US Cyber Reinsurance Rates Drop 32% at April 2026 Renewals: What Actuaries Need to Know

Gallagher Re's April 2026 renewal report put US non-proportional cyber reinsurance rates down 32% on a risk-adjusted basis, the largest single-renewal move the line has recorded. It follows a decline of up to 25% at the January 1 renewal.

Primary cyber rates over the same window are flat to slightly negative. That gap, between what cedants pay reinsurers and what insureds pay cedants, is where the next two accident years of margin get decided.

Key Takeaways

32% risk-adjusted decline at April 1 on Gallagher Re's cyber aggregate excess-of-loss RAR index, on top of a fall of up to 25% at January 1, with primary rates flat to slightly negative over the same period.
Attachment points came down with price. The effective risk-adjusted cost per unit of coverage fell further than the headline, and quota share treaties renewed with ceding commissions roughly 1% above prior year.
Loss ratios of 40% to 50% through 2024 and a US cyber combined ratio near 73% for 2023 are the backward-looking figures that 2026 pricing rests on, alongside roughly $9 billion of cumulative underwriting profit across 2022-2024.
A 39% average cession rate through the Q1 renewals, barely off 40% in 2025, means cedants bought the same share of protection for materially less money rather than cutting reinsurance spend.
SME penetration of 10-20% is the growth vector the market is counting on, and the one segment whose loss experience large-corporate benchmarks do not describe.

What the RAR Index Is Actually Measuring

Gallagher Re's Risk Adjusted Rating index is the closest thing cyber reinsurance has to a standardized benchmark. It tracks rate movement on US non-proportional covers after adjusting for exposure, attachment, and portfolio composition, which is why the April reading is not simply a price cut.

Three things moved at once. Reinsurers reduced price, lowered attachment points, and broadened event definitions to win placements. Cedants secured attachments at a lower loss threshold, so reinsurers took on risk the 32% figure does not capture. On the proportional side, quota share treaties renewed with ceding commissions approximately 1% higher than prior year.

The supply side explains the direction. Reinsurance capital reached $785 billion by early 2026, with industry surplus surpassing $1 trillion, and new cyber MGAs, Lloyd's syndicates, and dedicated insurer teams have launched into a line with a short profitable history. Reinsurance News reported the same renewal produced a surge in bespoke structures rather than standard treaty programs.

Demand did not move with it. Average market cession rates stood at 39% through the Q1 renewals, down from 40% in 2025. Cedants are buying roughly the same share of protection for materially less money, which is the textbook buyer's market. S&P Global Ratings projects global cyber premium near $23 billion in 2026 on 15% to 20% annual growth.

A 32% Cut Against a 40% to 50% Loss Ratio

The pricing question is what margin survives the cut. Cyber loss ratios ran between 40% and 50% through 2024, the US cyber combined ratio was approximately 73% for 2023, and Beazley reported a 48.5% loss ratio through the first half of 2025. Those figures priced 2022-2024 vintage business, not 2026 vintage business.

For a primary carrier the arithmetic is favourable in the short run. Renewing an excess-of-loss program at 32% less while holding primary rates flat widens the net margin on the ceded portion of the book. That is a gift from the reinsurance cycle, not an improvement in the underlying risk, and it reverses when the cycle does.

For the reinsurer the same 32% comes off a line already running at a 40% to 50% loss ratio before expenses and brokerage. If the 2024 loss ratio of 49% is a floor rather than a ceiling, 2026 pricing is inadequate within two accident years. WTW noted in February 2026 that a material shift to a hard market is not yet observable, while flagging severe ransomware and systemic events as the swing factor.

Reserving inherits the same problem in a harder form. Cyber is short-tail by P&C standards, with most claims reported and settled within 12 to 24 months, so inadequacy surfaces fast. But the credible history is 8 to 10 years, much of it from the 2020-2022 hard cycle, and the frequency and severity trends now point in opposite directions.

Ransomware payment rates fell to 28-32% of incidents in 2025 from 37% in 2024, while paid amounts and business interruption durations rose. A reserving framework weighting that frequency improvement more heavily than the severity trend will understate ultimate. The pattern is the one commercial auto and general liability ran through in prior cycles, where reported profitability peaked immediately before the turn.

The Growth Vector Is the Least-Measured Segment

What sustains premium volume through a 32% rate decline is expansion into small and medium enterprises, and the penetration gap there is the largest in the market.

Segment	Revenue Range	Estimated Penetration
Large corporations	$1B+ revenue	60-70%
Mid-market	$100M-$1B revenue	40-50%
SMEs	$10M-$100M revenue	10-20%
Micro businesses	Below $10M revenue	5-10%

Munich Re and CRC Group both identify SME take-up as the primary growth vector. Moving SMEs from 10-20% toward the 40-50% range seen in mid-market accounts would add enough premium to offset rate declines and widen the aggregate pool.

It would also change what is in the pool. Smaller businesses carry weaker security controls, thinner incident response capability, and proportionally larger business interruption exposure. The 40% to 50% loss ratio benchmark was earned on large-corporate portfolios with dedicated security operations. The American Academy of Actuaries made the same point in its January 2026 Contingencies article, noting that loss ratio stability at the 40-50% average sits on top of significant variation by segment.

Sitting behind both is a coverage question the renewal did not settle. The April 1 pricing was set after Operation Epic Fury began on February 28, 2026, and after Unit 42 identified the CL-STA-1128 cluster targeting industrial control systems, with roughly 60 hacktivist groups active around the conflict. Reinsurers are either discounting a systemic event or relying on war exclusions.

Attribution of state-affiliated attacks is difficult, and proxy attacks by hacktivist groups sit in the gray zone between covered criminal activity and excluded acts of war. The Stryker wiperware incident already put US contract war exclusions in question, and CyberCube has flagged financials and healthcare as the concentrations where an outage causes the most operational friction. A dispute over exclusion wording would reprice the line faster than any loss ratio.

US Cyber Reinsurance Rates Drop 32% at April 2026 Renewals: What Actuaries Need to Know

Key Takeaways

What the RAR Index Is Actually Measuring

A 32% Cut Against a 40% to 50% Loss Ratio

The Growth Vector Is the Least-Measured Segment

Further Reading on actuary.info

Sources