UK Cyber Insurance Premium Index 2026: Costs & Controls

UK Cyber Insurance Premiums in 2026: The Headline Numbers

The UK cyber-insurance market is large and still expanding: Gallagher's UK Cyber Market Report 2026 put premium written across the UK market at around £13.2 billion over 2025. That sits alongside — but is distinct from — the UK Government's Cyber Security Sectoral Analysis 2026, which estimated the wider UK cyber-security provider sector at £14.7 billion in annual revenue and around 69,600 FTE employees; one figure is insurance premium, the other is the revenue of firms selling cyber-security products and services, and the two should not be added together.

On pricing direction, four separately reported figures tell a consistent softening story, each with its own scope. Marsh data reported by GDPR Course showed UK primary cyber pricing down about 7% in Q1 2025 and 42% below its 2022 peak. Lockton reported an average 11% decline across its cyber portfolio over 2025, alongside broadening coverage. S&P Global's 2026 commentary found UK rates down 7% on average, with midmarket clients down 12% and clients turning over £1 billion to £5 billion down 19% — the steepest reduction reported in this dataset.

Detailed 2026 Premium Ranges by Turnover Band

Rather than headcount, the clearest lens for UK 2026 pricing is turnover band and the cover limit purchased — this is how Connection Technologies and WS Insurance both frame their published 2026 benchmarks, and the two sources broadly corroborate each other at the micro and small end of the market.

Sector matters on top of turnover. Connection Technologies notes that higher-risk sectors — healthcare, financial services, legal and technology — typically pay 1.5 to 3 times the baseline premium bands below, reflecting the sensitivity of the data they hold and the regulatory exposure that follows a breach.

• •Micro (turnover under £500,000): £500–£1,500 a year for £500,000 of cover
• •Small (£500,000–£2 million): £1,500–£4,000 a year for £1 million of cover
• •SMB (£2 million–£10 million): £3,500–£9,000 a year for £2 million of cover
• •Mid-market (£10 million–£50 million): £7,500–£25,000 a year for £5 million of cover
• •Enterprise (£50 million+): £25,000–£150,000+ a year for £10 million+ of cover

Three Worked Examples: How the Bands Play Out

A 20-person IT consultancy turning over roughly £1.5 million falls into the small band, so the reference premium is £1,500–£4,000 a year for £1 million of cover. Because it operates in technology — one of the sectors Connection Technologies flags as carrying a 1.5–3x loading — insurers may price it towards the top of that range, or above it, before any control-based discount is applied.

A 100-person e-commerce retailer turning over around £8 million sits in the SMB band: £3,500–£9,000 a year for £2 million of cover. Where such a business runs its own customer-facing platform rather than buying it as a service, underwriters increasingly treat it more like a technology risk than a standard retailer, which can push quoted terms towards the upper end of the band.

A mid-market healthcare provider turning over about £20 million falls into the £10 million–£50 million band, with a baseline of £7,500–£25,000 a year for £5 million of cover. Healthcare is explicitly named among the higher-risk sectors carrying a 1.5–3x loading, so this profile should expect to sit at the top of the band, or need a broker to negotiate excess layers separately.

What Actually Moves the Price: Rate-on-Line and Controls

Cyber remains structurally expensive relative to other commercial lines. A UK Government cyber-security report found that the rate on line for the primary cyber layer ran at roughly three times general liability and around six times property — a reflection of pricing per pound of limit purchased, not of the final premium any one business pays. That structural gap helps explain why cyber premiums can fall year on year, as they have through 2025 and into 2026, and still sit well above equivalent liability or property cover.

Within that structure, the lever insurers use most is the strength of core controls. Market commentary is consistent that stronger multi-factor authentication, tested backups, disciplined patching, email-security controls and a documented incident-response plan are rewarded with lower premiums or broader terms — Lockton specifically noted coverage broadening alongside its 2025 rate reductions. Where those controls are weak, the outcome is not always a flat decline: it more commonly shows up as a surcharge, a higher deductible, or a cover exclusion built into the policy wording. A structured cyber security risk assessment before renewal is the most direct way to see where a policy is likely to be marked down.

The Cyber Essentials £25,000 Bundle — and Its Limits

One of the most concrete 2026 data points for UK SMEs is the Cyber Essentials-linked insurance bundle: businesses turning over under £20 million can receive £25,000 of cyber liability cover at no additional cost simply by holding Cyber Essentials certification. It is a genuinely useful floor for the smallest organisations, but it should be read as a starting point rather than a substitute for the standalone limits set out above — even a micro business benchmarked at £500,000 of cover is buying twenty times the bundled amount.

