<p>AMRAE COLLECTION SURVEYS AND PROSPECTS LU CYBER INSURANCE LIGHT UPON 2026 Edition 1 AMRAE Light Upon Cyber Insurance - 2026 Introduction 2 Editorial 3 Key figures 4 Methodology 5 What are the key takeaways from 2025? 22 11 STATE OF THE MARKET IN 2025 6 Cyber insurance: a tipping point on the horizon 7 Reduction in premium rates and deductibles 8 Claims rates remain stable for large companies, but are rising for intermediate-sized companies 9 Increase in medium and XL claims for intermediate-sized companies 10 CYCY 2026 SUMMARY 22 MARKET TREND ANALYSIS 12 2025 reflects a context of increased competition among insurers 13 Increased market penetration for intermediate-sized companies 14 Favourable market conditions for medium-sized companies 15 3 OUTLOOK 16 44 ANALYSIS 18 LULU 2 AMRAE Light Upon Cyber Insurance - 2026 A positive trend but a delicate balance The year 2025 marks a continuation of the easing trend in the cyber insurance market. The sharp fall in premiums, particularly for large companies (   -32%), combined with increased competition between insurers, is contributing to a more favourable environment for policyholders. This trend is accompanied by a relaxation of cover conditions, with an increase in purchased insurance capacity and a reduction in deductibles. Against this backdrop, the uptake of cyber insurance continues to grow, particularly among intermediate-sized companies and medium-sized enterprises, where the number of insured entities has risen sharply. The emergence of new providers and the development of more accessible products are contributing to this gradual spread across the wider economy. However, this commercial momentum has been accompanied by a significant rise in claims, driven in particular by intermediate-sized companies. Whilst the market remains profitable overall for insurers, there is a growing disparity between falling premiums and rising risks. In this context, the question of the sustainability of the pricing model arises in the medium term. The market remains highly volatile: the occurrence of a major loss event could lead to a rapid readjustment of conditions, with a sharp rise in rates and a tightening of access to insurance for certain players. This sensitivity to shocks serves as a reminder that the current balance remains fragile. The challenge is no longer simply to purchase capacity at the best price, but to continue investing in prevention by taking advantage of lower rates. The LUCY study, based on a comprehensive analysis of broker portfolios representative of the French market, provides a reliable and objective insight into these developments. After six years of data collection and analysis, it has now become a benchmark for all stakeholders (companies, insurers, brokers and public authorities) and an essential reference point for understanding the changes currently underway. Introduction Philippe Cotelle A study directed by Philippe COTELLE, Board member of Amrae, Chair of Amrae’s Cyber Committee Chairman of Ferma Risk Manager at Airbus Defence &amp; Space "The challenge is no longer simply to purchase capacity at the best price, but to continue investing in prevention by taking advantage of lower rates." 2 AMRAE Light Upon Cyber Insurance - 2026 3 AMRAE Light Upon Cyber Insurance - 2026 Editorial A maturing market facing an evolving risk The LUCY study highlights an increase in the uptake of cyber insurance in 2025, against a backdrop where cyber risk is becoming a systemic concern. This trend reflects a growing awareness within businesses, particularly intermediate-sized companies. At the same time, the market is maturing, with more stable players, better-structured products and enhanced cover, reflecting a more sophisticated approach. However, these positive developments should not obscure the market’s persistent weaknesses. Being cyclical by nature, the market has been experiencing a downturn in premiums for the past three years, following several years of growth. At the same time, claims are on the rise, particularly in the intermediate-sized, medium-sized companies, and SMEs segments. This trend may foreshadow a rebalancing, or even a future reversal. Without jumping to conclusions, it nevertheless raises questions about the sustainability of the current equilibrium. These trends are also taking place against a backdrop of rapid change in the threat landscape, driven in particular by artificial intelligence, which is making attacks increasingly sophisticated. In an environment characterised by budgetary trade-offs, cybersecurity cannot be viewed as a variable to be cut back on, given the high cost of inaction and the proven return on investment from prevention. Prevention remains a key lever and cannot be taken for granted: it must be continually adapted. Whilst the most mature organisations demonstrate its effectiveness, intermediate-sized companies and SMEs, which are more exposed, would be well advised to strengthen their systems by drawing inspiration from these practices. In the