The state insurance regulators' annual cyber report says loss ratios may deteriorate if AI outpaces patching
Cybersecurity Dive reports that the National Association of Insurance Commissioners' 2026 report on the cybersecurity insurance market says "Total U.S. domestic cyber direct written business has nearly tripled since 2020", with Chubb, Beazley and St. Paul Travelers the largest writers by direct written premium. The average claim at businesses with at least $1 billion of annual revenue reached $4.4 million in 2025, double the 2024 figure and up 586% since 2021, while payout frequency fell to 10 claims per 100 policies from 15, which NAIC says "might suggest that improved underwriting selection and security controls may be reducing the number of incidents reaching a claim"; mid-market claims averaged $759,000, up 23% from $619,000, and claims at smaller firms averaged $142,000, down from $215,000. NAIC attributes the severity growth to "rising business interruption expenses and the growing cost of data breach and privacy-related litigation" and the frequency decline to underwriting and controls, while naming frontier AI models among the factors it says are "fueling a more dangerous cybersecurity environment". On AI it says "Cyber risk is evolving at the pace of machines" while remediation runs at human speed, and that "If AI democratizes offensive capability faster than defenders can patch, loss ratios may deteriorate", particularly for insureds on common software stacks; it calls supply-chain risk "the defining challenge of the current cycle" because "A single event or vulnerability can trigger correlated losses across many policyholders simultaneously."