Cyber insurance gains ground in Singapore as coverage widens, premiums fall

Singapore-based AWG Insurance Brokers and London-headquartered broker Howden said more companies bought cyber insurance policies, but they did not reveal figures.

Japanese insurer MSIG and German insurer Allianz reported an increase in the number of Singapore customer queries, but did not reveal exact numbers.

Cybersecurity policies typically insure firms against the costs of recovering from data breaches and ransomware attacks, such as hiring forensic experts and lawyers, and restoring lost data. Premiums depend on a company’s size, sector, where it operates, claims record, cyber defences, risk exposure, and the amount and breadth of coverage purchased, among others.

Media reports of damaging cyber attacks have brought the potential financial and operational fallout into sharper focus, prompting more businesses to seek coverage against losses for ransomware, sophisticated social engineering techniques and prolonged business outages.

At the same time, AI is enabling faster, larger-scale and more sophisticated attacks – a threat already felt by businesses here.

A May 2026 QBE survey involving 400 Singapore companies found that 39 per cent of firms had experienced at least one AI-related cyber incident in the past year. These incidents include AI-generated malware, cyberattacks where AI was used to identify vulnerabilities, and phishing messages with AI-enhanced content.

“Cyber risk is no longer viewed solely as an IT or operational issue. It is increasingly being discussed at the board and senior management level as a governance and enterprise risk concern, leading many organisations to review and enhance their cyber insurance programmes as a fail-safe,” said Howden Singapore’s director of cyber and technology solutions for financial lines, Kenny Tan.

More stringent regulations in Singapore are also making breaches costlier. For example, in October 2022, Singapore increased the maximum penalty for data protection breaches to 10 per cent of an organisation’s annual local turnover, or $1 million, whichever is higher. Previously, the maximum fine was $1 million.

“A mid-sized business with an annual turnover of $20 million faces a potential $2 million fine for a single compliance failure, forcing them to purchase higher limits simply to protect against regulatory liabilities,” said a spokesperson for AWG Insurance Brokers.

Large multinational corporations and government bodies have also made cyber insurance a prerequisite for vendors bidding for contracts.

This is their way of strengthening an oversight of their suppliers’ cybersecurity defences after seeing a growing trend of attackers entering their networks through less-secure vendors, said AXA XL’s head of cyber for Asia and the Middle East, Samuel Bye.

Market conditions have also swung in buyers’ favour. Cyber insurance rates in Singapore have eased from their 2021 to 2022 highs as competition intensified.

Some of the latest entrants include US-based Liberty and Japan-headquartered Sompo, while established insurers such as Chubb, AIG and MSIG offered significantly broader coverage, said industry players.

AWG Insurance Brokers said annual premiums for small businesses with revenue below $2 million have halved since 2022. Such firms can now obtain $250,000 in coverage for premiums starting from $1,000 a year, down from $2,000 previously.

For mid-market firms with annual revenue of between $10 million and $50 million, the starting premium for $2 million in coverage has fallen 25 per cent, from $8,000 in 2022 to $6,000 today.

With premiums falling, some companies are using the room in their budgets get more comprehensive coverage.

The expanded coverage covers losses from cloud outages, failures of critical third-party technology providers, cyber extortion and expenses to recover from reputational harm after a cyber incident, said Olga Wong, head of Markel’s professional & financial risks and cyber team.

Businesses with weaker cyber defences also stand a better chance of obtaining coverage today. In the past, they would have to fill up checklists of the technical measures they have in place, and may be declined coverage if they fell short even in one area, said industry players.

But after several years of gathering data from cyber incidents and insurance claims, insurers are now better able to estimate the potential cost of an attack for different types of businesses.

This allows them to calibrate and offer coverage to companies with less-developed defences, although they may charge higher premiums or impose more restrictions to account for the greater risk.

Karlis Trops, head of cyber and technology professional indemnity at Allianz Commercial Asia, said the industry used to ask extensive questions when assessing a company for cyber coverage, regardless of size.

“Now, we’ve reached a balance where the number and technicality of questions asked is reflective of the size of the company, what they do and the risks their business face,” said Trops.

Still, there are minimum requirements to meet. These typically include multifactor authentication for all remote access, a robust back-up strategy that includes offline or disconnected back-ups and a formal patch-management process, with faster remediation for high- and critical-severity vulnerabilities.

Insurers are encouraging companies to take advantage of the market conditions to get covered. “Cyber policies have become better value for buyers,” said Trops.