Insurance works when losses are independent: a few policyholders claim while most do not. Cyber losses often arrive together, because many firms run the same software. That correlation makes cover hard to price, which is why terms are tight and some events are excluded.
Independent versus correlated
A house fire in one town says little about a fire in another. An insurer can pool thousands of houses and predict the share that burn. A flaw in a widely used program is different. If one customer is hit, many may be hit at once.
Anderson and Moore, citing Bohme and Kataria, say interdependence of risk takes both local and global forms. Cyber attacks often exploit a vulnerability in a program used by many firms. Risks that are globally correlated, such as worms and viruses, and systemic risks such as Y2K, can be unattractive to insurers. They add that the local and global correlation of different attack types largely determines which insurance markets are feasible.
Correlation also changes buyer behavior
The same paper says correlated risk makes firms under-invest in both security technology and cyber insurance. If your loss depends partly on events you cannot control, your own spend buys less protection. See interdependent risk.
The information problem
Insurers also see less than the insured. Wikipedia notes many policies require an IT security audit before cover starts, which can reveal vulnerabilities, and the insured may have to fix them first. It ties part of the market failure to information asymmetry between insurers and the insured, alongside correlated risk.
What this means for a buyer
Expect these features in the market, and plan around them:
- Detailed questionnaires. Insurers need evidence to price. See how a CISO should prepare a cyber insurance application.
- Deductibles and control requirements. They exist to reduce hidden action. See moral hazard in cyber insurance.
- Exclusions for system wide events. Read the war and infrastructure wording closely. See the Lloyd's state backed attack exclusion.
- Limited capacity for tail events. Do not assume cover for the worst case you can imagine.
What it does not mean
It does not mean insurance is a bad idea. For many firms it funds recovery from a serious incident and can push controls up. It means treating it as one tool inside a wider plan: prevent, detect, recover, then transfer what is left.
Quick check
Why is correlated risk a problem for insurers?
Because many policyholders can be hit by the same event at the same time, which breaks the pooling that insurance relies on.
Does a policy replace security investment?
No. It transfers part of the financial loss, and insurers often require controls as a condition of cover.
Sources
Last reviewed: 19 October 2026.
