Cyber insurance in 2024: Premiums finally stabilize, but the underwriting questions got harder

After three bruising years of premium increases, the cyber insurance market finally showed signs of stabilization in 2024. Rate increases moderated, capacity returned, and for many organizations, renewal stopped feeling like a confrontation. But the relief came with a catch. The market's new normal was built on far more rigorous, evidence-driven underwriting than before. Organizations that expected the old, lightly-scrutinized application process to return were disappointed. Here is what 2024's stabilizing market looked like, and what carriers were still demanding.

The end of the hard market, sort of

The cyber insurance market began hardening in 2020, when a surge in ransomware claims collided with a broader tightening of the insurance industry. Premiums climbed sharply through 2022 and into 2023, with some organizations seeing renewal quotes double or worse. By 2024, that pressure had eased. Rate increases slowed, and in some segments flattened or even reversed. Capacity returned as new carriers entered and existing ones expanded. The panic was over. But the underlying changes to how cyber risk was underwritten, the deeper questionnaires, the emphasis on verifiable controls, were permanent.

What stayed hard: the questions

Even as pricing stabilized, the underwriting process did not relax. Carriers continued to ask detailed, evidence-driven questions about multi-factor authentication coverage, endpoint detection and response, backup strategy, patch management, incident response planning, and security awareness training. The difference from the hard-market years was not the rigor of the questions, it was that organizations had finally learned to answer them. The most prepared organizations had spent the preceding years closing gaps and building documentation, and they arrived at 2024 renewals with strong, defensible answers.

Training documentation stayed table stakes

Among the controls carriers scrutinized, documented security awareness training remained one of the most consistent. The logic had not changed: most incidents still begin with human error, and a trained, tested workforce represents measurably lower risk. Carriers wanted to see who was trained, when, on what topics, and whether completion records could be produced on demand. Organizations that could demonstrate an ongoing, well-documented program stood out. Those that could not, even in a stabilizing market, still faced tougher terms or coverage restrictions.

Why stabilization happened

The market's stabilization reflected several forces converging. Carriers had repriced risk to reflect the new reality, and those higher prices restored the profitability of writing cyber coverage. Organizations, for their part, had made real security improvements in response to the hard market, deploying multi-factor authentication, improving backups, and investing in training. The result was a market closer to equilibrium: prices high enough to be sustainable, risk reduced enough to be insurable. It was a healthier market, but a more demanding one.

What the new normal expects of you

The lesson of 2024 was that the cyber insurance market had matured, and so had its expectations. Organizations should treat documented security controls, including annual training, as a permanent baseline rather than a temporary concession to a hard market. That meant maintaining current completion records, keeping training content updated against evolving threats, and being ready to demonstrate the entire program on short notice. The organizations that treated these practices as standing disciplines, not renewal-season chores, navigated the stabilizing market with the least friction.

A better market, on better terms

Stabilization in 2024 was welcome, but it was not a return to the past. Cyber insurance had become a more serious, more analytical market, and the organizations that thrived in it were those that took their own security seriously. The premium relief was real, but it flowed most reliably to organizations that could prove their controls worked. In the new normal, the best way to keep cyber insurance affordable was the same as it had always been: run a strong, documented security program, and keep the evidence current.