Why Cyber Insurance Premiums Are Rising and What LA Companies Can Do

US cyber insurance rates fell 2% in the second quarter of 2026, yet plenty of LA renewals still went up. Your premium tracks your own risk, including claims, remote access, website tracking lawsuits, and coverage quietly trimmed through sublimits.

Say your broker's renewal email lands with a 15% increase on it. The same week, you read that cyber insurance has been getting cheaper for three years. Both can be true. Marsh's Global Insurance Market Index shows US cyber rates down 2% in Q2 2026, and cyber insurance premiums rising for Los Angeles companies anyway is one of the more common renewal surprises of the year.

Marsh's figure is an average across every policy a carrier writes. Your number is a judgment about you. Whether you already run managed cybersecurity in Los Angeles or you're still deciding, that gap is where the money sits. Underwriters quit pricing the industry a while ago. They price the applicant now, and a few things about doing business in California push the applicant's number up.

Are cyber insurance premiums actually rising in 2026?

Not on average. US cyber rates have dropped every quarter since Q2 2023, and total US cyber premium fell 7% in 2024, the first decline on record. Individual renewals are a different story.

Regulators' numbers point the same way. The NAIC's 2025 cyber insurance report put US direct written premium at about $9.14 billion for 2024, down from $9.84 billion the year before. In the same year, the number of claims rose almost 40%, to nearly 50,000.

Premium shrank while claims grew. No carrier runs like that for long.

So where do the "premiums are skyrocketing" headlines come from? Partly from 2021 and 2022, when renewals really did jump by half or more. Partly from forecasts like S&P Global Ratings' November 2024 outlook, which expected global cyber premiums to grow 15% to 20% a year toward $23 billion by the end of 2026. That's total premium volume. More buyers, not higher prices. And it was written before the price correction showed up in the data. AM Best counted US premiums down 2.3% in 2024, with some large companies moving risk into captives, which are insurance companies they own themselves.

Marsh now describes the declines as slowing and moving toward stable pricing. If someone tells you rates are soaring, ask which year they're quoting.

Why did your renewal go up when the market went down?

Because your premium is three numbers stacked on top of each other. One is the market rate. One is how much coverage the policy actually gives you. One is a charge for your own risk. Only the first is falling everywhere.

Marsh measures the market rate. On a $6,000 policy, a 2% drop is $120. You won't feel it.

Coverage moves more quietly. A carrier can hold your premium flat and cap ransomware at $250,000 inside a $1 million policy, or exclude a type of loss that was covered last year. A sublimit is a smaller ceiling for one kind of claim inside your overall limit. Same price, less policy. That's a price increase with better manners.

Then there's you. Your industry, your revenue, any paid claim in the last few years, and every answer on the application. At-Bay found ransomware hit manufacturers at 2.2 times its portfolio average last year, so a Vernon distributor and a Century City law firm can buy the same $1 million limit and get very different quotes. One wrong answer on the application can give a carrier grounds to deny the claim or rescind the policy, which is worse than any premium.

Two of those three numbers are yours to move.

Which claims are pushing prices up for smaller businesses?

Ransomware getting more expensive, attackers coming in through remote access, and wire fraud that starts in someone's inbox. Those three show up in the 2026 claims reports from At-Bay, Coalition, and Chubb.

At-Bay's 2026 InsurSec Report, built on more than 100,000 policy years, found overall claim frequency up 7% and average claim severity at an all-time high of $221,000. Companies under $25 million in revenue had it worse on ransomware. Frequency rose 21% and the average claim jumped 40%, to $422,000. Remote access services were the way in for 87% of ransomware claims, and VPN compromises accounted for 73% of the intrusions where At-Bay could identify the entry point. A VPN is the login page your staff use to reach the office network from home. One in three ransomware claims involved a SonicWall device. Check yours. SonicWall is a firewall brand you'll find in a lot of small offices. Our comparison of SASE, SD-WAN, and VPN covers the replacement options if yours is one of them.

Email didn't produce a single ransomware claim in At-Bay's book last year. It did produce 82% of the funds transfer fraud, where an attacker talks your team into wiring money to the wrong account, and the average stolen amount hit $285,000. Coalition's 2026 Cyber Claims Report puts business email compromise and funds transfer fraud together at 58% of the incidents it handled, with ransomware still the costliest claim at an average of $269,000.

Carriers don't agree on everything. That matters to you. Chubb's 2026 claims report shows average severity for small businesses falling to about $142,000 while middle-market claims climbed to about $759,000. Coalition saw its average severity drop 19%. Each carrier prices from its own book of claims, which is why two quotes for the same company can come back far apart and why a broker who shops your policy around actually earns the commission. The real cost of a ransomware attack goes past the claim check into downtime and recovery.

What's different about buying cyber insurance in California?

California adds three pressures most states don't. It has the country's largest pile of reported wire fraud losses, a 1967 wiretapping law now aimed at website tracking tools, and a 30-day clock for breach notices.

Wire fraud volume

California filed more cybercrime complaints than any other state in 2025, according to the FBI's IC3 state data, with 116,414 complaints and $3.67 billion in reported losses. Business email compromise alone cost Californians $430.7 million across 3,444 complaints, roughly 14% of the national total. A carrier that writes a lot of California businesses is paying a lot of California wire fraud claims, and it shows up in how hard the application presses on payment controls. Expect pointed questions. If your team approves wires by replying to an email, email security is the first place to look.

