Cyber Insurance
Cyber Insurance in India: Closing the Growing Protection Gap
Cyber insurance is one of the fastest-growing needs in Indian business and one of the least addressed
India is digitising at a pace few countries have matched. Every business connecting to the internet, every hospital digitising records, every MSME adopting digital payments is also expanding its attack surface. The cyber risk is growing. The insurance coverage is not keeping up.
CYBER RISK IS NOW MAINSTREAM BUSINESS RISK and the Indian insurance industry must treat it that way.
India’s digital economy is expanding rapidly in payments, healthcare, logistics, manufacturing, and financial services. Every sector is generating more data, running more systems, and connecting more devices than ever before. This is broadly positive. It also means that the consequences of a cyber incident ransomware, data breach, system outage are more severe, more disruptive, and more costly than they have ever been.
India ranked among the top five most targeted countries for cyber attacks globally in 2023, according to CERT-In. Critical infrastructure, healthcare systems, and financial institutions were among the primary targets. The average cost of a data breach in India reached ₹17.9 crore in 2024 a figure that continues to rise. (Source: CERT-In Annual Report 2023 / IBM Cost of a Data Breach Report India 2024)
Despite this, cyber insurance penetration in India remains extremely low. Most Indian businesses including large enterprises either have no cyber coverage or are significantly underinsured relative to their actual exposure. The gap between cyber risk and cyber insurance is one of the most significant protection gaps in the Indian market today.
This is not a niche product problem. It is a market maturity problem and it represents one of the largest untapped growth opportunities in Indian insurance.
The Cyber Risk Gap in Numbers
55+
Of new insurance policies in India now sold through digital channels
42%
Of IRDAI complaints relate to claims settlement and servicing where channel handoffs break down
25,000+
IRDAI-registered agents the human channel remains critical, but must work alongside digital
Distribution is no longer a choice between physical and digital. Future growth will come from integrating both into a single operating model.
Sources: CERT-In Annual Report 2023 · IBM Cost of a Data Breach Report India 2024 · IRDAI Annual Report 2023–24
Four forces driving cyber risk exposure in India
Rapid digitalisation across sectors
India’s healthcare, BFSI, logistics, and manufacturing sectors are digitising at unprecedented speed. Every system brought online expands the potential attack surface. The same infrastructure that drives efficiency also creates new vulnerabilities. (Source: CERT-In Annual Report 2023)
Increasing sophistication of attacks
Ransomware, supply chain attacks, and business email compromise are becoming more targeted and more costly. CERT-In reported over 13.91 lakh cyber incidents in 2023 a 300% increase over three years. Indian organisations in critical sectors are being targeted with increasing frequency and precision.
Regulatory pressure on data protection
India’s Digital Personal Data Protection Act 2023 introduces significant obligations on data fiduciaries and meaningful financial consequences for non-compliance. Organisations managing personal data now face regulatory risk alongside operational risk. Both are insurable. (Source: MeitY / DPDP Act 2023)
SME and MSME digital adoption
India’s 63 million MSMEs are rapidly adopting digital payments, cloud infrastructure, and online platforms often without enterprise-grade cybersecurity. This creates a large, underserved, and genuinely exposed market for cyber insurance. (Source: Ministry of MSME)
A cyber incident does not just cause financial loss. It causes operational disruption, reputational damage, regulatory scrutiny, and customer attrition simultaneously. The businesses that recover fastest are those with cyber insurance that covers not just the breach cost, but the full cost of response. Most Indian businesses today have neither the coverage nor the response plan.
The data landscape what Indian insurers can actually use
Data Layer · Security Posture Assessment
MFA adoption, patch maturity, endpoint coverage, cloud configuration
What underwriters measure
Multi-factor authentication adoption, patch management maturity, endpoint detection coverage, cloud security configuration, backup protocols, and third-party vendor access controls each factor contributes to a risk score that drives pricing.
