---
title: Cyber Insurance May Be Making Ransomware Worse, Here's Why
description: Cyber insurance seems like a great way to mitigate the financial losses of a successful cyber attack. Unfortunately, cyber insurance policies may be making ransomware worse.
image: https://blog.morphisec.com/hubfs/Cyber%20Insurance%20Making%20Ransomware%20Worse.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Cyber Insurance May Be Making Ransomware Worse, Here's Why

Posted by [Matthew Delman](https://1534169.hs-sites.com/author/matthew-delman) on July 1, 2021

Find me on:

[LinkedIn](https://www.linkedin.com/in/matthewdelman/) [Twitter ](https://twitter.com/nerdymarketr)

- [Tweet](https://twitter.com/share)

Cybercriminals have pounced on the COVID-19 crisis, made clear by the number of ransomware attacks increasing by [at least 150 percent](https://www.helpnetsecurity.com/2021/03/08/ransomware-attacks-grew-2020/) in 2020. As a follow-on consequence, organizations have started purchasing cyber insurance policies to hedge against the financial risk of a successful cyber attack. 

![Cyber Insurance Making Ransomware Worse](https://www.morphisec.com/hubfs/Imported_Blog_Media/Cyber%20Insurance%20Making%20Ransomware%20Worse.png)

Between 2016 and 2020, the take-up rate for cyber insurance policies nearly doubled from [only 26 percent](https://www.gao.gov/products/gao-21-477) in 2016 to 47 percent in 2020. In 2021, thanks to ransomware’s continued explosive growth, the number of businesses looking for insurance against cyber threats is likely even higher. 

Ransomware is rapidly becoming the main reason organizations take out cyber insurance policies and, for that matter, put in cyber insurance claims. [Almost half](https://www.cyberscoop.com/ransomware-cyber-insurance-cost-beazley-coalition/) of all cyber insurance claims in the first half of 2020 were related to ransomware attacks, and the insurance provider AIG experienced [a 150 percent increase](https://kmph.com/news/local/ransomware-cyberattacks-could-cause-some-insurance-rates-to-rise) in ransom and extortion claims between 2018 and 2020. 

Because many insurance providers cover both the cost of recovery from a ransomware attack and the ransom payment itself (or at least some of it), insurance is undoubtedly an attractive idea for organizations that worry about the rising threat of ransomware. However, rather than helping organizations bounce back after a cyberattack, cyber insurance policies may actually be making them more susceptible to a ransomware attack in the first place. 

## Cyber Insurance Provides Less Protection, Not More

For business leaders, cyber insurance can seem like a sensible hedge against some of the financial pains that come with falling victim to a ransomware attack. However, this is a dangerous mindset to have. In many cases, organizations that take out cyber insurance policies are more at risk of a ransomware attack than those that don’t. 

In [an interview](https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/?__cf_chl_jschl_tk__=6f485a197b0b19792af8f95a4691178312d98690-1620416525-0-AWkAupScvFyY92vxbQUuwtLwXdkR2nxCixHjQHLA3IB0kK4Tfk37DZlgvDc2aKxB6Xqz-af_Xdn0T2wq0d1modohIcHJhTxJKkKORr3cXpfGo1inbqLOVJp11CZFRvZaZh-qOA5E3XUhPT_6-Zew96EvRBWsGG7J0wHYjDbvjLbriXaW5scMytuhJHt3F0o1G3DpgBfd2G_h_4IVr9nr7sgzdoiuyAg5oHWuFJAfhMh6TIdOj4tXXQsgBdXdSGEPpR9FA5zkCRrTZwSAb2n7LKlfUUzfyGhiyubRNb-gV0fjwhHc4eHE-8CN4ylB2dbqMZ3udX2_8VtDAV1DcZCndMT7ePBsT8S0PmUjysydd8OsWSBHh1K2Fpvk8EFogzy_17Zu71Kgy674paHl4mH6SdCpvYqJK1_7kAWyChstzEKAw5HryMJneXdfdSZFvEvz6-dG6SfiQRKbYyrOITXbe0Me8yUUVc0GSuwMwYFGmnZNB0wyOZblH2vD3EpwhNjsic5wHZ6bhMj0LnBJInTji2U) with the cyber intelligence news site “The Record” earlier this year, a member of the REvil ransomware group said that the group specifically goes after companies with cyber insurance. Tellingly, the anonymous cybercriminal described victims with insurance as “one of the tastiest morsels.” 

The ransomware operator also gave some insight into how insurance works in cybercriminals’ favor, stating that they (cybercriminals) typically “hack the insurers first—to get their customer base and work in a targeted way from there. And after you go through the list, then hit the insurer themselves.” 

For insurance companies, providing funds to pay a ransom is [usually far cheaper](https://www.zdnet.com/article/ransomware-cyber-insurance-payouts-are-adding-to-the-problem-warn-security-experts/) and quicker than helping a victimized organization restore its data from scratch. As a result, attacking companies that have taken out cyber insurance policies is almost always a safe bet. 

Even when cybercriminals don’t know that it’s the insurers paying their ransom demands, easy capitulation from victimized organizations gives cybercriminals the confidence to ask for more. As a result, cyber insurance perpetuates a negative cycle: the more organizations (or insurance providers) pay, the more threat actors attack and the higher ransom demands get.

[![The Comprehensive Checklist for Anti-Ransomware Assurance](https://no-cache.hubspot.com/cta/default/1534169/a600f860-690c-4b09-ae15-aa0365a110f7.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/a600f860-690c-4b09-ae15-aa0365a110f7)

 

## Cyber Insurance Is Getting More Expensive, Less Effective, and Harder to Find 

While the cyber insurance industry inadvertently drives the ransomware threat level higher, purchasing these policies is an increasingly elusive and expensive option for businesses. In response to more frequent cyberattacks, soaring ransom demands, and a growing appetite for cyber insurance, such companies are raising their premiums. 

