This is a significant stress test for the cyber insurance sector in India. Several cyberattacks on companies in India, including State Bank of India, Central Bank of India, Bharat Electronics, and hundreds of non-banking financial corporations (NBFCs), have led to the filing of cyber insurance claims. Losses are estimated in the thousands of crores over the next few months for the insurers.
Until now, cyber insurance was considered a luxury, a product that the CFO purchased at a conference or out of a very close shave. Things have changed. The events have raised questions as to whether the existing cyber insurance policies cover cyber risks. If you are running a company, handling customer data, or managing risks for a company, this directly impacts you.
This post will discuss what is happening, how it impacts you, and what needs to be checked in your insurance policy.
A Small Market Facing a Big Shock
In India, the cyber insurance industry is still in its infancy. Current estimates suggest that the market has annual premiums of approximately ₹1,000-1,500 crore. Globally, premiums were around $15 billion in 2025 and are projected to reach around $30 billion by 2030. In India, it is estimated that the market will be worth about $600 million more by 2030, as provided in the Global Cyber Risk & Insurance Survey 2026, conducted by Munich Re.
The figures seem to be insignificant in view of the scale of recent losses. After years of existence in the form of small premiums, the market has now been flooded with major claims from leading banks, a huge defence electronics company and hundreds of NBFCs (non-banking financial companies). The insurers are expected to react by raising premiums significantly, changing their underwriting rules and making the terms of offering more stringent, which will be felt by businesses pretty fast.
The Question That Keeps Insurers Awake: Who Pays When Everyone Is Hit at Once?
The key challenge faced by insurers and policyholders: who is liable when a single flaw puts hundreds of organisations at risk?
Insurance is based on the premise that everyone does not suffer losses at once. Fire insurers do not predict that all properties in a city will burn down in a single day. Cyber risks counter this premise. A bug in common software, a vendor attack, or a shared service provider can expose tens of companies simultaneously. This phenomenon is known by the industry as systemic risk or aggregation risk.
When there are hundreds of NBFCs hit by the same attack, the claims pile up and the financial capabilities of insurers are tested in a way that the few isolated claims never do. This is why concentration risk calculation is more critical for insurers today, and as a result, we can notice, for instance:
- Lower limits for some types of events such as mass attacks and supply chain attacks
- Higher deductibles for the cases related to the same weaknesses of the companies
- More questions regarding patching and vendor reliance
- More exclusions related to systemic issues.
What Cyber Insurance Typically Covers
Many companies are still unclear about their purchases. Cyber insurance is commonly utilized by companies to take care of expenses related to forensic audits, data breaches, computing interruptions, and losses incurred from ransomware attacks.
- Forensic audit and investigation: Experts will determine how the attackers gained access, what they managed to acquire, and whether they are still present.
- Data breach response: This consists of informing affected clients, consulting lawyers, and informing authorities.
- Business interruption: If your company’s system gets hacked, you will be able to recover the lost income and expenses you incurred during this process.
- Ransomware losses: Depending on the insurance policy you have, it may involve paying for damages, negotiating prices, and recovering data.
Policies vary widely, and those who are able to utilize all the fine print will end up with higher compensation.
Insurers Negotiating With Hackers
One of the interesting fact is that there are cases when insurance companies negotiate directly with hackers in order to find out whether the ransom should be paid or not, and the amount of payment.
This sounds like something strange at first glance, but from a business perspective, this decision is quite logical. As soon as it is clear that the ransom will be paid, then it is better to take control of the situation: check the claims made by the hackers, ensure that the decryption keys actually work and try to negotiate a smaller amount. Experienced specialists manage to get much lower ransoms than any frightened company could agree on.
It should be noted that paying the ransom is a morally and legally controversial issue. It can fuel the criminal activities of hackers, and in some situations it may violate the sanctions regime.
The AI Problem: Rogue Agents and Unclear Cover
Increased doubts surrounding sabotage attacks by means of rogue artificial intelligence agents is also discussed, as insurance providers are at odds with companies about the new methods of conducting AI attacks.
The policy definitions used a number of years ago discussed the attacks that were committed by humans that made use of malicious software and phishing techniques. Therefore, it did not cover AI agents that are capable of probing software systems, writing plausible social engineering messages, and acting on their own once released. Therefore, the questions arise:
- If a rogue AI agent is used by your organization and causes a data breach, is it a cyberattack, an operational failure, or an error in technology?
