Admitted vs non-admitted cyber insurance is not a niche distinction: most U.S. cyber premium is non-admitted. An admitted insurer is licensed in the state and files its rates and forms with the regulator; a non-admitted, or surplus lines, insurer is not licensed there but is eligible to be used through a licensed surplus lines broker, with its rates and forms free of state approval and its policyholders outside the state guaranty fund. In 2024, U.S. insurers reported $2.74 billion of cyber premium written on admitted paper and $4.35 billion on surplus lines paper, and alien surplus lines insurers wrote about $2.06 billion more, so seven dollars in ten were surplus lines premium, 47.5% from U.S. insurers and 22.5% from alien ones, against 29.9% admitted, on our arithmetic (NAIC Report on the Cybersecurity Insurance Market, 2025). For the underwriter that means the carrier's own minimum-controls guide and wording library do much of the work a filed rating plan does elsewhere. Botminds' Cyber Underwriting Risk Assessment is built around that guide: it grades every submission against the carrier's rules and drafts conditions only from its approved wording.
This guide sets out who writes the market, why cyber sits so heavily in surplus lines, what changes for the buyer and the underwriter, and where the filing duties that follow are handled. The figures are the NAIC's, from the cyber supplement insurers file with their annual statements.
Who wrote U.S. cyber insurance premium in 2024
$9.14 billion of direct written premium
- Admitted, U.S. insurers · 29.9%
- Surplus lines, U.S. insurers · 47.5%
- Surplus lines, alien insurers · 22.5%
Is cyber insurance admitted or non-admitted? Both, but mostly surplus lines
Both kinds of insurer write cyber, and a buyer may meet either: an admitted cyber endorsement on a package policy, or a standalone policy placed through a surplus lines broker. The NAIC's data do not say which risks go where, but they show the market as a whole: in 2024 the cyber supplement recorded $2.74 billion of admitted premium against $4.35 billion of surplus lines premium from U.S.-domiciled insurers, before the alien insurers' share.
It was not always so. In 2019 surplus lines insurers wrote about a quarter of domestic cyber premium. The share jumped in 2021, when surplus lines premium tripled while admitted premium grew about a quarter, and it has stayed above half since. The jump came in the year the NAIC records total cyber premium rising 61%.
Surplus lines share of U.S.-domiciled cyber premium, 2019–2024
Why is most cyber insurance written in the surplus lines market?
Because the surplus lines market lets the carrier change price and wording quickly, and cyber has needed both. A surplus lines insurer's rates and forms are not approved by the state; Florida's required disclosure tells the insured so directly: no Florida regulatory agency approves a surplus lines insurer's rates or forms (Fla. Stat. § 626.916; the whole disclosure is quoted in the guide to Florida surplus lines diligent effort). In a line whose total premium rose 61% in one year and fell 7% in another, a carrier that can reprice and rewrite without a filing has an advantage.
The data problem points the same way. The U.S. Government Accountability Office reported in 2021 that the cyber market faced "Limited historical data on losses" and that "Cyber policies lack common definitions", with industry stakeholders noting that differing definitions "can lead to a lack of clarity on what is covered" (GAO-21-477). Filed rating plans need loss experience to support them; surplus lines pricing does not need a filing at all. That freedom moves the discipline from the regulator's file to the carrier's own guide.
What is the difference between admitted and non-admitted cyber insurance?
Five differences matter to a buyer and an underwriter: who approves rates and forms, who stands behind the policy if the insurer fails, who may place it, which notices go on it, and who files and pays tax on it. The table sets them side by side.
Admitted vs non-admitted cyber insurance, side by side
| Admitted cyber insurer | Non-admitted (surplus lines) cyber insurer | |
|---|---|---|
| Rates and forms | Filed with the state insurance department, and approved or accepted under that state’s rules | Not approved by the state; set by the carrier and its guide |
| If the insurer fails | Claims backed by the state guaranty association, within its limits | Not covered by the state guaranty fund |
| Who places it | Any licensed agent or broker appointed by the insurer | A licensed surplus lines broker, sometimes through a wholesale broker |
| Notice on the policy | Standard state notices | A statutory notice that the insurer is not licensed and the guaranty fund will not pay |
| Filing and tax | Premium tax paid by the insurer | Surplus lines tax and filings handled by the surplus lines broker |
Do non-admitted cyber policies have guaranty fund protection?
