The key UK cyber insurance statistics in one place — how many businesses actually carry cover, how uptake varies by firm size, how much insurers are paying out in claims, and where pricing and the wider market are heading, with the data period stated next to every figure.
This page uses the government’s Cyber Security Breaches Survey for reported insurance uptake, the Association of British Insurers for its participating firms’ claims data, and Marsh’s client portfolio for claims and renewal pricing. These sources cover different populations and cannot be combined into a national loss ratio.
The figures describe insurance uptake, claims and pricing. Ransom payment behaviour and the cost of individual breaches are separate measures covered in the related guides. Dates and definitions accompany the figures, with sources collected at the end.
Key facts and figures
- 47% of UK businesses reported some cyber insurance in the 2025/26 survey, broadly consistent with 45% in 2024/25.
- 10% of businesses reported a specific cyber policy; 37% reported cyber cover within a wider policy in 2025/26.
- £197 million was paid in 2024 cyber claims by firms participating in the ABI’s collection, a reported 230% annual increase.
- 51% of cyber claims in the ABI’s 2024 collection involved malware or ransomware; this is a share of claims, not of money paid.
- 22% of businesses did not know whether they had cyber insurance in the 2025/26 survey.
- 55% of small businesses reported some cyber cover in 2025/26; the figure was 61% for medium businesses.
- 5% — the decline in UK cyber renewal rates in Marsh’s Q2 2026 index, reflecting its client portfolio.
- 668 cyber claim notifications were recorded for Marsh UK clients in 2025, 8% more than in 2024.
Checked on 15 October 2026. Uptake is from the 2025/26 survey, conducted in August–December 2025. ABI paid-claims figures cover calendar 2024, Marsh notifications cover 2025, and the pricing index covers Q2 2026.
The headline measures at a glance:
| Measure | Latest figure | Data period | Trend / detail |
|---|---|---|---|
| UK businesses with any cyber insurance | 47% | 2025/26 survey; fieldwork August–December 2025 | Broadly consistent with 45% in 2024/25 and 43% in 2023/24 |
| Businesses with a specific standalone policy | 10% | 2025/26 survey | 37% reported cover within a wider policy |
| Cyber claims paid by ABI collection participants | £197 m | 2024 calendar year (ABI, Nov 2025) | Up 230% on ~£59m in 2023 |
| Malware/ransomware share of claims | 51% | 2024 (ABI) | Up from 32% in 2023 |
| Businesses unsure if they are covered | 22% | 2025/26 survey | Respondent did not know whether cover was held |
| Small-business uptake | 55% | 2025/26 survey | 61% among medium businesses |
| UK cyber renewal rate change | −5% | Q2 2026, Marsh index | Portfolio measure; prior quarter −8% |
| Marsh UK cyber claim notifications | 668 | Calendar 2025 | 8% increase within Marsh’s client portfolio |
What percentage of UK businesses have cyber insurance?
The 2025/26 Cyber Security Breaches Survey found that 47% of UK businesses reported some cyber insurance. Ten per cent had a specific cyber policy and 37% had cover within a wider policy. Interviews took place in August–December 2025. These responses describe reported cover, not an assessment of the adequacy of each contract.
Policy limits, exclusions, conditions and incident-response services vary. Whether cover is standalone or part of another policy does not by itself show whether a particular claim will be paid. Organisations should review their actual wording and notify incidents in accordance with its conditions.
The same survey found some cyber cover among 35% of charities, broadly consistent with 34% in the previous two surveys. Five per cent reported a specific policy. The figures do not by themselves explain differences in organisations’ resources or risk management.
Has UK cyber insurance uptake stopped growing?
The survey describes uptake as broadly consistent: 43% in 2023/24, 45% in 2024/25 and 47% in 2025/26. This is not evidence that the market has reached a permanent limit or that further growth is impossible.
Among businesses without cyber insurance in 2025/26, 39% said they were unaware of it and 34% said it was not a budget priority. These were prompted reasons from the uninsured subgroup, which could select more than one reason.
Twenty-two per cent of business respondents did not know whether their organisation had cover. Uncertainty limits what the survey can establish about coverage, but it does not quantify how many policies would respond to a claim or justify adjusting the headline uptake percentage downward.
How does cyber insurance uptake vary by business size?
Small and medium businesses were more likely than businesses overall to report some cyber insurance: 55% and 61% respectively, against 47% overall. For specific standalone policies, uptake rose from 8% of micro businesses to 32% of large businesses. The survey does not establish a single reason for every size-band difference.
