CHENNAI: A spate of cyberattacks on critical digital infrastructure and software vulnerabilities exposing millions of websites to hackers is bringing fresh attention to cyber insurance, a product many organisations consider critical but still treat as optional.
“We are witnessing a clear increase in the size of cyber insurance covers being sought by businesses, although the quantum varies significantly by industry, scale and risk profile,” says Ramit Goyal, Chief Distribution Officer, Generali Central Insurance.
Gisha George, President – Product & Underwriting, Commercial Lines & Reinsurance, Liberty General Insurance, also says demand for cyber insurance has moved to the boardroom, driven by a sharp rise in ransomware and data breaches, regulatory requirements such as CERT-In’s incident-reporting directions, the RBI’s cyber-security framework and the Digital Personal Data Protection Act.
She says the cover size has also gone up with large Indian corporates and listed entities buying cyber insurance cover of $10–50 million and above, with reinsurance support, compared to single-digit-million limits five years ago.
Last week, websites worldwide faced millions of attempts to exploit a recently discovered vulnerability in PHP, the programming language that underpins about 70% of the world’s websites. The vulnerability prompted some governments and companies to take their websites offline to prevent potential attacks. In another instance, a cybersecurity researcher recently observed a Chinese-speaking hacker breaking into websites belonging to more than 100 global companies by outsourcing the hacking entirely to artificial intelligence (AI) agents.
The growing concern adds to a rising number of cyber incidents. In 2025 alone, the Indian Computer Emergency Response Team (CERT-In) handled over 29.44 lakh cyber incidents.
However, rising threats alone may not translate into wider adoption. Amit Goel, Director, Equirus Raghnall Insurance Broking, says, “Awareness, affordability and a better understanding of policy coverage will play an equally important role.”
Insurers are also becoming more selective about the risks they underwrite. “Businesses need to demonstrate reasonable security controls, and they must understand what their policies cover, particularly in relation to ransomware, cyber fraud, business interruption and third-party incidents,” Goel says.
The banking, financial services and insurance (BFSI) sector is a particular area of concern. According to Amit Solanki, Executive President – Liability & Special Risks at Howden India, the sector experienced cyberattacks at approximately 1.6 times the global average, while reported incidents more than doubled between 2021 and 2025.
“Recent incidents and disclosures involving major financial institutions illustrate the scale of the challenge,” Solanki says.
Last week, the country’s largest lender, State Bank of India, acknowledged that close to 3,75,000 records were available on the dark web, including 3,897 customer records containing personally identifiable information such as registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. Bank of Baroda, ICICI Bank and Star Health Insurance have also faced cyber incidents or ransomware threats in recent years.
Demand is extending beyond large organisations to individuals seeking protection against online fraud. “Even individual customers are now seeking protection from various cyber scams and phishing attacks. We are seeing a shift in customer behaviour, moving from being reactive to being proactive,” says Arti Mulik, Chief Technical Officer at Universal Sompo General Insurance.
Industry executives say BFSI, technology, telecom, healthcare and e-commerce are among the biggest buyers of cyber insurance, given their large volumes of customer data and exposure to cyber incidents.
Vibhaw Kumar, Executive Vice President – Financial Lines & Liability, Anand Rathi Insurance Broking, says businesses should assess whether their policies adequately cover potential losses from ransomware, data breaches, payment-system disruptions, attacks on technology vendors and business email compromise.
“Most importantly, organisations should examine policy exclusions, sub-limits, waiting periods, notification requirements and the treatment of social-engineering fraud, system outages and third-party service-provider incidents,” he adds.
Industry estimates suggest cyber insurance limits have risen significantly, with some large banks seeking coverage of $50–100 million or more, depending on their exposure.
Yet the Indian cyber insurance market remains relatively small, with annual premiums estimated at ₹900–1,100 crore, compared with a general insurance industry size of over ₹3 lakh crore.
“Industry experience indicates that the Indian cyber insurance market has been growing at approximately 25-30% annually,” Solanki says. He estimates the market’s annual premiums at $65–70 million, reflecting lower penetration than in more mature markets.
George says India’s annual cyber insurance premiums account for well under 1% of the global cyber premium pool, estimated at roughly $14–16 billion. “The opportunity is therefore less about today’s size and more about the trajectory, particularly in the mid-market and SME segment, which is largely uninsured.”
Source: The Financial Express