No, and the policy has to say so. State law requires a notice on the policy, in words like these. Illinois: "This contract is issued, pursuant to Section 445 of the Illinois Insurance Code, by a company not authorized and licensed to transact business in Illinois and as such is not covered by the Illinois Insurance Guaranty Fund" (215 ILCS 5/445). Texas: the insurer "is not a member of the property and casualty insurance guaranty association created under Chapter 462, Insurance Code" (Tex. Ins. Code ch. 981).
The NAIC's model act gives the plain-language version states can adopt: "These insurers do not participate in insurance guaranty funds. The guaranty funds will not pay your claims or protect your assets if the insurer becomes insolvent and is unable to make payments as promised" (NAIC Nonadmitted Insurance Model Act). For a cyber buyer, the practical consequence is that the insurer's own financial strength is the only backstop, and it is worth checking before the policy is placed.
Are non-admitted cyber policies safe?
They are as safe as the insurer behind them, and the state does not vouch for it. Texas makes the point in its required notice: "The Texas Department of Insurance does not audit the finances or review the solvency of the surplus lines insurer providing this coverage." Surplus lines insurers must still be eligible: a U.S. surplus lines insurer is licensed in its own state of domicile, and federal law bars states from prohibiting placements with non-U.S. insurers on the NAIC's Quarterly Listing of Alien Insurers (15 U.S.C. § 8204).
The buyer's checks are therefore about the carrier: its eligibility in the insured's home state, its financial strength, and its claims record. The policy's terms need equal attention, because without state form approval the wording can differ from carrier to carrier more than admitted forms do.
The U.S. cyber insurance market in 2025
$9.46B
direct written premium, including alien surplus lines insurers
$7.46B
written by U.S.-domiciled insurers, up from $2.75B in 2020
5.84M
domestic policies in force, up 33%
56,323
reported claims, up 20%
How big is the U.S. cyber insurance market, and what is it made of?
The U.S. market wrote $9.46 billion of cyber premium in 2025, including alien surplus lines insurers, after the first-ever fall in 2024. U.S.-domiciled insurers wrote $7.46 billion of it, up from $2.75 billion in 2020, on 5.84 million policies, and reported 56,323 claims (NAIC, October 2026).
Premium and policies tell different stories. For 2024 the NAIC split both by structure: primary policies were 65% of premium but 41.6% of policies, excess policies 31% of premium and 3.3% of policies, and endorsements 4% of premium but 55.1% of policies. The claims show the same skew: of claims closed in 2024, 28,555 were closed without payment and 9,941 with payment, and for excess policies the unpaid outnumbered the paid by more than twenty to one. The standalone policies, primary and excess, carry 96% of the premium, and they are the policies underwritten from a full submission rather than added to a package.
Who reports cyber premium to the NAIC?
U.S.-domiciled property and casualty insurers, admitted and surplus lines alike, report it in the Cybersecurity Insurance Coverage Supplement to their annual statement; the NAIC adds alien surplus lines data from its International Insurers Department. From the 2024 annual statements the supplement "changed from a two-way standalone/packaged split to a three-way primary/excess/endorsement split", and its new state-level part "creates state-level transparency for the first time since the NAIC began collecting data on cyber insurance."
Those reports are where every figure on this page comes from. They count premium, policies and claims; they do not say how each risk was underwritten. That evidence lives in each carrier's files, and in New York the supervisor expects it to be data-driven, as set out in NYDFS cyber insurance requirements.
What to check on a non-admitted cyber policy before it is bound
With no state approval of the form and no guaranty fund behind the claim, the checks a regulator would otherwise make fall to the broker and the buyer. Most of them are about the insurer and the wording; one is about the application itself, because on surplus lines paper the carrier's own guide decides what an untrue answer costs.
