How is cyber insurance premium calculated? Revenue, then controls

Cyber insurance premium is calculated by starting from a base premium set by the applicant's annual revenue or assets, then multiplying it by factors: the industry's hazard class, the limit and retention chosen, the loss history, and the quality of the applicant's security controls, with a final adjustment the underwriter may apply within the range the rating plan allows. A peer-reviewed study of the cyber rating plans filed with three state regulators found that "The factor that assigns the greatest influence on the premium is the base asset value or revenues of the applicant's firm" (Romanosky et al., Journal of Cybersecurity, 2019). Controls come second, as credits and debits. Because the size of those credits is a judgment, the evidence behind each control grade matters: Botminds' Cyber Underwriting Risk Assessment exists to put every signed answer beside that evidence before the price is set.

This guide walks through each factor, works one premium through a filed-style calculation, and shows where an underwriter's judgment enters and how a contradicted application answer changes the quote. It is written for risk managers buying cyber cover, brokers and newer underwriters. The filed figures come from the RAND study of 2007–2017 filings; current plans differ in their numbers but mostly not in their shape.

How is cyber insurance premium calculated? A base rate times a chain of factors

The structure is multiplicative. Romanosky and colleagues, reading cyber rating plans filed with the New York, Pennsylvania and California insurance departments, describe it this way: "the base premium is assessed as a function of the insured's annual revenues or assets", and "This base premium is then multiplied by variables relating to standard insurance and industry-related factors." Security questions then feed rating modifiers that let the underwriter debit or credit the premium for the insured's own attributes.

Some filed plans in the study were simpler. A flat-rate plan priced from an expected loss, a frequency times a severity, and added a profit load; others used a single modifier for a hazard group assigned by business type. The multiplicative plan is the one where the underwriter's reading of the controls changes the result, and the one this guide follows.

Does revenue affect cyber insurance price? It sets the base

Yes: revenue, or assets, sets the starting point, and it is applied by table rather than by judgment. One filed plan in the study priced the annual gross base premium by revenue band as follows, before any other factor. Revenue is a proxy for what is at risk: the volume of data, transactions and operations an incident can interrupt. The study's own reading is that carriers "focus on data and the potential loss at risk".

Two things follow for a buyer. A company that grows into a new band pays more before anyone looks at its security; and the base is the same for two companies of the same size whatever their controls. The controls only move the price from there.

Limits, retention and loss history move the cyber premium next

The limit and the retention are the buyer's own choices, and they move the price in the obvious direction: in the study's words, "the greater the limits, or the smaller the deductible, the larger will be the premium." A plan expresses this through factors for the limit and the retention, set by the carrier.

Loss history is a debit, and a predictable one: "Premiums typically increase about 10% for each event." Claims also point the underwriter at a control. A past funds-transfer fraud raises the question of how payment changes are verified; a past ransomware event raises the questions about backups and remote access. In the fictional sample submission used across this series, one spoofed-invoice loss of $84,300 in 2024 sits beside a payment call-back answer the evidence confirms and a DMARC setting that still allows the domain to be spoofed.

Do security controls lower cyber premiums? Through credits and debits within filed ranges

Yes, but through modifiers whose size the underwriter chooses within a range, not through a fixed price per control. One filed plan in the study rated several security factors on four levels, "poor, fair, good, excellent", with weights from 0.75 to 0.85 for excellent and 1.25 to 1.50 for poor. Another asked "Are penetration tests conducted on the insured's network at least annually?" and applied 0.85 to 0.95 for yes and 1.10 to 1.20 for no. A third allowed the underwriter to "multiply (either reduce, or increase) the premium by as much as 0.85 up to 1.7."

Regulators want this channel used. New York's Department of Financial Services told cyber insurers to "incentivize the adoption of better cybersecurity measures by pricing policies based on the effectiveness of each insured's cybersecurity program" (DFS Circular Letter No. 2, 2021). The operative word is effectiveness: a credit earned by a signed answer that the evidence contradicts is a credit for a control that is not there.

Priced, required or eligibility: three ways a control reaches the cyber price

Not every control is priced. A carrier's minimum-controls guide sorts each one into a treatment, and only one of the treatments is a premium credit or debit. An eligibility control must be in place or the carrier will not quote; a required control must be in place or become a condition of binding; a priced control moves the premium and nothing else. The same control can sit in different treatments for companies of different sizes.

The fictional sample carrier's guide shows how. MFA on privileged accounts is priced for companies under $50 million of revenue, required from $50 million to $500 million, and an eligibility rule above that. Enforced DMARC is priced for the smallest band and required above it; network segmentation is not required for the smallest band, priced in the middle one and required for the largest. A small company missing DMARC pays a debit; a mid-sized one missing it gets a condition with a due date. The buyer sees a price in one case and a subjectivity in the other, for the same gap.

This is why "will better controls lower my premium?" has no single answer. A control the guide prices can earn a credit; a control the guide requires earns nothing extra when present, but costs a condition or a quote when absent. The buyer's broker can ask which treatment applies, and the underwriter's grade decides which side of it the company falls.

