The problem is the risk landscape is shifting under the policies. 5 years ago, ransoms were 100 K$ on the high end. Now they are 10 M$. The number of ransomware

The problem is the risk landscape is shifting under the policies. 5 years ago, ransoms were 100 K$ on the high end. Now they are 10 M$. The number of ransomware attacks per year has been tripling(!) year over year for the last few years. So, compared to five years ago, the probability of a claim against a policy increased by 30,000%. Every single policy written 5 years ago is underwater and every single policy with a large coverage amount is so hilariously underwater that there is a good chance that they will ruin the insurer and all of their re-insurers. For instance, the courts recently ruled in favor of Merck for a 1.4 G$ claim due to the 2017 NotPetya cyberattack [1]. That alone was more than the premiums of the entire worldwide cybersecurity insurance industry in 2015 [2]. It is to the point where, from what I have heard recently, the cybersecurity insurance vendors have largely given up writing new policies with more than a few million dollars worth of coverage. They want to stay in the business so they are ready when the risk landscape stabilizes, but profitable policies need the premiums to be tens to hundreds of times higher than the standard backward looking actuarial models would suggest. So, if your competitors are dumber than you are, they will give policies with ridiculously lower premiums, not realizing they are going to be bankrupt in a few years. The only way to write a competitive policy in that environment is to take a loss, but limit the coverage to bound the loss to something survivable. Then you hunker down until the risk landscape stabilizes and everybody writing dumb big policies dies allowing you to write new policies with correct, vastly higher, premiums. [1] https://www.securityweek.com/court-rules-in-favor-of-merck-in-1-4-billion-insurance-claim-over-notpetya-cyberattack/ https://www.securityweek.com/court-rules-in-favor-of-merck-i... [2] https://content.naic.org/sites/default/files/cmte-c-cyber-supplement-report-2022-for-data-year-2021.pdf https://content.naic.org/sites/default/files/cmte-c-cyber-su...