NetDiligence® Releases Sixteenth Annual Cyber Claims Study

NetDiligence's 2026 Cyber Claims Study, covering 10,309 cyber-insurance claims from 2021-25, found ransomware demands reached a record $500 million and payments climbed to $90 million, including 59 payments of at least $10 million. Ransomware and business-email-compromise incidents affected nearly 64% of SME claims in 2025, while large enterprises—just 3% of claims—accounted for 56% of total incident costs. Large-company legal and regulatory expenses averaged more than $22 million per claim, with one settlement exceeding $500 million, underscoring escalating cyber-loss severity for insurers and corporate policyholders.

Analysis

The relevant listed exposure is cyber insurers, not EXPN: heavier tail severity raises required capital, attachment points, and reinsurance costs, favoring carriers with diversified commercial books and disciplined cyber underwriting (CB, WRB) over smaller specialty writers reliant on aggregate covers. Premium repricing can initially support written-premium growth, but the earnings risk emerges at renewal if claims inflation outpaces rate increases or reinsurers tighten capacity; that is a 1-3 month underwriting-market issue and a 6-18 month ROE issue.

The more investable second-order effect is that business-interruption severity shifts security budgets from point products toward platformized prevention, identity protection, backup/recovery, and incident-response services. CRWD and PANW benefit only if enterprise buyers translate loss awareness into incremental spend rather than merely reallocating existing budgets; identity and resilience vendors may capture a disproportionate share because they directly address operational downtime rather than only breach detection.

The reported loss extremes should not be extrapolated mechanically into carrier earnings: claims datasets can be skewed toward participating insurers and high-severity cases, while cyber policy limits, exclusions, coinsurance, and reinsurance materially cap retained losses. Consensus may overreact to headline ransom figures; the decisive data for insurers are renewal pricing, cyber loss ratios, aggregate-limit disclosures, and treaty terms, none of which are supplied here. EXPN has no clear near-term earnings linkage beyond indirect demand for identity/data tools, so this is not a standalone EXPN catalyst.

Key Decisions for Investors

• No directional EXPN trade: require evidence of incremental identity-security bookings or raised guidance before treating cyber-loss severity as an earnings catalyst; absent that, the sponsorship linkage is immaterial.
• Watch-list long CB versus short AIG over the next 1-3 months if quarterly disclosures show cyber rate increases holding above loss-cost inflation and CB reports stable commercial P&C combined-ratio guidance. Target a 5-8% relative move; exit if CB raises catastrophe/cyber reserve assumptions or reinsurance costs compress expected ROE.
• Use a 6-12 month basket overweight CRWD and PANW versus IGV only after earnings calls demonstrate security-budget expansion, not vendor consolidation alone. The thesis is strongest if net retention, platform-module adoption, and billings accelerate; falsify on flat security spending guidance or decelerating remaining performance obligations.
• Monitor WRB and RNR for cyber reinsurance pricing and aggregate-limit commentary at upcoming results. A disclosed increase in attachment points or reduced aggregate capacity is a positive pricing catalyst for primary carriers but a warning that retained-tail risk may be rising.