This article examines cyber market signals from Travelers/Corvus, Coalition, Cowbell, At-Bay, Marsh, CIAB, Chubb, AXA XL, and other broker, carrier, and security sources. It looks at ransomware activity, cyber rate movement, VPN and identity-driven claims, underwriting control requirements, and AI-enabled fraud to assess how cyber insurers are changing the economics and conditions of coverage.

This deep dive covers:

Cyber insurers are lowering or stabilizing prices in 2025–26 while ransomware activity remains elevated. Travelers/Corvus reported more than 2,400 victims posted to leak sites in Q1 2026, with 84 active groups, yet broker indexes show cyber rates still declining. The implication is a split market: preferred risks are getting price relief while weaker risks are being filtered through tighter underwriting.

Cyber is entering the awkward phase of its cycle. Buyers are seeing softer pricing, more capacity, broader terms, and more competition for large shared-layered programs. At the same time, the loss environment has not returned to a calmer baseline. Travelers, through Corvus, reported the second-worst ransomware quarter on record in Q1 2026, just below Q4 2025. The report counted more than 2,400 organizations posted to ransomware leak sites and 84 active ransomware groups, including 19 appearing for the first time.

That is the conversion point for carriers, brokers, and insureds: the rate cycle says competition is back, but the threat data says the underwriting problem has become more technical, more fragmented, and harder to mean-revert away. The market is giving price relief where underwriters believe risk can be verified, segmented, and controlled. It is much less clear that the same logic holds across weaker controls, exposed remote access, mid-market accounts, and systemic dependencies.

The case for rate softening is not imaginary. Coalition’s 2026 claims data found initial ransom demands rose