face of these changes, Amrae’s role remains essential. Promoting a risk- aware culture, raising awareness amongst staff, who are often identified as the weakest link, and supporting companies in their prevention efforts are key drivers. These accessible and effective measures play a direct part in improving organisations’ resilience. In this context, the LUCY study has now established itself as a benchmark, including on the international stage. By providing concrete and comprehensive data, it enables all stakeholders, risk managers, insurers and brokers, to better understand market dynamics and to adapt their product offerings, capacity and strategies. Oliver WILD Scientific Vice-President of Amrae Head of Risk and Insurance at Veolia François BEAUME Chairman of Amrae Senior vice-president of Risk and Insurance at Sonepar 3 AMRAE Light Upon Cyber Insurance - 2026 4 AMRAE Light Upon Cyber Insurance - 2026 Average indicative annual premium figures; some large groups purchase coverage exceeding €100 million. Key figures - 2025 22 % Claims-to-premiums ratio in the large companies. This figure remains low, indicating that this segment remains profitable for insurers, which explains the ongoing price competition. 83.2 M€ Total claims paid in 2025 (compared with €54.5 million in 2024), representing a very significant increase ( +53% ), driven mainly by intermediate-sized companies, which saw their claims paid quadruple (rising from €6.8 million to €28.8 million ). These figures show that the market is entering a phase of an increasing number of claims. ↗ +18 % Increase in capacity purchased by large companies: from €42 million in 2024 to €50 million in 2025. This suggests that they are increasing their level of cover, taking advantage of a more favourable pricing environment. They were able to increase their coverage whilst reducing their overall budget, confirming a significant easing in the market. ↘ - 32 % Average fall in premium rates for large companies in 2025. This is the largest fall ever recorded in this market. The fall has enabled them to reduce their overall budget by around 14  %. ↘ - 23 % A reduction in the premium rate for intermediate-sized companies in 2025. Following a fall in 2024 (   -10%), the sharper decline in 2025 reflects intensifying competitive pressure in this segment. Cover &amp; pricing Some typical figures (on average): An intermediate-sized company has taken out cover of €4.2 million with a deductible of €91,000 for a premium of €34,000. A small company has taken out cover of €701,000 with a deductible of €2,300 for a premium of €1,600. A micro-enterprise has taken out cover of €627,000 with a deductible of €1,076 for a premium of €645. A large company has taken out cover of €50 million with a deductible of €5.1 million for a premium of €641,000. A medium-sized company has taken out cover of €1.4 million with a deductible of €11,000 for a premium of €5,000. 5 AMRAE Light Upon Cyber Insurance - 2026 Number of cyber insurance policies analysed 20,996 Number of claims analysed 1,251 Number of large companies 318 intermediate-sized 2,002 medium-sized 3,769 of small companies ≈ 5,547 of micro-enterprises ≈ 9,360 This sixth edition of LUCY (LUmière sur la CYber-assurance) brings together seven years of analysis dating back to 2019. It is based on a compilation of data collected from a panel of representatives of the French market, with the aim of bringing together comprehensive data extracted from their client portfolios, covering the level of underwriting (premiums, capacity), the number of underwriting companies, deductibles, and claims (their number, value and distribution by company size). Its aim is to obtain the most reliable data possible on premiums and claims in order to better understand the dynamics of this market’s evolution. In this study, Amrae is committed to maintaining complete confidentiality with regard to brokers, their clients and their partners, insurers and reinsurers. The data is aggregated by portfolio in order to ensure client anonymity. This year, 12 brokers , including insurtechs, (Aon, Cyber Cover, Dattak, Diot-Siaci, Filhet-Allard, Howden, Kré, Marsh, Stoïk, Verlingue, Verspieren, WTW) and one insurer, SMABTP, took part in this study, which was designed and carried out by Amrae. This interface, developed in collaboration with our partners, ensures a high degree of reliability for this study, particularly regarding the businesses that use their services (large companies, intermediate-sized companies, and small and medium- sized companies). It is less accurate when it comes to the smallest businesses, as the sample of SMEs does not include all such firms; these may take out their cyber insurance policies directly with their insurer or via a general agent. Participation in the PLANETE CSCA study, which also covers small and medium-sized companies, provides a better overview of this economic sector. Public sector bodies/local authorities are also absent from this overview provided by LUCY, given their