Six checks on a surplus lines cyber placement
- Is the insurer eligible in the insured’s home state?
A domestic surplus lines insurer licensed in its own state, or an alien insurer on the NAIC’s Quarterly Listing; the surplus lines broker confirms it.
- Is the insurer financially strong enough to stand alone?
No guaranty fund will pay if it fails. Look at its financial statements and its claims record before the quote is accepted.
- Does the policy carry the statutory notice?
The notice that the insurer is not licensed and the guaranty fund will not pay is required; its absence is a filing problem for the broker.
- Which conditions, sublimits and exclusions are carrier-specific?
Without form approval, wording on MFA, ransomware sublimits and waiting periods can differ more between carriers than on admitted forms.
- Are the application answers true today?
A subjectivity or exclusion tied to a control is only as safe as the answer behind it. Check the remote access, MFA and backup answers before signing.
- Who files and pays the surplus lines tax, and by when?
The surplus lines broker, in the insured’s home state, on that state’s deadline.
What surplus lines paper means for the cyber underwriter
Freedom from filed rates and forms means the carrier's own rules carry the weight a filing would. Without an approved rating plan, the underwriter's credits and debits rest on the carrier's guide and on the evidence read; the factors and their filed ranges, where they exist, are set out in how cyber insurance premium is calculated. Without an approved form, the subjectivities, conditions and sublimits the underwriter attaches are the carrier's own words, and they should come from an approved, versioned library, not from memory.
State law still limits that freedom in places. Florida, for example, requires that an exported policy form not be more favourable to the insured than similar admitted forms in actual use. And the surplus lines broker carries filing and tax duties in the insured's home state, on a deadline; the surplus lines filing requirements by state guide sets them out, and Botminds' Surplus Lines Filing Compliance handles them.
On surplus lines paper, the carrier's guide is the rulebook
Where Cyber Underwriting Risk Assessment fits in E&S cyber
The solution is built for the submission a wholesale broker sends to a surplus lines cyber carrier: an application, a ransomware supplement, an outside-in scan the carrier orders, sometimes a penetration test, and the loss history. Its agents grade fifteen controls against the carrier's own guide, draft subjectivities and conditions only from the carrier's library, and draft the letter to the broker and the note for the file. The fictional sample submission came from a wholesale broker for a $5 million limit, and the quote went back to her with three pre-bind subjectivities in the carrier's wording.
It works the same way on admitted paper, where the guide must sit inside the filed rating plan and form. What it does not do is the surplus lines broker's work: diligent search, the home-state filing and the tax stay with the broker and the filing team. How the decision and its reading divide between people and agents is in the guide to a cyber underwriting platform go-live.
The quote to the wholesale broker, with every condition in the carrier's words
Questions people ask
Is cyber insurance admitted or non-admitted?
It can be either. In 2024, 29.9% of U.S. cyber premium was written by admitted insurers, 47.5% by U.S. surplus lines insurers and 22.5% by alien surplus lines insurers, by our arithmetic on the NAIC's premium tables.
Is non-admitted insurance worse than admitted insurance?
Not necessarily. It lacks state rate and form approval and guaranty fund protection, so the insurer's financial strength and the policy wording deserve closer reading, and surplus lines insurers write most U.S. cyber premium.
Why does my cyber policy say the insurer is not licensed in my state?
Because it was placed in the surplus lines market, and state law requires the notice. Illinois, for example, requires a legend stating the company is "not authorized and licensed to transact business in Illinois" and is "not covered by the Illinois Insurance Guaranty Fund".
Can a business buy non-admitted cyber insurance directly?
Generally it is placed through a licensed surplus lines broker, sometimes via a wholesale broker working with the retail agent, and the broker handles the filings and the surplus lines tax for the insured's home state.
Is cyber insurance premium still growing?
Yes. After the NAIC recorded the market's first fall in 2024, about 7% to $9.14 billion, it reported $9.46 billion for 2025 including alien surplus lines insurers, with domestic policies in force up 33%.