Why it changes pricing
An organisation with strong MFA and updated patching is measurably less exposed than one without. Underwriters who can quantify this difference price more accurately and reduce adverse selection building a healthier, more sustainable cyber book.
Market signal
IRDAI’s regulatory sandbox has enabled multiple motor insurers to pilot usage-based insurance products signalling clear regulatory intent to enable telematics-driven pricing
Data Layer · Incident & Claims History
CERT-In incident data, sector breach frequency, loss severity benchmarks
The underwriting challenge
Cyber insurance lacks the decades of claims history available in motor or health. CERT-In reported over 13.91 lakh incidents in 2023 — but incident reports do not automatically translate into structured loss data. Underwriters must price risk that evolves continuously, on an incomplete historical baseline. (Source: CERT-In Annual Report 2023)
What good data looks like
Sector-level breach frequency, average incident cost by industry and company size, ransomware recovery timelines, and regulatory penalty data structured and updated regularly. Insurers who invest in building proprietary loss databases now will have a material underwriting advantage as the market matures.
Regulatory direction
IRDAI’s push toward mandatory cyber incident disclosure and the DPDP Act’s breach notification requirements will generate structured data over time gradually improving the actuarial foundation for cyber pricing in India. (Source: IRDAI / MeitY)
Three reasons cyber insurance is hard to underwrite and how to address them
1. Limited historical loss data
Traditional actuarial models rely on stable historical loss patterns. Cyber insurance has no such baseline attack vectors, incident costs, and threat actor tactics change faster than annual policy cycles. Insurers must build dynamic underwriting models incorporating real-time threat intelligence rather than relying solely on claims history that may already be outdated.
2. Accumulation risk is difficult to model
A single cyber event a cloud provider outage or widely-used software vulnerability can trigger simultaneous claims across hundreds of policyholders. This accumulation risk has no equivalent in traditional insurance lines. Managing portfolio-level cyber exposure requires scenario modelling and reinsurance structures that most Indian insurers are still developing.
3. Are we flagging fraud at submission or after payment?
Insurance fraud remains a significant and acknowledged leakage challenge across the Indian market. IRDAI has identified fraud detection as a supervisory priority, and analytics models trained on IIB data can shift detection to the point of submission before money leaves the organisation. (Source: IRDAI Annual Report 2023–24)
Four decisions for insurers building a cyber practice
-
Develop a cyber underwriting framework now not after the market grows
The insurers who will lead India's cyber market are building underwriting capability today risk assessment questionnaires, security scoring, incident response partnerships, and reinsurance treaties. Waiting for the market to develop before building the capability means entering it without the tools to price risk accurately. -
Design SME-specific cyber products not enterprise products at lower premiums
India's MSME segment represents the largest untapped cyber insurance market but it requires purpose-built products. Simplified coverage, modular add-ons, digital distribution, and pricing that reflects SME risk profiles rather than enterprise risk profiles. -
Partner with cybersecurity firms for pre-bind risk assessment
The strongest cyber underwriting decisions are backed by real security data not just questionnaire responses. Partnerships with cybersecurity assessment firms, threat intelligence providers, and incident response specialists allow insurers to price risk more accurately, reduce adverse selection, and add genuine value beyond indemnity. -
Work with government and regulators to build market awareness
Cyber insurance market growth in India requires demand-side development. IRDAI, CERT-In, and MeitY all have active cybersecurity mandates. Insurers who engage with these bodies to develop awareness frameworks, regulatory guidance, and public-private cyber protection programmes will shape the market - not just participate in it. (Source: IRDAI / CERT-In)
Recent Posts
Related Posts
EV Insurance in India: Challenges, Trends & Opportunities
Cyber Insurance in India: Closing the Growing Protection Gap
Omnichannel Insurance Distribution in India
Insurer Insurtech Partnerships and the Future of Indian Insurance
From Protection to Prediction: How Analytics Is Reshaping Insurance