The table compares specific cyber policies, rather than combining them with wider policies. Separately rounded categories may not add exactly to published totals. The figures describe respondents’ reports and do not measure policy limits or effective protection.
| Business size | Specific cyber policy, 2025/26 | Detail |
|---|---|---|
| Micro (1–9 staff) | 8% | 37% reported cover within a wider policy |
| Small (10–49 staff) | 15% | 40% reported cover within a wider policy |
| Medium (50–249 staff) | 24% | 36% reported cover within a wider policy |
| Large (250+ staff) | 32% | 22% reported cover within a wider policy |
| Charities | 5% | 31% reported cover within a wider policy; totals may differ through rounding |
How much do UK insurers pay out in cyber claims?
Firms participating in the ABI’s cyber data collection paid £197 million in 2024, £138 million more than in 2023. The ABI described the annual increase as 230%. This is the collection’s paid-claims total, not a measure of all UK cyber losses or all costs incurred by insured organisations.
Malware and ransomware represented 51% of claims in the ABI’s 2024 collection, compared with 32% in 2023. The percentage is not the share of the £197 million paid. Claims counts and the value of payments require separate measures.
The ABI also reported 17% more policies taken out in 2024 than in the previous year. That count differs from the government survey’s percentage of businesses reporting any cover, so the two trends need not match.
What are UK cyber insurers seeing in claims?
Marsh recorded 668 cyber claim notifications for UK clients in 2025, its highest annual total at that point and 8% above 2024. Without a comparable policy exposure denominator, that increase does not establish a national incident rate or more incidents per policy.
In Marsh’s own extortion claims dataset, the share involving ransomware deployment fell from 70% in 2021 to 24% in 2025. The comparison distinguishes encryption from data-theft-only extortion. It does not show the same change across every UK insurer or every uninsured business.
What is happening to cyber insurance prices and the UK market?
Marsh’s Q2 2026 UK index reported a 5% decrease in cyber insurance renewal rates, following an 8% decrease in Q1. The index reflects the mix of Marsh’s clients. It is not a guaranteed reduction in an individual premium or a quoted price for a particular business.
Neither the ABI’s claims collection nor Marsh’s pricing and notification series provides a complete UK cyber premium total. Comparing claims from one year and population with revenue from another sector would not establish an insurance loss ratio or profitability.
Individual renewal outcomes depend on the organisation’s risks, controls, claims experience and policy terms. A market index can provide context, but organisations should assess the cover and conditions offered rather than assume that a headline decline applies to them.
Frequently asked questions
What percentage of UK businesses have cyber insurance?
In the 2025/26 government survey, 47% of UK businesses reported some cyber insurance: 10% a specific cyber policy and 37% cover within a wider policy. The survey was conducted in August–December 2025.
How much do UK insurers pay out in cyber claims?
Firms participating in the ABI’s collection paid £197 million in cyber claims for calendar 2024, a reported 230% annual increase. Malware and ransomware represented 51% of claims, not necessarily 51% of the amount paid.
Do small businesses need cyber insurance?
Fifty-five per cent of small businesses reported some cyber insurance in the 2025/26 survey. Whether a particular policy is appropriate depends on risks, available resources and its terms. NCSC guidance explains questions to consider; holding insurance does not replace security controls.
Does cyber insurance cover ransomware payments?
Coverage varies by policy, including incident response, interruption, liability and extortion-related costs. Exclusions, notification conditions and applicable law still matter. A payment involving a sanctioned person may breach financial sanctions even if an insurance policy appears to cover it.
Is cyber insurance uptake in the UK still growing?
The government survey describes overall business uptake as broadly consistent across 2023/24, 2024/25 and 2025/26, at 43%, 45% and 47%. That does not establish a permanent market ceiling or predict future uptake.
Related guides
- Ransomware Statistics UK: Attacks, Payments & Costs
- Data Breach Statistics UK: ICO Reports, Trends & Costs
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- Phishing Statistics UK: Attacks, Trends & Costs
- GDPR data breach: what to do in the first 72 hours
Sources & references
- DSIT and Home Office — Cyber Security Breaches Survey 2025/2026, section 3.3
- ABI — 2024 cyber claims data, published 10 November 2025
- Marsh — UK Cyber Claims 2025, published 2026
- Marsh — UK insurance market rates, Q2 2026
- NCSC — Cyber insurance guidance
- OFSI — Financial sanctions guidance for ransomware, January 2026
Most cyber claims start with an everyday mistake — a missed update, a weak password, a convincing email. Cover pays the bill afterwards; training helps stop the breach in the first place and meet your UK GDPR duties.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.