A worked cyber premium, step by step

The table below works one illustrative premium through the factors whose filed ranges the study reports, for a company with $35 million of revenue, one prior claim, security rated "good" and an annual penetration test. It is an illustration assembled from different filings, not any carrier's price, and it leaves out the limit, retention and industry factors, which the study does not quantify in the same way.

The spread is the lesson. The same $35 million company costs about $3,100 or about $6,100 depending on how its controls are rated, and the underwriter's discretionary range is wider still. A rating that wide is defensible only if the grades behind it are: the "good" security rating and the yes on the penetration test should each point to something the underwriter has seen.

Why controls move the cyber price less precisely than buyers expect

Controls change the price, but not by an amount anyone has measured precisely. The RAND authors were direct about it: "it is highly unlikely that any insurance underwriter would know the marginal reduction in risk that any of these provide", and "there is no authoritative source for cyber risk assessment." And "in a number of occasions," they observed, carriers "based their rates on the pricing of their competitors."

That was a study of filings made before 2018, and carriers now see far more claims: U.S. insurers reported 56,323 cyber claims to the NAIC for 2025 alone. But it explains a buyer's experience. Adding a control can move the premium less than expected, because the credit is a range and the underwriter chooses where in it to sit. And a weak control the underwriter can prove can move it more, because it can trigger a sublimit, a subjectivity or a decline rather than a modest debit.

Revenue is priced by table. Controls are priced by judgment. The judgment is only as good as the evidence the underwriter has read.

Why did my cyber insurance premium go up?

Four factors can raise it, and a renewal letter does not always say which. Revenue grew into a higher band. The loss history added an event. The carrier's own rating plan or guide changed. Or the controls were graded lower than last year, for example because the evidence changed: a remote desktop port now open, a firmware version now on CISA's list of known exploited vulnerabilities, a supplement count lower than the application claimed. A limit or retention change can explain it too.

Ask the broker which factor moved. In the fictional sample, the quote of $142,800 against $96,400 expiring was rated on revenue of $186.4 million, the freight and warehousing class and a control score of 78, the score the account reaches once three pre-bind subjectivities are met; it scored 58 on the evidence as submitted. The quote does not break the increase down further, and neither should a reader of it.

Are cyber insurance rates going down? What the premium totals show

Total premium fell in 2024 for the first time and rose again in 2025, more slowly than in the hard-market years. The NAIC reported "its first ever reduction in Direct Written Premium" for 2024, about $9.14 billion including alien surplus lines insurers, 7% below 2023 (NAIC Report on the Cybersecurity Insurance Market, 2025). For 2025 it reported $9.46 billion, "demonstrating sustained demand even as premium growth moderates and market conditions stabilize" (NAIC, October 2026).

Premium is not rate. A total can fall because fewer or smaller policies were written, and rise because more companies bought endorsements; the NAIC says endorsements now account for nearly two-thirds of policies in force. A buyer's own rate depends on the factors above far more than on the market's total. Where most of that premium is written, and why it matters for rates that are not filed, is in admitted vs non-admitted cyber insurance.

What a contradicted application answer does to the cyber quote

A contradiction can change the terms before it changes the price. The premium assumes the controls the application describes; when the evidence shows one is missing, the underwriter can debit the price, but the cleaner response is a subjectivity that restores the assumption, with a consequence if it is not met. In the sample, the exposed remote desktop became a pre-bind subjectivity, and if it is not met at binding, ransomware cover is sublimited to $2,500,000 at 50% coinsurance on a $5 million policy.

That is why the order of work matters. Grading every control against evidence before the quote lets the price rest on the controls the company has, and puts the cost of the gaps into terms the broker can see. Which questions make that grading possible is in cyber insurance application questions, and what the reading costs per submission is in the guide to automating the cyber underwriting process.

The quote rests on the controls the evidence supports

Which controls block, require or price: the guide behind the score

Questions people ask

What factors affect cyber insurance cost?

Revenue or assets, industry, the limit and retention, loss history and the security controls, plus the underwriter's discretion within the plan's range. In the filed plans the RAND study read, revenue had the greatest influence and each prior claim added about 10%.

How much does cyber insurance cost?

It depends on the policy type more than anything else. By our arithmetic on the NAIC's 2024 shares of premium and policies, the average domestic cyber endorsement cost about $118, the average primary policy about $2,530 and the average excess policy about $15,200; a company's own price depends on the factors above.

Does a penetration test lower my cyber premium?

It can. One filed plan applied a factor of 0.85 to 0.95 for an annual penetration test and 1.10 to 1.20 without one. A test also gives the underwriter evidence for controls a scan cannot see, such as MFA on administrator accounts.

Can an underwriter change the rated cyber premium?

Within limits. One filed plan in the study let the underwriter multiply the premium by 0.85 to 1.7. Surplus lines cyber, which writes most U.S. cyber premium, is not bound by filed rates at all, so the underwriter's guide carries even more weight.

Why was my cyber quote subject to conditions instead of a higher price?

Because the gap can be fixed. A missing control the insured can close before binding can be better handled by a subjectivity, with a sublimit or other consequence if it is not met, than by a permanent debit to the premium.