In one survey, [more than half](https://www.ciab.com/resources/q4-p-c-market-survey-2020/) of insurance brokers reported premiums that went up by at least 10 percent, and in some cases by as much as 30 percent, in late 2020. Higher premiums apply to everyone, not just companies unlucky enough to be affected by ransomware. As a result, some smaller companies have had no choice but to [give up cyber insurance](https://www.reuters.com/business/ransomware-attacks-rise-even-cyber-insurers-scale-back-2020-12-16/).

In addition to rising premiums, coverage limits are also decreasing, especially for risky industry sectors like healthcare and education. Some providers now [sublimit ransomware](https://www.insurancebusinessmag.com/us/news/cyber/cyber-insurance-market-reacts-to-ransomware-epidemic-252394.aspx) so that the insured can only claim a fixed amount for all cyberattack costs, while others are also implementing co-insurance provisions that would require policyholders to pay anywhere from [20 percent to 30 percent](https://www.reuters.com/article/us-ransomware-insurance/insurers-look-to-curb-ransomware-exposure-as-u-s-cyber-rates-rise-idUSKBN1ZL1J2) of a ransomware claim. 

One major cyber insurance provider, French insurer AXA, recently decided to [stop reimbursing ransom payments](https://www.msspalert.com/cybersecurity-markets/europe/axa-drops-ransom-payment-coverage/#:~:text=European%20insurer%20AXA%20will%20no,ransomware%20payments%20after%20cyber%20attacks.&text=A%20leading%20European%20insurer%20said,retrieve%20stolen%20or%20locked%20data) altogether. Some experts predict that it is only a matter of time before other cyber insurance providers [follow suit](https://www.cyberscoop.com/axa-ransomware-cyber-insurance-policies/), likely to limit the payouts they have to make.

Whenever possible, insurers may also try to get out of paying insurance claims via loopholes in their policies. For example, after the NotPetya malware infected organizations globally, some insurers argued that they did not have to pay claims due to [war exclusions](https://carnegieendowment.org/2020/10/05/war-terrorism-and-catastrophe-in-cyber-insurance-understanding-and-reforming-exclusions-pub-82819#:~:text=The%20insurers%20argued%20that%20NotPetya,peace%20or%20war.%E2%80%9D42%20War) that were written into their policies. 

Other insurers, like Allianz, are also considering separating ransomware coverage from general cyber coverage because of the risk to their overall business. Cyber insurance providers that are not taking such drastic measures are making their underwriting guidelines stricter and spending more time scrutinizing organizations’ cybersecurity controls. 

Insurers have taken this avenue to ensure that their clients have taken appropriate precautions. This has already made filing a claim after a ransomware attack increasingly challenging, and it will only become even more so in the future.

For example, underwriters may [refuse to cover organizations](https://global.lockton.com/gb/en/news-insights/increasingly-severe-ransomware-claims-impact-the-cyber-insurance-market) that don’t use multi-factor authentication or those without specific categories of endpoint protection products. Highlighting the increasing due diligence insurance companies require from customers, the Zurich Insurance Group gives precedence to companies with network features that stop attacks from spreading through the system when considering who to underwrite.

 

## Cyber Insurance Is Not Sustainable, Proactive Defense Is

Cyber insurance can be valuable as a financial hedge for organizations with the ability to afford it, but the changes to the market as a result of the ransomware epidemic makes clear that it should be considered as *part* of a company’s overall security strategy. Ultimately, the cost of a cyber attack is rarely something that can be covered by any degree of insurance. [Almost half](https://www.securelink.com/blog/reputation-risks-how-cyberattacks-affect-consumer-perception/) of all organizations that experience a data breach also end up with severely damaged reputations, which is not something that any insurance policy can remedy. 

Instead of relying on something that should really be little more than a backstop, organizations that want to avoid a ransomware attack should instead adopt a proactive approach to ensuring their attack surface is minimized. This isn’t done through taking out a cyber insurance policy, but rather through adopting a proactive approach to preventing breaches.  

In addition to preparing backups, patching up vulnerabilities, and training employees on best cybersecurity practices, companies should look to invest in preventative cybersecurity tools, such as [Morphisec](https://www.morphisec.com/products/morphisec-guard-endpoint-protection). Leveraged with built-in Windows security features like [Defender AV](https://www.morphisec.com/morphisec-microsoft-defender-av), Morphisec will greatly reduce your organization’s risk exposure to ransomware — at a fraction of the cost of a cyber insurance policy. 

Cyber insurance is an important tool in the security tool belt because it, in theory, allows for organizations to recoup some of their financial losses incurred in the event of a successful cyberattack. What has become abundantly clear, however, is that these insurance policies should not be relied on as a compensating control to fully repair losses from a successful cyberattack. Instead, organizations need to adopt a proactive approach to security and harden critical systems against attack with a solution like Morphisec that makes breach prevention easy. 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/50832359-01e9-4911-98db-45bd66a69b90.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/50832359-01e9-4911-98db-45bd66a69b90)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/cyber-insurance-may-be-making-ransomware-worse-heres-why#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Matthew Delman",
    "url" : "https://1534169.hs-sites.com/author/matthew-delman"
  },
  "dateModified" : "2024-11-07T17:00:12.356Z",
  "datePublished" : "2021-07-01T18:08:21.000Z",
  "headline" : "Cyber Insurance May Be Making Ransomware Worse, Here's Why",
  "image" : [ "https://blog.morphisec.com/hubfs/Cyber%20Insurance%20Making%20Ransomware%20Worse.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/cyber-insurance-may-be-making-ransomware-worse-heres-why",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```