwriting criteria have changed in 2026, which mistakes take organisations out of the cover market, and what well-covered organisations do differently.
A market that no longer covers the same risks as in 2022
NIS2 and DORA have accelerated a transformation the insurance market had already started. After two years of record losses, with ransomware accounting for 75% of cyber claims in 2023 according to Hiscox, insurers substantially revised their underwriting grids from mid-2024. The result is not only higher premiums: it is a structurally finer selection of risks.
The transformation runs along three lines. First, underwriting questionnaires have become maturity audits. AXA XL, Allianz Cyber and SCOR now publish requirement frameworks that map directly to NIS2 (Art. 21, risk management measures) and DORA (Art. 5-14, ICT resilience framework). An insurer can refuse cover if the organisation cannot demonstrate a documented third-party risk management programme.
Second, deductibles and cover limits have become conditional. An organisation without generalised MFA on privileged access will see its deductible double or triple. An organisation without an incident response plan tested in the last 12 months may face an explicit exclusion on ransomware recovery costs, precisely the most frequent type of claim.
Third, exclusions have been refined. 2026 policies now exclude incidents linked to known unpatched vulnerabilities (CVEs with a CVSS score above 7 left unfixed for more than 30 days), to contractually unqualified third parties, and to untested backup configurations. These exclusions cover the entry vectors behind three quarters of declared claims.
What insurers actually require in 2026
Insurers' requests can be summed up in five blocks of evidence, and none of them can be produced at the last minute.
Formalised risk governance. An up-to-date risk register, documented and presented to the executive committee (Comex) at least once a year. NIS2 Art. 21 provides the framework for entities in scope. Without this document, produced within 48 hours on the insurer's request, some policies cannot be issued.
Documented third-party management. Under the influence of DORA (Art. 28 for financial entities), insurers ask for a list of critical ICT providers, their contractual service levels, and proof of an assessment of their resilience. This is precisely the scope that third-party risk management is meant to cover, and that many organisations have not yet formalised.
Tested incident response plans. An untested plan document is insufficient. Insurers require proof of exercises (tabletop, incident simulation) conducted in the 12 months before underwriting. DORA Art. 26 imposes these tests on financial entities: insurance simply aligns its requirements with the regulatory framework.
Demonstrable cyber hygiene. MFA on privileged access, a patch management policy with deadlines based on CVSS criticality, EDR deployed on all endpoints, encrypted and tested backups. These elements have become prerequisites, not differentiating factors.
Traceable audit chain. The ability to produce documented evidence of all of the above within 48 hours of a claim. This is where organisations without a centralised GRC platform struggle, and where they are sometimes refused payment on the basis of a clause on breach of declared preventive measures.
The classic mistake: confusing cover with a programme
The most common confusion is treating cyber insurance as a substitute for a security programme. You take out a policy, tick the box "covered against cyber risks", and remain structurally vulnerable.
This logic has been turned on its head. Insurers now know precisely which organisations will suffer a claim: those whose underwriting questionnaire reveals an incomplete security programme. The insurers' response is not to cover these risks at a higher price. It is to exclude them from the market, or to apply deductibles so high that the cover is de facto worthless.
A secondary mistake is to think about compliance only at the annual renewal. The organisations that obtain the best terms maintain a documented compliance programme on an ongoing basis, which naturally generates the evidence the insurer asks for, because that same evidence is what France's national cybersecurity agency (ANSSI), a NIS2 auditor or a DORA regulator would request during an inspection. Continuous compliance is not an extra cost of cyber insurance. It is the precondition for it.
Three questions to assess your position
Before your next policy renewal, ask yourself these three questions.
Can you produce, within 48 hours, an up-to-date risk register validated at executive committee level? If the answer is "partly" or "no", your underwriting file is exposed, and your premium or exclusions will bear the cost at the next issue.
Do you have a formalised inventory of your critical ICT providers, with their contractual SLAs and proof of a recent assessment? The absence of a documented answer to this question systematically triggers a deductible increase at the leading cyber insurers in the European market.
Can you provide proof of an incident response plan exercise conducted in the last 12 months? This criterion, absent from underwriting questionnaires three years ago, is now systematically checked at any new underwriting or renewal above 500,000 euros of cover.
Presidio centralises this evidence on an ongoing basis: risk register, third-party monitoring, immutable audit chain. Read also our analysis of the 7 pitfalls when launching a TPRM programme, or contact our team for a scoping interview tailored to your context.
Conclusion
The cyber insurance market is becoming a mirror of organisations' regulatory maturity. Those that invest in a documented, continuous and auditable GRC programme do not pay more for their cyber insurance: they pay less, on better terms and with fewer exclusions. Those that treat compliance as a box to tick pay more, or no longer find cover suited to their real risk profile. The convergence between regulatory requirements (NIS2, DORA) and insurance requirements is no coincidence: the market creates the same incentives as the regulator. Organisations that have understood this have built a structural lead over their competitors, in costs, in resilience and in credibility with their own stakeholders.