Why the Protection Gap Keeps Growing
The cyber-insurance protection gap is the distance between the losses firms may suffer and the losses that commercial policies can actually absorb. This chapter examines why that gap is widest for small and medium-sized enterprises and for emerging markets, even though cyber risk is widely recognised. The useful judgement is not simply whether more cover is desirable; it is whether the policy is affordable, understandable, large enough for the exposure, and connected to controls that reduce the chance and duration of loss.
A gap can arise because insurers do not offer capacity, because firms do not buy what is available, or because the policy limit and wording fall short of the loss. Cyber insurance shows all three possibilities, but the evidence in the BIS Financial Stability Institute report suggests that demand-side factors are currently especially important. Firms may not know that cover exists, distrust the product, find its exclusions difficult to understand, or decide that the premium and required resilience investment cost more than the perceived benefit.
A wide gap with an uneven shape
The headline estimate is striking but needs careful handling. BIS cites an estimate that only about 1% of global economic cyber losses are covered by cyber insurance, leaving roughly 99% uninsured. It also places the 2024 global cyber-insurance market at USD 15.3 billion in gross written premiums. Estimates of total economic losses from cyber incidents range from roughly USD 1 trillion to above USD 10 trillion annually.
These figures are not a precise loss ratio. The market estimate and the economic-loss estimates use different populations, definitions and periods, and the report explicitly notes that estimates of the gap vary. The comparison is still useful as an order-of-magnitude signal: the insurance market is small beside the economic exposure it might be asked to help recover. Much of the loss remains with firms, their customers, suppliers, employees, governments and the wider economy.
The gap is not distributed evenly. The BIS report cites estimates that in North America and Europe between 60% and 70% of large corporates purchase cyber cover, compared with 40% to 50% of mid-market firms and 10% to 20% of small and medium-sized enterprises. Emerging market and developing economies are especially underinsured. The source gives Asia Pacific as an illustration: the region accounts for about 10% of cyber-insurance gross written premiums while experiencing an estimated 34% of global cyber attacks.
The comparison does not mean that every large company is well protected or that every smaller firm is uninsured. It describes a market pattern. Large organisations tend to have more data and revenue at risk, more resources to document controls, greater access to brokers, and more ability to negotiate with insurers. They are also more likely to treat insurance as part of a formal risk-management programme. Those features make them more attractive risks and make it easier for them to meet underwriting requirements.
Size does not remove the gap. Underwriters limit their exposure, and the limits available to a large corporate may still be below the cost of an unusually large attack. BIS cites an estimate that the average global cost of a data breach for a large corporate was USD 4.4 million, while some individual events have been much larger. A firm can therefore have a policy, pay a substantial premium and still retain a material tail exposure.
The same distinction applies to the European Economic Area.