limited access to insurance brokerage. Methodology Premium: amount of the gross premium paid by the company. For the year 2025, this corresponds to the placement between 1 st January 2025 and 31 December 2025. Claim: number of claims and payouts declared between 1 st January and 31 December 2025. Claims-to-premiums ratio: the ratio between the total amount of compensated claims and the total amount of premiums collected over the same period. Lexicon Large companies: turnover exceeding €1 billion. Intermediate-sized companies: turnover between €50 million and €1 billion. Medium-sized companies: turnover between €10 million and €50 million. Small companies: turnover between €2 million and €10 million. Micro-enterprises: turnover less than €2 million. Categories 6 AMRAE Light Upon Cyber Insurance - 2026 1. STATE OF THE MARKET IN 2025 6 AMRAE Light Upon Cyber Insurance - 2026 STATE OF THE MARKET IN ,*,/ 7 AMRAE Light Upon Cyber Insurance - 2026 Cyber insurance: a tipping point on the horizon In 2025, the French cyber insurance market continues to show mixed trends, with premium volume having fallen steadily over the past three years (   -3%), from €328 million in 2023 to €317 million in 2024 and then €306 million in 2025. This trend is accompanied by a significant rise in claims, the total value of which has risen from €55 million in 2024 to €83 million in 2025. When these premiums are broken down by company size, there has been a slight increase (  +8%) in the number of large companies insured, situated at the lower end of the segment. "Several brokers suggest that this trend can be partly explained by the growth of intermediate-sized companies that have now reached the large-company category," explains Philippe Cotelle. By contrast, the volume of premiums subscribed by these large companies fell significantly (   -14% between 2024 and 2025). As this segment is the main contributor to the total volume of premiums, its decline largely accounts for this overall decrease. There has also been a significant increase in the number of intermediate-sized companies and medium-sized companies taking out cyber insurance, driven more by non-traditional providers than by established brokers. It is primarily new entrants, such as MGAs (Managing General Agents), that have seen their portfolios grow significantly. "This could indicate that these companies’ entry into the insurance market is partly linked to the technical support services offered by these new players, which are less common among traditional players," says Philippe Cotelle. As for intermediate-sized companies , premium volume increased between 2024 and 2025 (from 54.5 million to 67.8 million), though this increase is modest given the rise in the number of such companies taking out insurance (from 1,145 to 2,002, a rise of  75%). This trend is due to the arrival of smaller intermediate-sized companies, which take out lower levels of cover and therefore generate lower premiums. The same trend and the same conclusion apply to medium-sized companies, which, despite the number of policyholders almost doubling (from 1,918 to 3,769, representing growth of   97%), have seen their premium income rise sharply (from 12.9 million to 18.9 million). As usual, the LUCY study also compiles data on small and micro-enterprises. However, this data is presented here for information purposes only, as there is still insufficient insight into these segments to draw robust conclusions. Cyber insurance premium and claims in France Premiums &amp; claims paid (€) Loss ratio = Claims/Premiums 0 350 325 300 275 250 225 200 175 150 125 100 75 25 50 0 % 180 % 160% 140% 120% 100% 80% 60% 20% 40% 2019 2020 2021 2022 2023 2024 73 87 217 130 183 71 316 38 328 55 317 83 306 167% 89% 22% 1 2 % 84% 164 Claims-to-premiums ratioClaimsPremium 2025 27. 2 % 17% STATE OF THE MARKET IN ,*,/ 8 AMRAE Light Upon Cyber Insurance - 2026 Reduction in premium rates and deductibles 2024 2025 TREND 2025 VS 2024 Business category Number of insured companies Premium subscribed (€) Number of insured companies Premium subscribed (€) Number of insured companies Premium subscribed (%) Large 295 238,331,805 318 203,828,395 ↗ 8  % ↘ - 14% Intermediate 1 145 54,591,370 2,002 67,853,986 ↗ 75  % ↗ 24 % Medium 1 918 12,903,697 3,769 18,987,500 ↗ 97  % ↗ 47% Small 3 824 5,675,375 5,547 9,140,353 ↗ 45% ↗ 61  % Micro 6 942 5,253,176 9,360 6,040,450 ↗ 35  % ↗ 15 % 14 124 316,755,423 20,996 305,850,684 ↗ 49 % ↘ - 3 % Large companies still account for the majority of premium volume, but this is declining both in absolute terms (   -14%) and as a proportion (  66% of the total in 2025, compared with  75% in 2024) There has been a sharp rise in the number of intermediate- sized and medium-sized companies, driven mainly by the work of brokers specialising in providing technical support. With regard to purchased insurance capacity and average premium rates, certain trends stand out. In the large companies segment, there has been a significant increase in underwritten capacity, rising