The cyber insurance gap: why OT losses land in property

A June paper from the Bank for International Settlements' Financial Stability Institute and the IAIS puts a number on a problem underwriters have long described. Only 1% of global economic cyber losses are covered by cyber insurance. And in actual attacks, most losses have been claimed under property policies that were never designed to cover cyber.

What the paper found

• A small, stalling market. Global cyber premiums reached USD 15.3 billion in 2024, double their 2020 level, but still under 1% of global property and casualty premiums. Growth has stalled even as capacity rises and rates fall.
• A huge loss base. Published estimates of the yearly economic cost of cyber incidents run from about USD 1 trillion to more than USD 10 trillion.
• Silent cyber is a critical concern. The paper says that in actual attacks most losses have been claimed under property policies not designed for cyber risk, and calls that ambiguity a critical concern.
• The tail is the problem. In the paper's words, the core challenge is not "average ransomware" but correlated tail events such as cloud outages, widely exploited vulnerabilities, destructive malware or critical infrastructure attacks.

Why OT is where the gap is widest

When a cyber event happens in an industrial operation, the loss is often physical: stock thrown away, supply chain dependency, damaged equipment, a stopped line. Physical losses are what property policies pay for. So the claim goes to the property book, where the cyber cause was never priced.

The European supermarket refrigeration attacks in October and November are a recent example. Attackers changed controller settings at hundreds of stores, and the losses were mostly spoiled food, one store at a time, with fires and damaged refrigeration units reported at some sites. In Europe, cyber-caused fire and explosion often sits in property books: covered, but unpriced.

What changes when you can price it

The gap won't close by writing more cyber policies alone. It closes when the OT cyber exposure inside property and cyber books can be assessed, submission by submission, in the time underwriters actually have. That means reading what the insured already discloses, linking OT control gaps to physical consequences, and expressing the result as expected annual loss and tail metrics an underwriter can use.

The paper ends on a point we agree with: cyber insurance can never replace sound cyber resilience. Pricing the risk properly is how insurance rewards it.

Run a free OT underwriting assessment with DeRISK UWA. 

References:

[1] BIS FSI and IAIS, FSI Insights No 75, “Cyber insurance unpacked: the corporate digital safety net” (June 2026): https://www.bis.org/fsi/publ/insights75.htm

[2] DeNexus, “European refrigeration attacks, Oct–Nov 2026”: https://www.denexus.ai/resources/incidents/2026-european-supermarket-refrigeration-attacks