India’s cyber insurance market remains small despite a sharp rise in digital threats, with over 2 million incidents recorded in 2024. Adoption is hampered by high costs for SMEs, complex policy wording, and a common belief that security tools alone provide enough protection. Investors and business owners are now facing a gap between expected coverage and actual payouts, as insurers tighten underwriting standards to manage losses.
The Cyber Risk Gap In India
The Indian cyber insurance landscape is facing a significant challenge as the speed and precision of digital attacks outpace current market offerings. While India recorded over 2.04 million cybersecurity incidents in 2024, the local insurance market remains small, estimated between $580 million and $750 million. This is a tiny portion of the $14.2 billion global market, highlighting a massive under-penetration in the Indian corporate sector.
Why Companies Hesitate to Insure
A primary hurdle is the persistent view that cyber risk is purely an IT department concern rather than a core business risk. Many organizations mistakenly believe that investing in robust cybersecurity software eliminates the need for insurance. However, insurance is designed to manage the financial fallout of an incident, whereas security tools are meant to reduce the likelihood of one. For small and mid-sized enterprises (SMEs), the barrier is often financial; high premiums relative to limited budgets lead many to treat security spending as a substitute for insurance coverage.
Product Complexity and Payout Issues
Businesses are finding it difficult to navigate the insurance process due to a lack of standardization. Policy wordings often vary widely across providers, creating a disconnect between what an enterprise believes it is covered for and what the actual contract provides. While companies may expect coverage for the vast majority of potential losses, hidden sub-limits, mandatory waiting periods, and specific policy exclusions often result in lower payouts than anticipated. Furthermore, a shortage of specialized actuaries and underwriters in India makes it harder for insurers to price these products accurately.
The Impact of AI on Underwriting
The rapid rise of AI-powered cyberattack tools has made threats more frequent and more damaging, particularly through automated phishing and reconnaissance. Most traditional actuarial models, which rely on historical data that does not account for AI, are struggling to keep up. This has led to inaccurate premium pricing. Consequently, premiums jumped by 50% in 2023, forcing insurers to become much more selective in their underwriting process.
Business Interruption Risks
For industries like manufacturing, the greatest threat is not just data theft but operational downtime. Attacks can lead to weeks or even months of suspended production, causing massive revenue losses. India currently ranks second globally in ransomware volume, with an average downtime of 21 days per incident. As companies integrate cyber risk quantification into their business planning, the demand for comprehensive coverage—which includes forensic support, legal counsel, and incident response services—is expected to rise.
What Investors Should Track
Investors monitoring the insurance and technology sectors should watch for three key trends: the standardization of policy forms by the industry, the development of more sophisticated AI-driven actuarial models, and the growth of mandatory insurance requirements in B2B contracts. These factors will determine whether the Indian cyber insurance market can effectively bridge the gap between rapidly evolving digital threats and the financial protection required by modern enterprises.