Cyber Underwriting Maturity

Cyber insurance is one of the most instructive case studies in how a new risk class matures.

A decade ago, cyber policies were written largely on gut feel, with minimal underwriting rigor and enormous variation in terms and conditions. Loss experience was thin and actuarial models were immature. The market responded — with a mix of heavy losses and rapid innovation — by developing more sophisticated risk assessment frameworks, standardized questionnaires, and clearer coverage language.

The cyber underwriters operating effectively today are using technical security assessments, third-party scanning data, and incident response track records to price risk in ways that were not possible even five years ago. The line still carries significant uncertainty, but the underwriting discipline has improved dramatically.

Other emerging risk classes — climate liability, AI liability, supply chain disruption — are at earlier stages of the same maturation curve. The cyber experience suggests that rigorous data collection and strong collaboration between underwriters and risk engineers speeds that maturation considerably.