Why Your Cyber Renewal Doubled (and Your Broker Can't Tell You Why)

The renewal packet landed in the CFO's inbox on a Thursday in March, and the number didn't make sense. Last year: $28,400 for $5 million in cyber coverage. This year: $57,900. Same company, no claims, headcount flat, revenue up modestly. She called her broker. The broker called the underwriter. The underwriter said — and this is a direct quote relayed secondhand — "the book needed rate."

What book. What rate. The broker had no real answer, because brokers rarely do when cyber renewals spike. The opacity is structural, not personal.

The hard market never really ended

Cyber insurance had its reckoning in 2021 and 2022, when ransomware claims detonated the market. Renewal increases of 80 to 130 percent were common, per Marsh's quarterly pricing reports from that period. Carriers discovered that a line they'd been writing like a sleepy specialty product was actually a catastrophe line — correlated losses, simultaneous claims, attackers who adapted faster than underwriting manuals.

By late 2023 the market softened. New capacity flowed in, MGAs like Coalition and Corvus were hungry, and renewals flattened to single digits or even small decreases. Brokers declared the hard market over. CFOs exhaled. Then ransomware came back.

Coveware's quarterly ransomware data showed average ransom payments climbing back above $400,000 in 2025, with a particular surge in attacks on mid-market firms — the exact segment insurers had been courting with competitive pricing. The FBI's Internet Crime Complaint Center logged over $16 billion in reported cybercrime losses for 2024, a record. Carriers that had priced 2023 renewals assuming the worst was behind them found themselves paying claims like it never left.

Loss ratios are the number nobody publishes

Here is the figure that explains the $57,900 renewal: carrier loss ratios on cyber. AM Best's analysis of statutory filings has shown cyber direct loss ratios swinging violently — from the high 60s and low 70s percent during the worst ransomware quarters, down to the 40s during the soft interlude, and climbing again through 2025. A loss ratio in the high 60s leaves almost nothing after expenses; cyber's expense ratios run another 30 to 35 percent. A combined ratio over 100 means the carrier is losing money on every policy it writes. Several major carriers — Chubb, AIG, Travelers — have publicly tightened cyber appetite in earnings calls over the past two years, shrinking capacity in the segments where losses concentrate.

When a carrier's cyber book is running at a 105 combined ratio, "the book needed rate" is not a dodge. It is the literal truth. The carrier is repricing to stay solvent.

Renewal underwriting is a black box by design

But here's the part that infuriates buyers, and rightly so: the repricing is not calibrated to your risk. It is calibrated to the carrier's portfolio. Your clean loss history, your MFA rollout, your incident response retainer — all of it gets steamrolled when the underwriter's mandate is a portfolio-wide 25 percent rate increase. Beazley's 2025 market commentary acknowledged this dynamic explicitly: renewal underwriting in cyber remains heavily portfolio-driven, with individual risk differentiation playing a smaller role than buyers assume.

Worse, the information asymmetry runs one way. The carrier knows its loss ratio by segment, its reinsurance costs (which spiked after reinsurers like Munich Re and Swiss Re repriced cyber treaties), and its forward claims pipeline. The buyer knows none of it. The broker, caught in the middle, knows slightly more than the buyer and considerably less than the carrier. So the broker says "the book needed rate" and the CFO pays double, because the alternative — going bare in a year when the average data-breach cost hit $4.44 million, per IBM's 2025 Cost of a Data Breach Report — is unthinkable.

The uncomfortable counterpoint

Is the carrier the villain here? Not entirely. The honest version of the story includes the fact that cyber insurance was chronically underpriced for a decade. Buyers got a bargain while attackers matured from hobbyists to industrialized ransomware operations with customer-service desks and affiliate programs. The 2021–2022 repricing was a correction to reality, and the current one is arguably the same: carriers charging what the risk actually costs.

The real problem isn't the price. It's the opacity. A CFO can budget for a 40 percent increase if she understands the drivers — ransomware frequency up, reinsurance up, her segment's loss ratio at 68. What she cannot do is plan around a black box that might deliver 5 percent or 100 percent with no explanation. Markets function on information. Cyber insurance renewals currently function on the absence of it.

That absence is the opening. Somewhere out there is a publisher building the rate-transparency layer this market has never had — real benchmarks, real renewal data, real explanations. When it exists, the broker's shrug stops being acceptable. Until then, expect the Thursday-afternoon packet to keep landing, and expect the number inside to keep not making sense.