from around €42.5 million to €50 million. At the same time, average annual premium rates have fallen sharply, by around 32     %. This decline prompted checks with market participants, who confirmed it. It is, however, part of a broader trend characterised by increased volatility. At a macroeconomic level, whilst large companies have generally increased their capacity by an average of   18%, the reduction in premium rates has enabled them to reduce their overall budget by around 14  %. "In other words, they have strengthened their cover whilst reducing their expenditure, which is consistent with the price trends observed in the market," notes Philippe Cotelle. They have also seen their deductibles change significantly, with a fall of around 21     %. Among intermediate-sized companies, a similar trend can be observed in average annual premium rates, which have fallen by  23%, also reflecting a sharp decline. However, this decline is not accompanied by an increase in average underwritten capacity (falling from 4.5 million in 2024 to 4.2 million in 2025). This is mainly due to the number of intermediate-sized companies insured almost doubling, the majority of which are in the lower end of the segment. "These companies take out lower levels of cover, which helps to keep average capacity broadly stagnant," explains Philippe Cotelle. Thus, the trend observed appears to result primarily from a volume effect linked to the entry of new intermediate-sized companies, rather than from an increase in individual cover levels. Premium by business category STATE OF THE MARKET IN ,*,/ 9 AMRAE Light Upon Cyber Insurance - 2026 Claims rates remain stable for large companies, but are rising for intermediate-sized companies It should be noted that the claims referred to here relate to claims for which compensation was paid, and not to the number of attacks. For large companies, a slight increase in the number of claims has been observed (rising from 51 to 63), potentially linked to the reduction in deductibles, whilst the total amount paid out remains broadly stable, rising from €43.7 million to €44.5 million (  +2%). The situation is much more pronounced in the Intermediate-sized company segment: the number of claims has risen sharply, from 100 to 248. This trend can be partly explained by changes in deductibles, explains Philippe Cotelle: "Lower deductibles automatically increase sensitivity to claims: the lower they get, the more claims are paid out, some of which were previously excluded." At the same time, the amount paid out has quadrupled, from €6.8 million to €28.8 million, which represents a very sharp rise. A similar trend is observed among medium-sized companies, with an increase in both the number of claims (from 136 to 269) and the amounts paid out (from €2.7 million to €6.2 million). Overall, the market has seen strong growth, with the number of claims rising from 448 to 1,251 (  +179%) and the total value of claims paid increasing from €54.5 million to €83.2 million (  +53%), a trend largely driven by intermediate-sized companies. Average capacity (€) Average deductible (€) Average annual premium rate Business category 2024 2025 2024 2025 2024 2025 2025% change Large 42,598,308 50,055,660 6,464,318 5,102,010 1.90  % 1.28 % ↘ - 32 % Intermediate 4,555,900 4,202,467 109,700 91,229 1.05  % 0.81 % ↘ - 23 % Medium 1,782,179 1,428,547 17,917 10,611 0.38  % 0.35 % ↘ - 7 % Small 955,360 701,413 8,385 2,361 0.16  % 0.23 % ↗ 51 % Micro 563,611 627,212 2,648 1,076 0.13 % 0.10 % ↘ - 23 % - 32 % Sharp fall in premium rates +1 8 % Increase in capacity - 21 % Reduction in deductibles - 23 % Sharp fall in premium rates A slight reduction in capacity due to the large influx of new insured businesses - 17 % Reduction in deductibles Large companies Intermediate-sized companies A particularly soft market! Capacity, deductible and premium rate STATE O) T+E 0ARKET IN 2025 10 AMRAE Light Upon Cyber Insurance - 2026 2024 2025 TREND 2025 VS 2024 Business category Number of claims Claims paid (€) Number of claims Claims paid (€) Number of claims Claims paid (%) Large 51 43,790,343 63 44,583,393 ↗ 24  % ↗ 2 % Intermediate 100 6,836,525 248 28,825,122 ↗ 148  % ↗ 322 % Medium 136 2,792,928 269 6,241,322 ↗ 98 % ↗ 123  % Small 115 912,259 233 2,184,337 ↗ 103  % ↗ 139 % Micro 46 196,528 438 1,369,480 ↗ 852  % ↗ 597  % 448 54,528,583 1,251 83,203,654 ↗ 179 % ↗ 53% Large companies Stability of amounts for claims paid (2%  ) A slight increase in the number of minor claims, possibly linked to the reduction in deductibles A very sharp rise in claims paid (four times the level of 2024) A very sharp rise in the number of minor claims (2.4 times higher than in 2024) Occurrence of "medium" and "major" claims Intermediate-sized companies Claims The distribution of claims in 2025 confirms a trend that began in 2024, with a resurgence in the number of minor claims following several years of decline. This trend is largely due to the rise in the number of incidents, combined with lower deductibles, which broadens the scope of claims eligible for compensation. There has also been a shift in the pattern of larger claims, with an increase in XL claims, but no marked rise in XXL claims (only one claim exceeding €10 million in 2025). In the intermediate-sized companies segment, the trend is particularly noticeable, with a sharp rise in the frequency and severity of minor claims, as well as the return of major events (XL), which had been absent in recent years, reflecting a resurgence in claims activity in this segment. Overall, 2025 is characterised by a significant rise in medium and XL claims, without any increase in the most extreme events, as well as a rise in small claims, which is undoubtedly linked to the reduction in deductibles. "This situation is actually a positive sign, insofar as it indicates that large companies have generally weathered the storm better than in other countries. By way of comparison, in the UK, a group such as Jaguar Land Rover faced a very large-scale loss in 2025. France is not currently experiencing this kind of situation," says Philippe Cotelle. Increase in medium and XL claims for intermediate-sized companies STATE OF THE MARKET IN ,*,/ 11 AMRAE Light Upon Cyber Insurance - 2026 0 20 40 60 80 140 120 100 Large companies Distribution of claim amounts by claim size 2019 2020 2021 2022 2023 2024 2025 XS/S €0–0.3 M M/L &nbsp;€0.3–3 M XL €3–10 M XXL €10–40 M 0 20 40 60 80 100 120 140 2020 An increase in severity due to the occurrence of just four XXL claims. 2021 Reduced severity, but results remain volatile. 2022/2023 Reduction in severity and frequency. 2024 A modest return to claim severity. 2025 Higher severity of medium and XL claims. Trend in the distribution of claims, 2019–2025 Statistical distribution of claims Large companies Distribution of the number of claims by claim size 0 20 40 60 80 100 XS/S €0–0.3 M M/L €0.3–3 M XL €3–10 M XXL €10–40 M 2019202020212022202320242025 Intermediate-sized companies Distribution of the number of claims by claim size 0 20 40 60 80 100 2019202020212022202320242025 Intermediate-sized companies Distribution of claim amounts by claim size 0 20 40 60 80 140 120 100 2019202020212022202320242025 A sharp rise in the frequency of minor claims A very sharp rise in the severity of claims Increase in the frequency of minor claims Just one claim exceeding €10 million in 2025 2019202020212022202320242025 XS/S €0–0.3 M M/L €0.3–3 M XL €3–10 M XXL €10–40 M XS/S €0–0.3 M M/L €0.3–3 M XL €3–10 M XXL €10–40 M XS/S €0–0.3 M M/L €0.3–3 M XL €3–10 M XXL €10–40 M 11 AMRAE Light Upon Cyber Insurance - 2026 12 AMRAE Light Upon Cyber Insurance - 2026 2. MARKET TREND ANALYSIS 12 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 13 AMRAE Light Upon Cyber Insurance - 2026 "The growing number of players in the market is intensifying competition among insurers, with some accepting price cuts in order to retain or win new business." Philippe Cotelle 2020 20212022202320242025 Trend of the average premium rate (%) Trend of average capacity (%) 2020 2021 2022 2023 2024 2025 -   40% -  20% 20% 40% 60% 80% 100% 0% 11 % 8% 97% 13% 97% - 2 4 % 12% - 1 2 % 8% - 1 8 % 17% - 3 2 % In 2025, large companies will see a slight increase in the number of insured businesses (from 5%  to 8%  ), with a very good claims-to-premiums ratio (rising from   17% to   22%). By contrast, the average premium rate shows a third consecutive decline, falling from    -12% in 2023 to    -18% in 2024, then to   -32% in 2025, reflecting a particularly pronounced trend. This development is mainly due to increased competition. 202020212022202320242025 8 % 5% -  5% 0% 5% 10% 15% 20% 25% -  4 % 21 % 17% 0% Trend in the number of insured companies (%) Market trend (%) 2025 reflects a context of increased competition among insurers Third consecutive fall in premium rates 0% 20% 40% 60% 80% 100% 120% 140% 160% 180% 200% 58% 190 % 16% 9% 17% 22 % Claims-to-premiums ratio (%) Claims-to- premiums ratio contained in 2025 MARKET TREND ANALYSIS 14 AMRAE Light Upon Cyber Insurance - 2026 In the intermediate-sized companies segment, two key factors stand out. Firstly, strong growth in the insured portfolio (from  32% in 2024 to  75% in 2025), reflecting increased market penetration; secondly, a sharp deterioration in the claims-to-premiums ratio, which rises to  42%, compared with  13% in 2024. At the same time, the decline in the average premium rate is continuing and accelerating (   -10% in 2024 compared with   -23% in 2025), despite this unfavourable technical signal, which raises questions about the sustainability of this trend. Market trend (%) Trend in the number of insured companies (%) 0% 10% 20 % 30 % 40 % 50 % 60 % 70 % 80 % 90 % 100 % 2020202120222023 20252024 20 % 12% 47 % 75 % 32% 0% 50% 100% 150% 200% 250% 300% Claims-to-premiums ratio (%) 85% 261 % 51 % 13 % 42&nbsp;% 21 % 2020 20212022202320242025 2020 2021 2022 2023 2024 2025 - 30% -20% -10% 10% 20% 30% 40% 50% 60% 70% 0% 7% -20 % -10 % -6% - 2 3 % -8% 56% -13 % 54% -8% Increased market penetration for intermediate-sized companies Significant deterioration in the claims-to- premiums ratio in 2025 2 nd consecutive fall in premium rates Trend of the average premium rate (%) Trend of average capacity (%) MARKET TREND ANALYSIS 15 AMRAE Light Upon Cyber Insurance - 2026 Medium-sized companies show a similar trend, with a significant increase in the number of insured companies (from 33% in 2024 to  97% in 2025), confirming the expansion of the market, and a claims-to-premiums ratio of  33%, which is also significant. For the first time, a decline in the average annual premium rate is observed in this segment (from 2%  to -7%), linked to the emergence of new distribution practices. "The development of simplified underwriting solutions, particularly through digital platforms that enable quick sign-up, has helped attract new businesses to cyber insurance." Philippe Cotelle -50% 0% 50% 100% 150% 200% 250% 16% 53 % 33 % 97 % 194 % -11 % 0% 20% 40% 60% 80% 100% 120% 45% 36% 100% 19% 22% 33 % 2020 2021 2022 2023 20252024 -20% -30% -40% -10% 10% 20% 30% 40% -1 % 21,78 % -7 % -37 % 22% 2% Claims-to-premiums ratio (%) Market trends (%) Trend in the number of insured companies (%) -7 % -20 % Favourable market conditions for medium-sized companies Deterioration in the claims-to- premiums ratio in 2025 0% 202020212022202320242025202020212022202320242025 Trend of the average premium rate (%) Trend of average subscribed capacity (%) MARKET TREND ANALYSIS 16 AMRAE Light Upon Cyber Insurance - 2026 3. OUTLOOK 16 AMRAE Light Upon Cyber Insurance - 2026 OUTLOOK FOR ,*,0" 17 AMRAE Light Upon Cyber Insurance - 2026 OUTLOOK → Looking ahead, with a claims-to-premiums ratio of  22%, which remains favourable for insurers, the large companies segment is expected to remain attractive in 2026, according to Philippe Cotelle: "The development of simplified underwriting solutions, particularly via digital platforms that enable quick sign-up, has helped attract new businesses to cyber insurance." → As regards intermediate-sized companies, a stabilisation of rates seems likely, given the rise in claims observed in this segment. Although there have been no major cyber incidents affecting large companies in France, the cyber threat remains very real, as illustrated by several recent events in Europe. The attack suffered by Marks &amp; Spencer in 2025 is a striking example, with a financial impact linked to operating losses exceeding £300 million, compounded by an estimated data loss of £59 million. The incident also had legal consequences, with a class action lawsuit in the pipeline, as well as damaging the group’s reputation among its customers. Furthermore, the case of the German industrial conglomerate Rheinmetall illustrates the heightened vulnerability of certain strategic sectors: this major player in the arms industry suffered a cyberattack resulting in data loss and a financial impact currently being assessed at over $10 million. Not to mention the major cyberattacks suffered by the British Co-op and the car manufacturer Jaguar Land Rover in the second half of 2025. These examples show that, even against a backdrop of falling premiums and intensifying competition, cyber risk remains capable of causing significant losses, including for leading companies and in critical sectors. 3 priorities for a sustainable market 1 Strengthening prevention: The softening of market premium pricing should free up resources to invest in prevention, detection, incident response and crisis management. 2 Maintaining a balance: Reductions in premiums and deductibles will only be sustainable if they remain consistent with changes in claims rates, the actual exposure of businesses and the quality of cybersecurity measures. 3 Structuring the cyber value chain: Insurers, brokers, risk managers, CISOs, cybersecurity providers and public sector bodies must strengthen their cooperation in order to better assess risks, support policyholders and reduce the cost of claims in the long term. Following a sharp rise in the average annual premium rate in 2021 (96.  81%), the correction phase is continuing: premium levels are gradually returning to those seen in 2020, which already appeared insufficient given the level of risk. "This situation could lead insurers to undertake strategic reviews of their positioning in 2026" , he continues. OUTLOOK 17 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 18 AMRAE Light Upon Cyber Insurance - 2026 4. ANALYSIS 18 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 19 AMRAE Light Upon Cyber Insurance - 2026 What is your take on the findings of the LUCY 2026 study? The trends presented here are consistent with what we are observing at Clusif: an increase in the number of incidents, mainly data breaches, DDoS attacks and ransomware, with generally more limited impacts. A key point concerns the rising risk associated with the supply chain. Attackers are increasingly targeting suppliers, particularly intermediate-sized companies, which act as entry points into large organisations. Regulations such as DORA specifically address this issue. As for Clusif, what lessons have emerged from the working group on cyber insurance? Cyber insurance is now seen as an integral part of overall risk management, rather than a stand-alone solution. Companies are seeking to obtain the right level of cover by focusing on their most critical assets. The main challenge remains quantifying cyber risk, particularly for major incidents such as ransomware attacks, the impact of which is difficult to assess precisely, as it depends on the IT system affected. Tools are emerging, but they still rely heavily on estimates. At Clusif, we emphasise the importance of taking out cyber insurance. In the event of an incident, it enables organisations to be put in touch with incident response teams (CSIRTs) and to rapidly mobilise the appropriate resources. It also serves as a lever for improving security posture, creating a virtuous circle. What are your thoughts on the results of Clusif’s Panocrim * 2025 report in light of these trends, particularly with regard to emerging risks? The supply chain is now clearly recognised as a major risk. Conversely, AI is increasingly seen as a catalyst for existing risks: in particular, it facilitates phishing and CEO fraud by making attacks more effective and accessible. As a result, new risks are emerging, such as data poisoning and bias. At the same time, certain already known threats continue to intensify: DDoS attacks, for example, are far easier to launch today than they were ten years ago, thanks to cheap and powerful tools. In this context, the challenge remains to strengthen the dialogue between insurers and businesses, as this represents a genuine meeting of two worlds that must learn to align more effectively. The aim is to share a common understanding of risk in order to tailor cover accordingly. * Cybersecurity overview "Cyber insurance is now seen as an integral part of overall risk management." Odile Duthil, Head of Cybersecurity at the Caisse des Dépôts Group, Chair of Clusif THE INTERVIEWCLUSIF’S VIEW ANALYSIS 19 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 20 AMRAE Light Upon Cyber Insurance - 2026 What is your reaction to the findings of the LUCY 2026 study compared with those of the CESIN Annual Corporate Cybersecurity Barometer? Overall, there is a strong correlation between the findings of this study and those of our survey. LUCY highlights a cyber insurance market that is easing, with a significant drop in premiums and more flexible terms. For our part, we have observed that companies have indeed benefited from more favourable terms when negotiating their policies, both in terms of price and deductibles. The current climate is seen as favourable for taking out or enhancing cover, with a high renewal rate of nearly 80  %. However, for the first time in several years, we are seeing an erosion in cybersecurity budgets, which are tending to stagnate or even decrease. This trend reflects a shift in the economic cycle, marked by budgetary trade-offs in an uncertain macroeconomic climate. The LUCY study highlights a significant rise in claims, particularly among intermediate-sized companies. What conclusions have you drawn from your own experience? Our findings reveal a trend that appears paradoxical but is consistent with the trends observed in LUCY. We have noted a decline in the overall number of significant incidents, which can be attributed to the efforts made in recent years to prevent attacks and secure systems. However, when attacks are successful, their impact is more severe. We are seeing fewer incidents, but they are more serious. Furthermore, some incidents are not reported to insurers, which means that the claims-to-premiums ratio is likely to be higher than that observed in insurance data alone. How do you see the market developing over the coming months? Against the current backdrop of increased budgetary constraints (budget cuts, freezes and prioritisation), companies are optimising their spending, particularly by renegotiating their cyber insurance cover. Furthermore, the growing importance of digital sovereignty issues tends either to redirect certain budgets towards European solutions, which may result in transfers or cuts in other areas, including cybersecurity, or to crystallise certain commitments or prolong the decision-making cycle, particularly for companies operating in international markets. Companies are thus seeking to create room for manoeuvre in a tighter budgetary environment. "For the first time in several years, we are seeing an erosion in cybersecurity budgets." Arnaud Martin, Head of Operational Risk at the Caisse des Dépôts Group, Treasurer of CesinTHE CESIN’S VIEW Key findings of the Cesin 2025 Barometer The Cesin Annual Corporate Cybersecurity Barometer, conducted in partnership with OpinionWay among 397 CISOs, highlights a decline in the number of significant attacks in 2025 (  40% of affected companies, compared with  47% in 2024). Nevertheless, the impact remains significant, with  81% of affected companies reporting consequences for their business, including production disruptions, damage to their reputation or data breaches. The study also highlights a shift in the nature of risk  :  53% of companies believe that state-sponsored threats are on the rise, whilst   30% consider that more than half of their incidents stem from third parties, partner suppliers or service providers. At the same time, organisations are continuing to mature in their approach, with   98% equipped with firewalls,  95% with EDR and  94% with multi-factor authentication, and  92% having identified their critical digital assets. Finally, the Barometer highlights, for the first time in three years, a slight decline in budgets, with the proportion of companies allocating at least 5%  of their IT budget to cybersecurity falling to  42% (compared to  48% in 2024). ANALYSIS 20 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 21 AMRAE Light Upon Cyber Insurance - 2026 The work carried out by AMRAE through the LUCY study is particularly valuable and illustrates a valuable French strength: the ability to bring market players together around an objective and shared vision of cyber risk. This update demonstrates that many companies have improved their cyber maturity, giving them greater access to cyber insurance. The challenge for ANSSI is now to provide broader support to businesses, particularly SMEs, notably through the forthcoming creation of a certification scheme tailored to their needs. The objective is clear: to better recognise the achievement of a nationally recognised security level, which should, in particular, help to streamline the underwriting process. "The challenge for ANSSI now is to provide broader support to businesses, particularly SMEs." Gaëtan PONCELIN DE RAUCOURT , Deputy Director of Strategy at ANSSI (National Agency for Information System Security) THE OPINION OF ANSSI ANALYSIS 21 AMRAE Light Upon Cyber Insurance - 2026 MARKET TREND ANALYSIS 22 AMRAE Light Upon Cyber Insurance - 2026 22 AMRAEL : Spotlight on Cyber Insurance – 2025 2025 confirms that competition in the cyber insurance market is intensifying, with a marked fall in premiums, particularly for large companies (   -32%), against a backdrop of increased competition among insurers. 2025 saw a significant rise in claims, with the total amount rising from €54 million to €83 million between 2024 and 2025, driven mainly by intermediate-sized companies, whose claims quadrupled. Despite this fall in prices, the market remains broadly profitable for large corporate accounts (with a claims- to-premiums ratio of   22%), which continues to fuel a commercial trend that benefits policyholders. Unlike other European markets, France has not seen a rise in the number of major claims involving large companies, but has observed an increase in intermediate claims (medium and XL) within this same segment. What are the key takeaways from 2026? The uptake of cyber insurance continues to grow, with the number of intermediate-sized and medium- sized companies purchasing cyber coverage almost doubling, driven largely by new players (MGAs, insurtechs) and more accessible products. Against this backdrop, 2025 highlights a growing disconnect between market dynamics (falling rates, intensifying competition) and the reality of risk (a marked rise in claims, particularly among intermediate-sized companies), raising questions about the sustainability of the pricing model in the medium term.&nbsp; 22 AMRAE Light Upon Cyber Insurance - 2026 Copyright Amrae 2026 – Any reproduction, in whole or in part, is strictly prohibited. Design: Agence La nageuse – Photo credits: Shutterstock / AdobeStock / iStock Amrae ("Association pour le Management des Risques et des Assurances de l’Entreprise") is the leading professional association for corporate risk and insurance professions. It is composed of more than 2,000 members belonging to 850 private or public organisations. Amrae helps these organisations achieve their strategic and operational objectives so that they can improve their performance and keep control of their risks. Amrae (the association) is made up of major players in the second and third lines of risk management (risk management, internal control and audit, insurance and legal). Through its scientific committees, publications and numerous events, Amrae produces content for these experts that enhances their skills, their development in their profession and their contribution to the success of the company’s strategy. With Amrae Formation, it fulfils their lifelong professional training needs by providing high-level certified training. Amrae Les Rencontres organizes the leading annual congress for the risk and insurance professions. This three-day event is the key professional conference for those involved in risk management and its financing. ABOUT AMRAE 36 Boulevard Sébastopol – 75004 Paris France Tel.: +33 (0)1 42 89 33 16 amrae.fr</p>