Josephine Wolff argues that cyber insurance is ineffective at reducing losses because it normalizes paying ransoms, which works against making ransomware less profitable. It is an argument, not a settled finding. A buyer can act on it by pairing cover with controls and a clear payment decision process.
The argument
The Wikipedia entry on cyber insurance summarizes Wolff's position this way: insurance that pays ransoms or related costs makes payment a routine business cost. If payment is routine, attackers keep earning, and the incentive to attack stays high.
This ties to a standard economic worry. If the party that bears the loss is shielded from it, it has less reason to prevent it. That is moral hazard. See moral hazard in cyber insurance.
The counterpoints
Several points push the other way, and the cited source does not settle them.
- Underwriting can raise standards. Wikipedia notes many policies require an IT security audit before binding, which can reveal vulnerabilities that must be fixed first.
- Insurance funds recovery. The same entry says insurance provides a funding mechanism for recovering from major losses and helping businesses resume operations.
- Payment is not required by cover. A policy may reimburse a payment, but a firm still decides whether to pay. See should you pay a ransom and ransom payment decision questions.
- Payment has limits. Paying does not guarantee data comes back. See does paying a ransom get your data back.
Where the evidence is thin
The entry flags itself as needing more citations, so treat its summary as a pointer to the original scholarship. Do not use the argument to claim that insurance causes more attacks. The fair reading is that incentives are a concern, and the effect size is not established by the cited source.
What a buyer can do
- Decide before an incident. Write down who decides on payment, what questions they ask and what legal checks apply. See OFAC sanctions risk when paying a ransom.
- Invest in recovery. Immutable backups and tested restores reduce the need to pay. See immutable versus offline backups.
- Check for a decryptor first. See check for a free ransomware decryptor before paying.
- Read the policy for ransom terms. Understand limits, consent requirements and conditions.
- Treat insurance as the last layer. Prevent, detect and recover first.
This is educational material, not legal or insurance advice.
Quick check
Is it proven that insurance increases ransomware?
No. It is an argument about incentives. Underwriting standards and recovery funding may point the other way.
What reduces the need to pay a ransom?
Tested, protected backups and a rehearsed recovery plan.
Sources
Last reviewed: 19 October 2026.
