3 CYBER CLAIMS TRENDS THAT INSURANCE PROFESSIONALS CAN’T AFFORD TO IGNORE

Insights into where your clients

may be vulnerable to a cyber event

By Rob Jones

Cyber risk is becoming more expensive, more interconnected, and harder for businesses to ignore. Analysts at Gartner project that global cybersecurity expenditures will climb 24% to $240 billion this year, but businesses face twice the likelihood of experiencing a cyber incident compared to five years ago, according to Check Point Research. This creates a paradox: Spending is rising, but businesses are not necessarily becoming more secure.

This disconnect should matter to insurance professionals. It tells us that more technology alone is not solving the problem. To break through, businesses need to understand how current cyber claims trends are changing and ensure that they are investing in the right measures to protect against today’s more sophisticated attacks.

Better preparedness, stronger controls, and a clearer understanding of how claims are changing can mean the difference between recovering quickly or suffering lasting financial damage.

For brokers, agents, and carriers, claims data offers one of the clearest views into where clients remain vulnerable. It also shows where the market is shifting. Three trends in Coalition’s 2025 cyber claims data stand out in particular, and each has important implications for how insurance professionals advise clients, assess controls, and help businesses build a more resilient, multi-layered defense.

1. Ransom demands rose, but more businesses are refusing to pay. Ransomware remains one of the costliest cyber threats in the market, but the story is no longer just about rising attacker demands. It is also about changing victim behavior.

In 2025, ransom demands increased 47% year over year. Threat actors escalated pressure during ransom negotiations, even going as far as to cite victims’ cyber insurance policies and argue that the targets can afford to pay. These tactics show the growing sophistication of the cybercrime ecosystem.

This manipulation aims to force businesses into a quick payout. However, the data shows that businesses are increasingly resisting attacks. Even though ransom demands increased, a record 86% of victims refused to pay. That figure signals something important for the insurance industry. Better preparation is changing outcomes.

With data backups and cyber incident response plans, more businesses are able to refuse ransom demands. They have options, including recovery protocols and access to professional negotiators and legal support, which puts them in a position of greater control. This demonstrates a significant improvement in organizational resilience and defenses.

Now, even when a victim considers paying, the attackers’ initial demand is rarely the final number. In 2025, professional negotiators cut demands by an average of 65%. These trends show increased leverage for victims.

Overall, there has been a growing shift from payment as the default option to a focus on preparation and prevention instead. For insurance professionals, the takeaway is straightforward: Resilience is not theoretical—it is measurable in claims outcomes.

This is also where the broker’s role becomes especially valuable. Clients often think of cyber insurance as a source of reimbursement after a loss. In reality, the strongest outcomes tend to arise when businesses pair coverage with preparation before a loss can occur.

The conversation should not be limited to whether a client has ransomware coverage. It should address whether the client has the operational readiness to avoid defaulting to payment.

2. Data theft now drives ransomware severity more than encryption alone. When it comes to ransomware severity, encryption is no longer the driving factor. In 2025, attacks involving both data encryption (locking systems) and data exfiltration (stealing data) accounted for 70% of all ransomware claims. Even more troublesome, these dual-extortion tactics doubled the costs of ransomware attacks, resulting in an average loss of $299,000.

Many businesses are aware of encryption as a tactic of ransomware attacks and may have resiliency measures already in place. So now, attackers are responding by leaning harder on data theft, which can still create legal, operational, and reputational damage even when organizations can restore systems from backups.

This is a critical point for insurance professionals advising clients. Many insureds have made progress on business continuity and recovery. Fewer have fully adjusted to the reality that data theft can create a second, and often more expensive, layer of loss. The result is that a client may feel operationally prepared but still be financially exposed.

The underlying access paths are also becoming clearer. Virtual private networks (VPNs) were the entry point in 59% of ransomware claims, and organizations with exposed VPN log-in panels were three to four times more likely to experience a cyber incident. Those numbers reinforce that cyber claims are often tied to very practical security decisions.

For brokers and underwriters, this trend highlights the value of focusing on controls that reduce attack surface, not just post-loss response. Moving away from exposed VPNs and toward zero-trust network architecture can materially reduce risk. More broadly, this is a reminder that cyber insurance works best when paired with active risk management. If claims are increasingly driven by preventable exposures, then the market must reward insureds that address them.