A soft cyber insurance market: what this means for your business
The German cyber insurance market is officially considered a soft market in 2026: premiums are falling, terms and conditions are becoming more generous, and insurers are increasingly competing for customers.
Only around five per cent of German companies are insured against the consequences of a cyber attack, reports the GDV reports, based on the latest figures for 2026. At the same time, the market is growing: in 2025, the number of cyber insurance policies taken out rose by 15.7 per cent to around 157,000. Two figures that don’t quite add up and which show just how much is happening right now in a cyber insurance market that has suddenly become soft, a market that for years was considered complicated and difficult to access.
The soft market is opening up faster than many companies realise
Too many insurers, fintechs and, increasingly, international providers are currently flooding the German market at the same time. The result: terms that were simply non-negotiable just a few years ago are suddenly up for discussion. Questionnaires are getting shorter, two-year contract terms are no longer the exception, and even clauses covering losses across the supply chain – that is, the scenario where a supplier or customer is hacked, causing your own operations to grind to a halt – are now found in policy terms that were, until recently, considered a niche product.
For businesses, this means that anyone who hasn’t reviewed their cyber insurance for years is likely sitting on a policy that no longer reflects today’s market. Not because it’s too expensive, but because it simply offers less cover than is currently possible.
Not everything off the shelf is negotiable
However open the market currently is, it remains consistent in one respect, and that is a good thing. Multi-factor authentication for admin accounts and remote access is one such area. No insurer is willing to compromise on this, no matter how fiercely they compete for new business. It’s a basic level of protection that pays off.
The second non-negotiable point does not lie with the insurer, but with the company itself: the risk questionnaire. German courts have confirmed on several occasions in recent years that inaccurate or unclear answers in the questionnaire can subsequently invalidate insurance cover; the Regional Court of Tübingen and the Regional Court of Kiel, amongst others, have ruled on precisely this matter. A questionnaire completed too carelessly therefore remains the most common reason why a cyber insurance policy ultimately fails to pay out in an emergency, regardless of how soft the market has become.
Claims are getting smaller – but not because fewer incidents are occurring
One reason for the current market trend is often overlooked: companies are better prepared than they were just a few years ago. The HDI SME Cyber Study 2026 clearly demonstrates this: Whilst the average cost of cyber attacks on small and medium-sized enterprises had remained constant at at least 68,000 euros since 2022, it currently stands at only around 25,000 euros. Companies that have implemented preventive measures even manage to get away with an average loss that is 33 per cent lower. So it is not a question of fewer attacks, but of faster response times and better preparation. That is the difference.
For insurers, this is yet another reason to relax their terms and conditions: a portfolio comprising better-prepared customers is simply more predictable for them.
What this means for your own policy
The current market rewards companies that do two things at once:
honestly assess their security situation and
actively scrutinise their existing cyber insurance policy, rather than leaving it as it is.
The two go hand in hand. Those who know their risks automatically negotiate from a stronger position. That’s exactly what the latest episode of Cybersecurity Basement is all about: