Cyber Insurance in 2026: Why Ransom Payments Are Down 44% but Claims Are Up 40%

Cowbell's 2026 claims report is the most concrete public data point behind the payments-down, claims-up framing, and it is worth being precise about what each number measures, because they are not measuring the same thing.

Claims volume rose approximately 40% year over year. That is a frequency number: more policyholders filed more claims. Separately, Cowbell reports that its average ransom payment amount fell approximately 44%, and that proactive negotiation reduced initial ransom demands by an average of 65% before any payment was made. That is a severity number on the ransomware subset of claims specifically, not a statement about overall claims payouts across the whole book.

Ransomware and extortion together made up roughly 18 to 19% of total claims from 2022 through 2025 in Cowbell's data, with data breaches (around 33.5%) and other cybercrime (around 31.8%) making up the larger share of claims volume. That matters for interpreting the headline: the 40% rise in claims is a whole-book trend across breach, cybercrime, and extortion claims combined, while the 44% payment reduction is specific to the ransomware slice of that book. The two trends are related but they are not the same measurement applied to the same population of incidents, and conflating them overstates how directly comparable the figures are.

A separate insurer data point adds useful contrast: Coalition has reported claims frequency actually decreasing for its own policyholder base, which it attributes to the effect of pairing required security controls with coverage. That is not inconsistent with Cowbell's rising frequency figure. Different insurers underwrite different segments of the market with different control requirements, and a book with stricter controls at binding can show a different frequency trend than a book with looser requirements. The market is not moving as a single uniform trend line.

The 44% drop in average ransom payment is not primarily a story about victims refusing to pay. It is a story about the payment process itself becoming more disciplined. Insurers with dedicated incident response panels now routinely bring in professional ransomware negotiators before any payment decision is made, and Cowbell attributes an average 65% reduction in initial demand to that negotiation step alone. A ransom demand is an opening position set by the attacker with no visibility into the victim's actual backup posture, cyber insurance coverage limits, or willingness to walk away. A negotiator who can credibly demonstrate recoverability, or who simply has the experience to recognize an inflated demand, routinely brings that number down substantially before a check is ever considered.

Faster claims handling compounds this. The longer a ransomware incident drags on without a clear resolution path, the more leverage shifts toward the attacker, because downtime costs keep accumulating on the victim's side. Insurers that can mobilize forensics, legal, and negotiation resources within hours rather than days shrink that leverage window, which shows up directly in the eventual payment amount.

The practical implication for a security team is not that you no longer need backups or endpoint controls because insurers will just negotiate the ransom down. It is that your insurer's incident response panel and your organization's own recovery capability are now working the same problem from two directions, and your program should be built so both actually apply when an incident happens, not just on paper in the policy documents.

The clearest lever a victim organization controls directly is whether paying a ransom is even necessary. An organization with immutable, tested, offline-capable backups and a rehearsed restoration process can decline to pay in scenarios where a less prepared organization would have no real alternative. This does not show up as a single number in the claims data, but it is consistent with the broader shift toward faster resolution and lower average payments: every incident where recovery from backup replaces a ransom payment removes a full-price payment from the average entirely, rather than just negotiating an existing payment down.

This is also where the claims-up trend and the payments-down trend connect rather than contradict each other. An organization can still file a claim (for incident response costs, business interruption, forensics, legal, and notification expenses) without a ransom payment being part of that claim at all. Rising claims frequency alongside falling ransom payment amounts is consistent with more organizations experiencing an incident that triggers coverage, while fewer of those incidents actually require paying an attacker to get data back.

The rising claims frequency side of the split has a straightforward driver: the cost and skill required to launch a ransomware attack keep falling. Ransomware-as-a-service and affiliate models let operators with limited technical sophistication rent access to functional ransomware, initial-access broker services, and negotiation playbooks, and CFC's 2026 market analysis identifies this lowered barrier to entry as a direct contributor to rising attack volume. More attackers attempting more intrusions, even at a lower average sophistication per attempt, produces more claims. This is a volume story, not a severity story, and it is a big part of why claims frequency can rise even as the security posture of individual defended organizations, on average, improves.

CFC's analysis also points to a parallel shift in attacker tactics that plays into the payments-down trend: a move toward data-only extortion, where attackers skip encryption entirely and instead threaten to leak stolen data. Skipping encryption is cheaper and faster for the attacker to execute, and it also sidesteps a defended organization's backup and recovery controls, since there is no encrypted system to restore from backup in the first place. Whether this shift lowers or raises average payment amounts depends heavily on the specific data stolen and the victim's exposure to regulatory or contractual consequences from a leak, so it cuts in more than one direction, but it is a documented change in how claims materialize and it should factor into how a team thinks about which controls matter for which attack pattern.

The most directly actionable mechanism for a practitioner is the one CFC is most explicit about: insurers are increasingly treating specific security controls as a precondition for coverage rather than a factor that simply adjusts premium. CFC's 2026 analysis describes three distinct outcomes for an applicant that cannot demonstrate required controls: outright denial of coverage, exclusion of specific incident types from the policy (ransomware being the most common exclusion target), or, worst of all, denial at claim time on grounds of material misrepresentation about the organization's actual security posture at binding.

That third outcome deserves its own emphasis, because it is where a program's risk-transfer strategy can fail silently. An organization that represents MFA as universally enforced, or backups as tested and immutable, at the time it applies for coverage, and then experiences an incident that reveals those controls were not actually in place as described, can have a claim denied specifically because of that gap between the application and the reality, independent of the underlying incident itself. A policy that looks fully bound on paper provides no actual risk transfer if the controls backing that binding do not hold up under claim-time scrutiny.

This is consistent with what insurers are asking for at renewal generally. Phishing-resistant MFA on remote access and privileged accounts, EDR with active monitoring rather than a license sitting unused, tested and immutable backups with documented restoration exercises, and formal incident response retainers are now closer to baseline requirements than differentiators for a growing share of the market. For a full walkthrough of what underwriters typically ask for at application and renewal, see our cyber insurance requirements checklist. For what actually happens operationally once a ransomware incident triggers a claim, including where negotiation and claims handling fit into the timeline described above, see our guide on the ransomware cyber insurance claim process.

The 2026 data supports a specific reframing of how to think about cyber insurance, rather than a simple verdict for or against it. Insurance is not becoming less useful. Claims frequency rising 40% means more organizations are actually using their coverage, and the mechanisms above show that the payout side of that coverage is being managed more effectively than in prior years through negotiation and faster response. But the market's own behavior is telling you where the coverage boundary actually sits: increasingly, on whether your controls are real and demonstrable, not just represented on an application form.

That changes the calculus for where to put security budget relative to insurance premium. A control investment that both reduces the likelihood of a claim-triggering incident and satisfies an insurer's binding requirement is doing double duty: it lowers your actual risk and it protects your ability to collect if something happens anyway. A control gap that would trigger a coverage exclusion or a material-misrepresentation denial is not a risk your insurance is actually transferring, no matter what the policy schedule says, so closing that specific gap should usually outrank incremental limit increases on the same policy.

Concretely, before your next renewal conversation: ask your broker exactly which controls are binding conditions versus rating factors on your specific policy, ask what your insurer's incident response panel and negotiation process actually looks like in practice (not just what the policy language says it provides), and confirm that whatever you represented about MFA, EDR, and backup posture at application time is still true today, since that representation is what a claim-time review will be measured against.