Cyber underwriter job description: a week on the desk, hour by hour

A cyber underwriter job description comes down to one decision made many times a week: whether to insure a business against cyber losses, and on what terms. The underwriter reads the submission (the application, a ransomware supplement, an outside-in scan of the company's internet-facing systems, sometimes a penetration test, and the loss history), grades the company's security controls against the carrier's minimum-controls guide, sets the limit, retention, premium and subjectivities within their authority, refers what is above it, and writes the note that explains the decision. Most of the hours go on the reading. Botminds' Cyber Underwriting Risk Assessment was built for those hours: its agents read every document, put each signed answer beside the evidence for it, and leave the decisions to the underwriter.

This guide describes the role as it is done, not as a posting describes it. The week below follows a fictional mid-market cyber desk with eleven submissions in the queue and seven quotes due by Friday; the hours per submission are Botminds' estimate for a mid-market account read by hand, about three and three-quarter hours, and the same work with the agents doing the reading.

What does a cyber underwriter do? The duties, in the order a submission meets them

The U.S. Bureau of Labor Statistics defines the occupation in two sentences that hold for cyber: "Insurance underwriters evaluate insurance applications and decide whether to approve them. For approved applications, underwriters determine coverage amounts and premiums" (BLS Occupational Outlook Handbook, insurance underwriters). In cyber, evaluation means reading a company's security in documents the company did not all write, and the duties fall in a fixed order.

First, triage: is the submission complete, inside appetite and worth the time before the quote date? Second, reading: every answer on the application and supplement, every finding on the scan and the penetration test, every claim in the loss history. Third, matching: which answers the evidence confirms, which it contradicts, which it cannot reach. Fourth, the decision: quote, decline or refer, and at what limit, retention and price. Fifth, the wording: subjectivities before binding, conditions after it, questions to the broker. Last, the note for the file, which a referral reviewer, an auditor or a claims handler will read later.

Only the fourth step and parts of the fifth are judgment. The BLS draws the same line between simple and complex lines: in common personal lines such as auto, underwriters mostly rely on automated recommendations, while complex commercial lines, its example is workers' compensation, depend on the underwriter's own analysis. Cyber sits firmly in the second group, and the analytical insight is spent on the decision only after the reading is done.

Where one cyber submission's hours go, reading against deciding

By hand, almost three-quarters of a submission's time is reading and matching. On Botminds' estimate for a mid-market account, reading the application and ransomware supplement takes an hour and a quarter, the scan and penetration test three-quarters of an hour, and putting each answer beside its evidence another three-quarters. Writing the subjectivities, the broker letter and the note takes the last hour. The decision itself is folded into the matching and the writing; it rarely has a slot of its own.

The second bar is shorter, and it is also a different kind of work. With the reading done, the underwriter's time goes to checking that each citation says what the grade claims, deciding what each contradiction means for this risk, and editing the wording that will reach the broker. That is the part of the job a posting describes when it asks for judgment.

What skills does a cyber underwriter need?

A cyber underwriter needs an underwriter's skills and enough security literacy to read the evidence. The BLS lists analytical skills first: "Underwriters must evaluate information from a variety of sources to balance risk against caution." In cyber the sources are unusually varied. A finding such as 3389/tcp open means a remote desktop login reachable from the internet; p=none on a DMARC record means the company's domain can still be spoofed; a firmware version on a VPN appliance means nothing until it is matched to a list of exploited flaws.

Regulators expect carriers to build that literacy. New York's Department of Financial Services lists "Obtain Cybersecurity Expertise" among its practices for cyber insurers: "Insurers should recruit employees with cybersecurity experience and skills and commit to their training and development, supplemented as necessary with consultants or vendors" (DFS Circular Letter No. 2, 2021). The UK Prudential Regulation Authority expects firms materially exposed to cyber risk to "understand the continuously evolving cyber landscape and demonstrate a continued commitment to developing their knowledge of cyber insurance underwriting risk" (PRA SS4/17).

The rest is the trade's common core: reading a wording, knowing where the carrier's appetite sits by industry and revenue band, negotiating with wholesale and retail brokers, and writing a note another underwriter can follow. The BLS notes that most firms prefer a bachelor's degree, often in business, and that beginning underwriters usually spend up to a year working under a senior underwriter's supervision.

Do cyber underwriters need a technical background?

No, but they need to read technical evidence without guessing at it. An underwriter can come from another commercial line and learn the controls on the job; the DFS practice above expects carriers to train them and to bring in specialists where needed. Where a carrier employs one, the specialist is a cyber risk engineer, who reads scans and penetration tests in depth and joins the larger or harder accounts.

