“Insurance companies’ reliance on technology to manage daily operations has outpaced their ability to secure it. Cyber risks don’t stop at the first layer of defense — they extend deep into the supply chain, where vulnerabilities are harder to detect and even harder to mitigate,” said Andrew Correll, senior director of cyber insurability. “Addressing these risks requires a shift in how the industry prioritizes third-party security.”

Other key takeaways…

• Insurance carriers were disproportionately affected by third-party breaches. Although carriers made up about 27% of the total sample, they represented 50% of the companies hit by third-party incidents.
• Third-party software and IT caused 50% of the breaches, while cross-industry software and IT accounted for 37% and insurance-specific IT comprised 13%.
• More than half (56%) of companies had at least one compromised credential in the past two years.
• Malware infections and device compromises affected 17% of companies last year.
• The lowest-scoring cyber risk factors for the sector are application security, DNS health and network security. DNS health rarely ranks among these factors.

Related: Not again? Change Healthcare reportedly targeted in a 2nd cyberattack

The global insurtech market peaked at roughly $27.8 billion in 2024 and could reach as high as $239.2 billion by 2033. In the U.S., the sector reached $9.2 billion in 2024 at a compound annual growth rate of 25.3%.

Meanwhile, the cyber insurance market peaked at roughly $17.77 billion in 2024 and is projected to reach $21.67 billion in 2025 at a compound annual growth rate (CAGR) of 22%.

“The cyber insurance market is ever changing with new insurance companies entering the market and others departing,” said Arthur Armstrong, a partner in Reed Smith’s insurance recovery group.

“Likewise, policy forms are continuously evolving to address new and different cyber risks,” he added. “Unfortunately, this has led to more exclusions and sublimits that negatively affect cyber coverage overall.A policyholder should work with an experienced broker to ensure that it is obtaining appropriate coverage with respect to scope and available policy limits.”