Cyber Claims Frequency Rises but Severity Falls as Businesses Improve Defensive Posture

Why It Matters

The shift signals that stronger cyber defenses are curbing loss severity, but attackers are targeting more organizations, reshaping underwriting risk and prompting insurers to refine pricing and coverage models.

Key Takeaways

• Claim frequency hit 1.54% in 2025, severity fell 19%
• BEC accounts for 31% of claims, average loss $27k
• Ransomware demands average $1M, 86% victims refuse payment
• Companies >$100M revenue see 5.7% claim frequency, five times smaller firms
• Privacy violations increasingly tied to California Invasion of Privacy Act

Pulse Analysis

The 2026 Coalition Cyber Claims Report highlights a paradox for cyber risk managers: attacks are happening more often, yet the financial hit per incident is shrinking. Improved security hygiene, rapid incident response, and better recovery processes helped drive a 19% dip in average claim size to $116,000. At the same time, the overall claims rate climbed to 1.54%, reflecting broader adoption of digital channels and a larger attack surface across more than 100,000 policyholders in five countries.

Email‑based scams remain the workhorse of cyber loss, with business email compromise (BEC) and funds‑transfer fraud (FTF) accounting for 58% of all claims. BEC frequency rose 15% year‑over‑year, but its average loss fell 28% to $27,000, suggesting that organizations are catching these schemes earlier. Ransomware, while representing only 21% of claims, continues to drive the highest payouts, with average demands exceeding $1 million and dual‑extortion tactics inflating losses to $299,000. Notably, 86% of ransomware victims declined to pay, and negotiators trimmed demands by 65%, underscoring the growing effectiveness of response strategies.

For insurers and corporate risk officers, the data underscores a nuanced underwriting landscape. Companies with revenues above $100 million experience a 5.7% claim frequency—nearly five times that of sub‑$25 million firms—yet their average loss fell 7% to $268,000, reflecting scale‑driven resilience. Industry variations are stark: materials firms see the highest claim frequency, while financial services enjoy the lowest average loss at $64,000 due to mature cyber programs. The report also flags rising legal exposure, with 72% of privacy‑rights violations linked to the California Invasion of Privacy Act, signaling a need for tighter data‑privacy controls. Insurers are likely to adjust premiums, embed more proactive risk‑mitigation clauses, and expand coverage for emerging privacy liabilities.