The gap a technical background closes is translation: turning a finding into a statement about a signed answer. That is the step a tool can take over cleanly, because it is mechanical once the controls are defined. In the sample, the risk engineer's complaint before the solution was that he saw the open port but nobody told him what the client had signed; afterwards every scan and penetration-test finding sits beside the answer it bears on.

How much does a cyber underwriter make?

No official statistic separates cyber underwriters, so the honest answer starts from the occupation as a whole. The BLS puts the median annual wage for insurance underwriters at $81,370 in May 2025, with the lowest-paid tenth below $55,530 and the highest-paid tenth above $145,160. Pay within that range follows authority, account size and seniority; job postings quote higher and lower figures, but a posting is not a statistic, and the BLS range is the defensible one.

Employers pay more than the wage. What a carrier spends per underwriting hour, once benefits are added, and what that makes one submission cost, is worked through in the guide to automating the cyber underwriting process.

What is a cyber underwriting assistant, and what does the role carry?

A cyber underwriting assistant keeps submissions moving: logging them as they arrive, checking that each has the documents the guide requires, ordering the outside-in scan, chasing the broker for whatever is missing, and preparing the file for the underwriter. The chasing is the part that expands to fill the week: the sample assistant's line before the solution was that half the week went on asking brokers for the page that was missing.

The role changes when every submission is read on arrival. In the sample queue, two of eleven submissions were missing a supplement or a scan, and both were flagged the day they arrived, with the request to the broker already drafted: a county school district waiting on its ransomware supplement, and a cold-storage company whose scan was still running. The assistant's time moves from finding gaps to closing them.

The cyber submissions queue, ranked by the date the broker needs the quote

The 25-minute figure on this screen is the solution's design target for documents to graded scorecard, not a measured result.

The people around one cyber submission

A cyber submission passes through more hands than the underwriter's. The figure below follows the five roles in the sample, and what their week holds before and after the agents take the reading.

Is cyber underwriting a good career? What the numbers say

The occupation is shrinking slowly while the line it serves keeps growing, which is the pattern of a job being reshaped rather than removed. The BLS projects underwriter employment to fall 4% from 2025 to 2035, and puts it down to automated underwriting software, which lets fewer people process more applications. It still expects about 6,800 openings a year, all from people retiring or moving on.

Cyber is moving the other way. The NAIC's report for 2025 counts 5.84 million domestic cyber policies in force, up 33%, and 56,323 reported claims, up 20%, in a market of $9.46 billion of premium including alien surplus lines insurers (NAIC, October 2026). More policies and more claims mean more submissions to read and more decisions to defend. The underwriters who do well are the ones whose hours go to the decisions, which is the case for taking the reading off their desk. Where most of that premium is written, and what it means for the underwriter's freedom on wording, is in admitted vs non-admitted cyber insurance.

Which hours Cyber Underwriting Risk Assessment takes, and which it leaves

The solution takes the reading, the matching and the first draft of the wording; it leaves every decision. Its five agents read the application and supplement with question numbers and pages, map each scan and penetration-test finding to a control, grade each control against the carrier's guide citing both sides, draft subjectivities only from the approved library, and draft the note. None of them quotes, binds, declines, relaxes a condition or contacts the insured.

What the underwriter signs at the end is still their note. In the sample, the drafted note states the risk, every grade with its evidence, and the basis for quoting below the carrier's score floor; it records that the score of 58 sits above the referral line of 50, the $5 million limit is within the underwriter's authority, and no contradiction was overridden. The underwriter signs it, and the note, scorecard and evidence are filed together.

The underwriting note, drafted from the scorecard and signed by the underwriter

Questions people ask

How many submissions does a cyber underwriter review?

No official source publishes a figure, and it varies with account size and the carrier's process. Work it from your own desk: at Botminds' estimate of three to four hours of reading per mid-market submission by hand, seven quotes in a week consume most of an underwriter's working hours before any broker call or referral.

What is underwriting authority?

It is the limit, and sometimes the score or industry, up to which an underwriter may bind without a second signature. In the sample, the senior underwriter's authority runs to $5 million, and any file with a score under 50, a limit over $5 million or an overridden contradiction is referred to the head of cyber.

What is a subjectivity in cyber insurance?

A subjectivity is a condition the insured must meet before or after binding, such as closing an exposed remote desktop port or enforcing MFA on named accounts. Written well, it names the asset, the account and the deadline, and says what evidence will prove it met, such as a rescan.

How long does it take to train as an underwriter?

The BLS says beginning underwriters typically work under a senior underwriter's supervision for up to 12 months, learning the common risk factors on basic applications. Cyber adds the security literacy to read scans and penetration tests, which carriers are expected to train for.

Do cyber underwriters work with risk engineers?

Where the carrier employs risk engineers, yes: the risk engineer reads the scan and penetration test in depth and advises on the findings, while the underwriter owns the decision. Both work faster when every finding is already tied to the signed answer it tests.