Cyber insurance in 2023: Capacity slowly returned, but ransomware sub-limits kept tightening

For three straight years, buying cyber insurance had felt like a punishment. Premiums climbed relentlessly, capacity vanished, and the application process turned into a grueling security audit. Then, through 2023, the market began, slowly and unevenly, to correct. Rate increases moderated. New carriers entered. Some organizations even saw flat or slightly lower renewal quotes. But the relief did not mean a return to the easy years. Carriers held firm on the tighter terms they had fought for, and the ransomware sub-limit, a cap on what a policy would pay for ransomware-related losses, became a permanent fixture rather than a temporary concession. Here is what the 2023 correction looked like and what it meant in practice.

Why the market finally began to correct

The correction was driven by the same forces, working in the other direction. Through the hard market, carriers had repriced risk sharply upward, and those higher prices restored the profitability of writing cyber coverage. At the same time, the organizations that had been forced to improve their security in response to the hard market, deploying multi-factor authentication, strengthening backups, and training their people, genuinely reduced their exposure. The result was a market closer to equilibrium: prices high enough to be sustainable, risk reduced enough to be insurable, and capacity returning as carriers regained confidence. It was a healthier market, but one built on much higher expectations than before.

Capacity trickled back, unevenly

The return of capacity was real but not uniform. New carriers and managing general agents entered the market, drawn by the improved economics, and some existing insurers expanded their appetite. But the appetite was selective. Higher-risk industries and organizations with weak security postures still found coverage hard to come by, even as the broader market eased. The organizations that had invested in controls during the hard years were the first to benefit from the returning capacity. Those that had hoped to ride out the storm without changing anything found the doors still closed.

Ransomware sub-limits became the new normal

The most visible change that stuck was the ransomware sub-limit. During the hard market, many carriers had capped what they would pay for ransomware-related losses, a direct response to the surge in ransomware claims that had driven their losses. In 2023, even as pricing eased, those sub-limits largely stayed. Carriers had concluded that ransomware was not a temporary spike but a structural, ongoing risk, and they priced and capped it accordingly. For policyholders, this meant reading the fine print carefully: a policy with a generous headline limit might still cap ransomware coverage at a fraction of that amount, and that cap was often the coverage they most needed.

The underwriting questions did not relax

Even as the market corrected, the rigor of underwriting did not. Carriers continued to ask detailed, evidence-driven questions about multi-factor authentication, endpoint detection, backups, incident response, and security awareness training. The difference from the hard years was that organizations had largely learned to answer them. Documented training, in particular, remained a consistent expectation, because carriers understood that most incidents still begin with human error. An organization that could produce current completion records, with names, dates, and topics, stood out even in a softening market.

What the correction meant for security programs

The 2023 correction sent a clear message: the higher standards of the hard market were here to stay. Organizations should treat documented controls, including annual security awareness training, as a permanent baseline rather than a temporary concession to a hard market. That meant keeping training content current, enrolling new hires promptly, and maintaining clean records that could be produced on demand. The organizations that treated these as standing disciplines navigated the correction with the least friction and the best terms.

A better market, on better terms

The market correction of 2023 was welcome, but it was not a return to the past. Cyber insurance had matured into a more serious, more analytical market, and the organizations that thrived in it were those that took their own security seriously. The premium relief was real, but it flowed most reliably to organizations that could prove their controls worked. In the corrected market, the best way to keep cyber insurance affordable was the same as it had always been: run a strong, documented security program, and keep the evidence current.