Website tracking lawsuits

Nobody budgets for this one. The California Invasion of Privacy Act, or CIPA, was written for phone taps. Plaintiffs' lawyers now use it against business websites that load tracking tools like the Meta Pixel, TikTok's pixel, chat widgets, or session replay software before a visitor agrees to it. Loeb & Loeb's April 2026 analysis notes the statute allows damages of up to $5,000 per violation, and the newer cases turn on whether tracking fired in the milliseconds before the consent banner even loaded.

Insurers' own numbers are blunt. At-Bay says CIPA lawsuits went from 7% of its third-party liability claims in 2023 to 34% in 2025, while those liability claims overall rose 70%, and 69% of the 2025 cases involved something other than the Meta Pixel. Coalition's researchers say about 70% of the wrongful collection claims it has seen since 2023 tie back to CIPA, and that insurers are splitting three ways, excluding it, staying silent, or covering it only if you meet privacy conditions.

This isn't a firewall problem. It's your marketing site, and a tag your agency added in 2022 can be the most expensive line of code you own. Have your web developer and your lawyer check what fires before consent. Our overview of CCPA and CPRA covers the state privacy rules that sit next to it.

A faster breach clock

Since January 1, 2026, SB 446 has given businesses 30 calendar days to notify affected Californians after discovering a breach. The Attorney General's breach list logged 453 notices through October 16, 2026, against 444 by the same date in 2025. A shorter clock means forensics, lawyers, and mailing costs all land in the same month. A written incident response plan is how you hit 30 days without panicking.

The cost increase that doesn't show up on the premium line

Policy wording is where the squeeze went. Carriers are adding exclusions, shrinking sublimits, and raising retentions instead of raising prices, so a flat renewal can still buy less protection than last year's did.

Insurance Business reported in October 2026 that the soft market is hiding exactly this. Some carriers are adding widespread-event exclusions for outages at big cloud and software providers. Others are cutting back dependent business interruption coverage, the part that pays your lost income when a vendor you rely on goes down, or charging extra to put the full limit back. Megan North of Amwins put it plainly. "Outsourcing the function doesn't outsource the risk."

Business interruption is where the money is. At-Bay found it was triggered in 1 of every 3 ransomware claims, and those claims averaged $510,000 against $168,000 for ransomware claims without it. That's the coverage getting trimmed.

Retentions deserve a look too. A retention is the deductible, the amount you pay before the policy pays anything. Raising it from $25,000 to $50,000 can keep your premium flat on paper while moving $25,000 of risk back onto your balance sheet. On paper, nothing changed.

Pull last year's declarations page, the summary sheet listing your limits and sublimits, and this year's, and lay the sublimit schedules side by side. Does your company depend on Microsoft 365, a cloud ERP, a payroll processor, or a managed IT provider? Then dependent business interruption isn't a line to skim, and neither is how you vet those vendors. Our guide to a third-party risk management program walks through that part.

What should an LA company fix before its next renewal?

Give yourself 90 days. Fix what the claims data says carriers are afraid of, keep proof the controls were on, and read the exclusions before signing.

MFA, or multi-factor authentication, means a code or phone prompt on top of the password. Carriers ask about it before anything else. Our cyber insurance requirements checklist goes control by control, with what counts as proof for each one.

Two habits pay off even outside the renewal. Report wire fraud fast. Speed matters more than people expect. In At-Bay's data, victims who reported within 3 days got some money back 70% of the time. Wait 4 to 14 days and it dropped to 53%. After that, under 30%. Keep an evidence folder going all year, too. Screenshots, restore dates, training records. Then the application takes an afternoon.

You may not need anyone this cycle. Renewal came back flat, no claims, and you can prove MFA, monitoring, and backups were running? Read the sublimits and get on with your week.

Does managed cybersecurity actually move the number?

Sometimes. Not as often as a sales deck would have you think. Carriers don't publish a set discount for hiring a security provider, and MFA and endpoint protection (security software on each laptop and server) now just get you in the door. What changes the quote is proof.

Tools don't equal protection. Underwriters know it. A security product nobody watches at night doesn't help when an attacker logs in through the VPN on a Saturday. At-Bay found that every victim of the Akira ransomware group that avoided encryption had 24/7 managed detection and response in place, meaning an outside team watching around the clock with the authority to cut off an infected machine. Two-thirds of those attacks landed at night or on weekends. Adam Tyra, At-Bay's CISO for Customers, told Help Net Security, "Our data shows that there is no close substitute for professional security monitoring via MDR."

Where a provider earns its keep at renewal is the paperwork underwriters now demand, like enforcement reports, alert logs, and restore test dates, plus honest answers on the application so a claim doesn't get denied over a box someone checked from memory. That's part of what Consilien's managed cybersecurity services cover for businesses nationwide. Compliance work like NIST, CMMC, or SOC 2 is a separate engagement, not part of managed IT.

Not sure which of your answers would hold up? A cybersecurity assessment maps the gaps before the carrier does, or you can speak to a cybersecurity expert with your renewal quote in hand.