By Rushik Patel, Associate Director, EDME Insurance Brokers Ltd.
The cyber insurance market in India is going through a paradigm shift. What was a niche service, a post-event financial risk mitigation solution, is now being transformed into a dynamic, real-time risk management platform. This is being triggered by a combination of factors: a perfect storm of digital adoption, regulatory forces, the sophistication of cyber threats, and the realization by boards that cyber risk is a business risk, not an IT risk.
The cyber insurance market in India has been growing at a CAGR of 20% to 30% over the last few years. This growth is underpinned by India’s accelerating digital economy, regulatory frameworks such as the Digital Personal Data Protection (DPDP) Act and increasing awareness of cyber risks across sectors. Yet penetration remains below what the risk exposure suggests. At the same time, the risk environment is intensifying. India has experienced more than 2.04 million cybersecurity incidents in a year and hundreds of millions of attempted attacks every year.
The economic damage is also equally alarming, with the average cost of cyber incidents in India standing at USD 2.5 million per incident for large businesses. The growing threat and low insurance penetration are thus forcing a paradigm shift in how cyber insurance is offered, priced, and structured. Cyber insurance underwriting has traditionally been based on financial statements, simple IT security data, and risk scores. However, in today’s threat environment, this is no longer adequate. Cyber risk is constantly dynamic, and attack surfaces change every day. Threat actors keep adapting, and vulnerabilities are emerging in real-time. The insurance industry is now moving from static underwriting to continuous risk assessment, a business model that uses telemetry, threat intelligence, and external attack surface scans to make sense of the changing risk landscape.
This paradigm shift is thus changing three fundamental elements of cyber insurance:
Underwriting: Insurers are now increasingly relying on real-time security ratings, vulnerability scans, and behavioral data to determine risk. This allows underwriting decisions to reflect current cyber posture rather than historical controls.
Pricing: Premiums are gradually moving toward dynamic pricing models. Organisations with stronger cyber hygiene and active monitoring are rewarded with better pricing, while deteriorating risk profiles can trigger premium adjustments or coverage restrictions.
Risk Mitigation Services: Policies are increasingly bundled with continuous monitoring, incident response support, threat intelligence feeds, and employee awareness programs that is shifting cyber insurance from a reactive payout mechanism to a proactive resilience tool.
Regulatory developments are also accelerating the shift toward real-time risk. The DPDP Act and sector-specific cybersecurity guidelines are compelling organisations to implement continuous monitoring, breach detection, and incident reporting capabilities. Cyber insurance is increasingly being aligned with these regulatory requirements.
Moreover, claims experience is reshaping insurer behaviour. High claims ratios reportedly exceeding 150–200% for some insurers in recent years have forced them to tighten underwriting standards and invest in better risk visibility. This further reinforces the move toward real-time risk assessment.
New Entrant: AI
As businesses globally move promptly to embrace artificial intelligence (AI) in their daily operations, insurance ecosystem doesn’t wish to lag. The rapid adoption of artificial intelligence is creating significant challenges for commercial insurance. Artificial intelligence is transforming the cyber insurance market by creating new and complex risk types that do not fit into the traditional underwriting paradigm.
For the insurance industry, artificial intelligence broadens the range of potential cyber events from data theft and ransomware attacks to algorithmic failures, model drift, and “hallucinations” from generative artificial intelligence. These risks are hard to measure, and the potential systemic risk if widely used tools all fail at once is a concern. The insurance industry will have to improve underwriting guidelines, craft exclusionary language, and consider a specific artificial intelligence liability product.
For policyholders, the impact of AI is to make coverage more complex. While many expect coverage for AI-related failures to be included in existing cyber or professional liability policies, exclusions and definitional issues could create a gap.
For other parties, such as brokers, the issue is to align client expectations with market practice. For brokers, it means managing coverage gaps across multiple lines, while regulators and industry associations are likely to demand a standardized approach to AI risk. In any case, the cyber insurance market is being forced by AI down the same path as cyber risk: from silent coverage to exclusions and finally to affirmative, standalone products that address the distinct risks of AI.
The future of cyber insurance will be shaped by predictive analytics and real-time risk intelligence. Cyber insurers will rely more on AI, machine learning, and threat data to predict losses before they happen. For corporations, this means that cyber insurance will become a strategic asset, fully integrated with enterprise risk management, business continuity planning, and boardroom decision-making.
The challenge for brokers and insurers is to unlock the opportunity to add value outside of the insurance contract, to help customers prevent incidents from occurring in the first place, rather than just mitigating the aftermath.
Cyber insurance will play a vital role in India, where the rate of digital development is currently outstripping the level of maturity in cybersecurity. The coming decade will see cyber insurance develop from a safety net into a real-time risk partner.