The cyber insurance market has changed considerably over the past few years. Pricing has softened, capacity has returned, and insurers have gotten much better at understanding the risks they’re underwriting. Businesses have also responded to underwriting pressure by implementing stronger controls and paying more attention to the security practices that influence insurability. All of that is positive, but cheaper insurance shouldn’t be confused with evidence that businesses are becoming more survivable.
Part of the problem is the language we’ve used around insurance for years. We routinely describe it as “risk transfer,” even though that isn’t really what happens. From a SABSA perspective, that distinction matters because risk exists in relation to a business objective. The organization owns that objective and remains accountable for what happens to it. Buying an insurance policy doesn’t transfer that accountability to the carrier. What the carrier agrees to take on is a defined portion of the financial consequence if certain events occur under the conditions established by the policy.
That may sound like semantics, but it changes how we think about the role insurance plays. If ransomware disrupts production, the insurer doesn’t own the production problem. If a compromised identity provides access to several interconnected SaaS platforms, the insurer doesn’t suddenly own those dependencies. If a critical supplier is unavailable or an AI-enabled business process can no longer operate because one of the services behind it has failed, those remain problems the business has to solve. Insurance may pay some of the resulting costs, but the operational consequences remain exactly where they were before the policy was purchased.
This is where financial recovery and operational recovery start to separate. A cyber insurance policy can perform exactly as intended while the insured business is still in serious trouble. The carrier can accept the claim, pay for incident response, cover legal expenses, reimburse restoration costs and eventually compensate the company for covered business interruption losses. None of that guarantees that the company can restore the capabilities it needs before the disruption causes lasting damage.
A manufacturer that can financially withstand three weeks of interruption may still lose customers because orders cannot be filled. A healthcare organization may have money available for recovery while clinicians are struggling to access systems they depend on to provide care. A professional services company may discover that restoring Microsoft 365 doesn’t restore the SaaS integrations, identity relationships and automated workflows that actually make the company operate. An organization that has aggressively adopted AI may discover that nobody really knows how to perform a critical process manually anymore because the technology gradually became part of the operating model without anyone treating it as a critical dependency.
These aren’t necessarily insurance failures. In many cases, they aren’t even security failures in the traditional sense. They’re failures to understand what the business actually depends upon and how quickly those dependencies have to be restored.
That distinction has become more important as businesses have moved away from operating within infrastructure they directly control. Critical business processes now cross cloud platforms, SaaS applications, suppliers, identity providers, APIs, outsourced services and increasingly AI platforms. The individual components may all appear reasonably resilient when evaluated separately. The weakness often appears in the relationships between them. A dependency that looks insignificant on an architecture diagram can become extremely important when its failure prevents several other processes from functioning.
This is one of the reasons I continue to find SABSA useful. It forces the security conversation to begin with the business rather than the technology. The purpose of security isn’t to deploy controls. It’s to protect the attributes and capabilities the organization needs to achieve its objectives. When that thinking is extended beyond security and into survivability, the question becomes less about whether a particular system is protected and more about what the business must still be capable of doing after something goes wrong.
That also changes the role cyber insurance should play. Insurance is absolutely valuable, and there are financial consequences that businesses should transfer rather than retain. The problem begins when the presence of insurance becomes evidence that the risk itself has somehow been dealt with. A policy can help finance recovery, but it cannot make an operation recover faster. It cannot recreate institutional knowledge, restore a supplier, repair a poorly understood dependency or magically produce a manual alternative to an automated process that nobody knows how to perform anymore.
This is why I’m cautious when I see improving cyber insurance conditions interpreted as evidence that cyber risk itself is improving. The insurance market may simply be getting better at understanding, pricing and absorbing certain financial consequences. That’s important, but it tells us very little about what happens inside the insured company during the first hours and days of a serious disruption.
The more useful measure is whether the organization understands how long its critical business capabilities can be unavailable and whether the dependencies supporting those capabilities can actually be restored within that window. If the business needs an operation back within eight hours but the systems, suppliers, identities and services supporting it require three days to recover, the size of the insurance policy doesn’t solve the underlying problem.
Cyber insurance therefore belongs inside a broader survivability strategy rather than being treated as the final destination of cyber risk management. Security can reduce the likelihood and impact of an event. Insurance can absorb some of its financial consequences. Recovery capabilities can help restore operations. The business still owns the outcome when all of those things are tested at the same time.
So yes, cheaper cyber insurance is good news. It may indicate a healthier insurance market and better security practices among insured organizations. What it does not tell us is whether those organizations can continue operating when something important stops working.
That’s a much harder question than “Can we insure this?”
It’s also the one that matters when the business is actually under stress.