- If criminals start to employ AI means of committing attacks, should the policy be affected?
- What happens if an AI system from an external provider is responsible for the attack?
As the definitions evolve, cases are likely to remain disputed. In case your company is relying on AI, find out the position of your broker on the coverage.
Why Businesses Are Asking for Higher Limits
There seems to be a growing number of inquiries about the limits on policies. People are curious to know if their policies cover them sufficiently. An insurance limit that seemed adequate 2 years ago might not be enough considering the high expenses involved in litigation, compliance, notices to customers, and other costs associated with hours or weeks of work lost.
Here are a few points to ponder about your limit:
- Your profit margin and daily operational expenses: What’s the cost of an entire week without operating?
- The amount and sensitivity of your data: An increase in the number of records and sensitive data means bigger costs associated with notifications and liabilities.
- Your reliance on your suppliers: Can you operate if you lose a crucial supplier?
- Legal exposure: You might have reporting obligations and face penalties according to local regulations.
Increased limits mean increased expenditures; however, it is still nothing in comparison to what you would pay if a risk happened.
MSMEs Are Coming to the Table
MSMEs are increasingly looking for policy protection. Small companies believe that hackers will target big banks and large companies. But in reality, the smaller companies are vulnerable, as their security is weaker, and they act as connections in the supply chains of the bigger organizations.
An MSME does not have any kind of security staff, and there are no plans in place in case of any incident; therefore, ransomware can pose a huge threat to such businesses. There is much more to cyber insurance than just compensation. Many plans come with access to specialists in handling incidents and legal help and recovery services.
What To Do Now: A Practical Checklist
Study your policy, not merely its synopsis. Focus on exclusions, sub-limits, waiting periods, retentions and considerations regarding the adequacy of your security controls.
Inquire into systemic events. Determine what your policy does when the vulnerability impacting many other businesses is causing your loss. Look for widespread event limits and any exclusions in this regard.
Determine the scope of AI coverage. Explicitly ask whether incidents related to the usage of AI tools or attacks using AI technology are covered.
Review your limits. Re-examine your limit with respect to a plausible worst-case scenario.
Improve your security position. Many insurers are now underwriting and pricing based on controls, including two-factor authentication, regular software updates, tested backup, endpoint detection and training for your staff. Improved security is improved terms.
Create an incident response plan. You will need to determine whom to call, how to contact your insurer (most policies require notification) and how to inform your customers and regulators.
Understand your vendors. Understand which third parties are integral to your business and what happens if one of them fails.
The Bigger Picture
It should be noted that cyber insurance cannot substitute the need for cyber security. Because insurance companies have limited resources, they tend to challenge vague terms and ineffective systems when they notice that claims are being filed by a host of clients. As a result, insurance buyers will face stricter underwriting, unambiguous exclusions and stiff requirements for maintaining security standards.
The cyber insurance sector itself is developing rapidly. By 2030, the global insurance premium market is expected to reach $30 billion, while the Indian sector will grow from humble beginnings. The expected outcomes include more precise data, clearer definitions and improved risk models. The following months will show how the sector overcomes its first major test.
Final Thoughts
The recent attacks on significant Indian institutions serve as a warning sign for every kind of organization. Cyber risk is not a hypothetical threat anymore; so insurance has to be considered seriously. Review your insurance policy, ask the right questions regarding systemic risk and AI, make investments in security, and get ready for the attacks, which will come one day.
Frequently Asked Questions (FAQs)
What is cyber insurance?
Cyber insurance covers a business against financial repercussions resulting from a cyber attack. The policy includes forensics audit costs, data breaches, interruptions to the business, and ransomware attacks.
Why are insurers worried about the recent attacks?
Because there may be multiple victims of a single weakness, claims come in bulk instead of individually. The systemic risk puts pressure on insurance companies’ capital, hence the reason for stricter terms and increased premium rates.
Do insurers really negotiate with hackers?
In some situations, yes. The insurers may enter into direct negotiations with the attacker on whether a ransom must be paid and for what amount. However, this is the ultimate measure that should be taken when all other options fail.
Are attacks involving AI agents covered?
This will depend on your policy wording. Many insurance policies were not written when autonomous AI agents were nonexistent, so it is not clear whether coverage would be provided for such scenarios.
Do small businesses need cyber insurance?
Yes, since MSMEs are now becoming more vulnerable due to weak defenses and can be jeopardized through one malicious action, many of which offer legal and incident response services which MSMEs cannot afford otherwise.