Analysis summary
Why are middle-market companies still underbuying cyber insurance? An education gap, sources tell Insurance Insider US, as business leaders struggle to keep up with changing threats and coverage options while AI fuels greater risk. This analysis shows why Chubb CEO Evan Greenberg calls the middle market “the biggest meatball”, why Axa XL sees signs of cyber rates bottoming out and the market firming despite rising claims, and why capacity providers have largely not pulled back. It delivers fast insight from Relation Insurance Services, Axa XL and HSB on how insurers are going beyond paying claims to offer risk management services such as website scanning, and why there's much more to a middle-market cyber policy than price.Subscribe to get comprehensive access to our exclusive analysis in the full platform.
Small to mid-sized companies are especially at risk due to a lack of internal resources.
The pressure is on for cyber insurance brokers to get businesses up to speed on changing cyber risks and coverage options, sources said, as AI fuels greater threats.
Some of the greatest risks face the middle market – “the biggest meatball”, according to Chubb CEO Evan Greenberg – where businesses are big enough to be a target for bad actors but often too small to have internal cybersecurity teams.
Cyber risks frequently top the list of concerns for middle market companies, yet business leaders still struggle to understand the changing threats they face and the myriad of coverage options carriers are offering.
Leaders at these businesses are frequently too swamped with operational responsibilities to take the time to understand the ever-changing landscape of cyber risks and the wide range of insurance policies to cover them, sources said.
“That education gap, unfortunately, is still very much alive,” said Courtney Maugé, SVP, cyber risk, at Relation Insurance Services. “Regardless of how much we're talking about it in the media, with our clients, I still see that.”
Pre-Covid, many people thought of cyber risks as just covering data breaches, and businesses that didn’t think of themselves as holding much data simply skipped buying coverage.
Since then, dependence on technology has grown, and cyber coverage has gone from a “nice to have” to an important part of protecting the business, Maugé said.
But signing these businesses up for adequate coverage has proven tricky, and demand has continued to frustrate expectations from carriers betting big on future growth.
The education gap is a big reason for this lack of demand, though sources hope this is beginning to change. Similarly, on the rate front, there are hopes of stabilization.
“We've definitely reached what I'm hoping is kind of a bottoming out earlier this year or last year, and now we're starting to see signs of the market firming,” Rachel Rossini, Axa XL mid-market underwriting manager, said.
“But it's still very competitive in middle market, despite the fact that we're seeing a lot of increased claim activity, and we're paying a lot of claims.”
Nonetheless, sources said capacity providers largely haven’t pulled back, betting the big growth is yet to come.
“We're seeing a little bit of that behavior pulling back, but -- it doesn't really make a whole lot of sense -- we're not really seeing as much of it as you would expect given the losses that we're seeing,” Rossini said.
More than a check
Another thing brokers are educating clients on – in the middle market especially – is that beyond writing insurance policies or signing a check for monetary damages, insurers are getting more involved in helping clients manage their cyber risks.
They're increasingly connecting them with resources and even training employees or providing cybersecurity services to prevent or react to cyber events.
“Every one of our insureds has the ability to take an insurance package that can provide them things like website scanning to understand what vulnerabilities they might have in their systems and infrastructure,” James Hajjar, head of HSB Portfolio Risk Solutions, said in an interview.
“We’ll help them as best we can to make sure we try to mitigate it and attack before it happens.”
Relation's Maugé said that’s something businesses should consider when shopping around.
"There’s so much more to the policy than just the price, particularly for middle-market clients,” she said. “That is something that’s slowly getting really lost in the softer market that’s very much price driven.”
Got a tip for us? Reach out confidentially here.
Frequently asked questions
Why is the middle market especially exposed to cyber risk?
Some of the greatest risks face the middle market – “the biggest meatball”, according to Chubb CEO Evan Greenberg – where businesses are big enough to be a target for bad actors but often too small to have internal cybersecurity teams.
Why do middle-market companies struggle with cyber insurance?
Cyber risks frequently top the list of concerns for middle market companies, yet business leaders still struggle to understand the changing threats they face and the myriad of coverage options carriers are offering.
How has cyber insurance changed since Covid?
Pre-Covid, many people thought of cyber risks as just covering data breaches, and businesses that didn’t think of themselves as holding much data simply skipped buying coverage. Since then, dependence on technology has grown, and cyber coverage has gone from a “nice to have” to an important part of protecting the business, Maugé said.
Are middle-market cyber insurance rates firming?
“We've definitely reached what I'm hoping is kind of a bottoming out earlier this year or last year, and now we're starting to see signs of the market firming,” Rachel Rossini, Axa XL mid-market underwriting manager, said.
Have cyber insurers pulled back capacity?
Sources said capacity providers largely haven’t pulled back, betting the big growth is yet to come.
What risk management services do cyber insurers offer?
Beyond writing insurance policies or signing a check for monetary damages, insurers are getting more involved in helping clients manage their cyber risks. They're increasingly connecting them with resources and even training employees or providing cybersecurity services to prevent or react to cyber events.
What should businesses look for in a cyber policy?
"There’s so much more to the policy than just the price, particularly for middle-market clients,” said Courtney Maugé, SVP, cyber risk, at Relation Insurance Services. “That is something that’s slowly getting really lost in the softer market that’s very much price driven.”
By Caleb Harshberger and Olivia Royle
9 October, 2026
Request your free trial today to unlock our complete intelligence platform. .svg){kind=small}