Two years is a long time in the cyber insurance market. In early 2024, carriers were still working through the hangover of the 2022-2023 hard cycle: the rapid rate increases, the capacity contraction, the sudden imposition of control requirements that left a lot of organizations scrambling. Entering 2026, the market looks materially different, and the difference is worth understanding before your next renewal because it cuts two ways at once.
The short version: price got better, and stayed better. Underwriting discipline got tighter, and stayed tighter. Both are true simultaneously. The renewal that lands on a desk in 2026 is cheaper than the one that landed in 2023 and harder to answer casually than the one that landed in 2021.
The price story: relief that held.
The clearest signal of where the market sits comes from the Council of Insurance Agents & Brokers' Q3 2025 Commercial P/C Market Survey. Cyber recorded the largest premium decrease of any commercial line in that quarter, down 2.6%, driven by ample capacity and competition among carriers. That is not a one-quarter blip. It is the continuation of a softening trend that ran through 2024 and 2025.
Marsh's ongoing U.S. cyber market commentary describes the same equilibrium from the broker's seat: pricing has stabilized after the hard cycle, and buyers with reasonable security postures are generally seeing flat renewals rather than the double-digit increases that defined 2022 and 2023. Capacity is plentiful. Expanded carrier appetite, including for the smaller accounts legacy carriers historically avoided, has kept the market competitive.
For an SMB, the practical implication is that the era of "your premium just doubled and there's nothing you can do" is, for now, over. The pricing environment in 2026 is the friendliest it has been since before the hard cycle.
That is the half of the story everyone wants to hear. The other half is the half that decides whether you get the friendly price.
The discipline story: tighter, and permanent.
Premium relief did not come with a relaxation of underwriting standards. It came alongside their entrenchment.
The Coalition 2025 Cyber Claims Report, covering full-year 2024 data, is the clearest evidence of why. Claim frequency declined roughly 7% year over year. Coalition attributes a substantial part of the improvement to the security posture it underwrites for and monitors: policyholders with proactive controls experienced approximately 73% fewer claims than the broader industry average. The carriers learned, with multiple years of loss data, exactly which controls correlate with not having a claim. They are not going to forget that lesson because the pricing environment softened.
The Insurance Journal's December 2025 viewpoint on healthcare cyber insurance frames the structural reality directly: data-driven underwriting discipline and continuous cyber-hygiene monitoring are now permanent features of the market, not temporary responses to a hard cycle. Soft market or hard market, the carrier is going to scrutinize controls, because the controls are what the loss data says drives the carrier's results.
So the 2026 application is not the relaxed 2021 application with a lower price tag. It is the demanding 2023-era application (the long questionnaire, the evidence requirements, the carrier external scans) at a competitive 2026 price. The discipline survived the price drop.
What actually changed since 2024, in plain terms.
Pulling the threads together, here is the honest before-and-after for an SMB buyer:
What got better since 2024:
- Pricing. Renewals are flat to down for buyers with reasonable postures, versus the increases that defined the hard cycle.
- Capacity. There are more carriers willing to write the account, including smaller accounts that legacy carriers historically avoided.
- Predictability. The wild swings of the hard cycle have given way to a more stable, more legible market.
What did not get better, and won't:
- The control requirements. MFA, EDR, tested immutable backups, and the rest of the cyber-hygiene set are permanent preconditions, not hard-cycle artifacts.
- The evidence expectation. Carriers still want artifacts behind the answers, and the external scans still happen before the quote.
- The consequence of an undisclosed gap. A mismatch between the application and reality is still what voids a policy at claim time, soft market or not.
The mistake an SMB can make in the 2026 market is reading the price relief as a return to the casual underwriting of the pre-hard-cycle era. It is not. The price came back down. The scrutiny did not.
How to actually use the 2026 market.
The 2026 environment rewards a specific posture: a buyer who has the controls real and documented can now get a competitive price for that posture, where in 2023 the same posture only avoided a punitive one.
That changes the economics of getting the controls right. In the hard cycle, strong controls were defensive: they kept the premium from exploding. In 2026, strong controls are also offensive: they let you capture the competitive pricing that soft-market capacity has created. The same evidence pack that prevented a bad outcome in 2023 now produces a measurably good one in 2026.
The practical move before the next renewal has not changed, but the payoff has improved:
- Get the controls real. Close the MFA carve-outs, complete the EDR coverage, test the backups.
- Document them. The configuration exports, the coverage reports, the restore-test logs.
- Bring the evidence to the renewal. In a competitive market, the well-documented applicant doesn't just avoid the penalty: they get the carriers competing for the account.
The market changed since 2024. It got friendlier on price and stayed strict on substance. The buyers who understand both halves are the ones who will get the most out of it.