Some insurers also extend meaningfully better terms to firms holding Cyber Essentials Plus discount arrangements, reflecting the deeper technical assurance that certification level provides compared with the base standard. Either way, certification is increasingly treated by underwriters as evidence of baseline hygiene rather than a nice-to-have — and its absence is one of the fastest ways for a quote to come back loaded or restricted.

Calculating Your Limit and Comparing Brokers

The turnover-band benchmarks above are a reasonable starting reference for sizing cover, but they should be checked against your own exposure — the cost of notification, forensics, business interruption and regulatory response after a UK breach can be sized more precisely using data such as the UK data breach costs research. If your potential loss materially exceeds the band's headline limit (£1 million, £2 million, £5 million and so on), that is the signal to negotiate a higher limit rather than accept the default.

Because premiums for the same limit vary widely within a band — the mid-market range alone spans £7,500 to £25,000 for £5 million of cover — the quality of your broker matters. A specialist cyber broker who understands control-based underwriting is better placed to present your MFA, backup and patching evidence in the way underwriters expect, which is where the gap between the bottom and top of a band is typically won or lost. When comparing quotes, ask explicitly what triggers a sub-limit or exclusion under each policy, not just what the headline premium and limit are.

• •Confirm the cover limit against your actual potential loss, not just the band default
• •Ask what evidence of MFA, backups and patching each insurer wants to see
• •Check whether a specialist broker can access markets a generalist cannot
• •Clarify what happens to terms if your control posture changes mid-term

The Outlook for Late 2026 and 2027

The tension in this dataset is between falling rates and persistent claims activity: brokers describe a market that continues to soften on price — Marsh, Lockton and S&P Global all report declines through 2025 and into 2026 — while incident volumes remain high enough that this softening is being watched closely rather than assumed to continue indefinitely. Large corporates have benefited most so far, with S&P Global's reported 19% reduction for £1 billion–£5 billion revenue clients the steepest cut in this dataset, while broader market averages have moved by smaller margins.

Longer term, Mordor Intelligence's market sizing forecasts continued growth in a specific, narrowly defined slice of the UK cyber-insurance market — from USD 1.77 million in 2026 to USD 3.28 million by 2031 — a scale far smaller than the broader market captured by Gallagher's £13.2 billion premium-written figure for 2025 cited earlier in this piece. Readers should treat Mordor Intelligence's growth trajectory as directional evidence of an expanding market segment rather than as a figure comparable to the billions-scale estimates used elsewhere in this study. For UK buyers, the practical implication is that control quality — not just market timing — is likely to remain the biggest lever on premium into 2027, because insurers have shown they will price hygiene rather than simply follow the broader rate cycle.

Methodology

The premium and rate figures in this study were compiled from published broker and rating-agency market commentary (Marsh data as reported by GDPR Course, Lockton's cyber portfolio update, and S&P Global's 2026 UK pricing commentary), from UK Government market and sectoral reporting, and from two independent UK broker pricing guides — Connection Technologies and WS Insurance — that publish turnover-banded 2026 premium ranges. Material was collected and cross-checked between January and July 2026.

Where the two broker sources overlapped, notably at the micro and small end of the market, their published ranges were checked against each other for consistency before being used. Rate-movement percentages (the 7%, 11%, 12% and 19% figures) were kept strictly separate from absolute premium levels throughout, since they describe pricing change over specific reporting periods rather than the cash cost of a policy. Every figure in this piece retains the exact scope — metric, business segment and reporting period — stated by its original source.

Sources

Every figure in this article traces to the sources below.

• •GDPR Course — Marsh-reported UK primary cyber pricing movement
• •Lockton — UK/EU cyber portfolio rate and coverage update
• •S&P Global — 2026 UK cyber pricing commentary by segment
• •Gallagher — UK Cyber Market Report 2026 (premium written)
• •UK Government — Cyber Security Sectoral Analysis 2026
• •UK Government — cyber rate-on-line vs. other liability/property lines
• •Connection Technologies — UK 2026 premium benchmarks by turnover band
• •WS Insurance — UK 2026 cyber insurance pricing and coverage guide
• •Mordor Intelligence — UK cyber insurance market sizing and forecast