Cyber pricing is easing, but the pace of decline has slowed sharply. Howden Re's Risk-Adjusted Rate Change reforecast for 2026 projected -4.9% against actuals of -5.4%. For 2023 to 2025, the gap between forecast and actuals exceeded eight percentage points. This convergence suggests the market is stabilizing. However, it doesn't mean your exposure is shrinking.
This checklist is for buyers and brokers heading into renewal. It covers how to use a calmer market to lock in better terms while testing your program against two pressures: privacy litigation moving down-market and AI-accelerated vulnerability discovery. Each item has a clear done/not-done state and a description of what good looks like.
Prerequisites
Before you start, gather these:
- Your current Stand-Alone Cyber Policy or Cyber Endorsement, with all endorsements and the declarations page
- Your last completed Underwriting Questionnaire and any supporting Cyber Maturity Assessment
- Your data inventory, including where Nonpublic Information and consumer data is collected and stored
- A current list of critical vendors and shared technology dependencies
- Your claims history and any open First Notice of Loss records
Checklist
1. Confirm your policy trigger and retroactive date.
Check whether your policy is a Claims-Made Policy and locate the retroactive date. Third-party liability claims develop slowly, so a gap between when conduct occurred and when a claim is made can leave you exposed.
Done: Retroactive date is documented and, ideally, matches your original inception date or earlier.
Good looks like: No retroactive date reset at renewal, and a documented extended reporting period option.
2. Test liability limits against privacy litigation exposure.
Privacy and data breach litigation has been expanding down-market, with smaller businesses now facing claims once associated with large companies. Review your third-party liability sublimits for regulatory proceedings, privacy liability, and defense costs.
Done: You've compared your limits to realistic defense and settlement scenarios for your data volumes.
Good looks like: Liability limits sized to your record counts and jurisdictions, not inherited from last year's renewal.
3. Verify Duty to Defend language.
Confirm whether the insurer has a Duty to Defend or merely reimburses defense costs, and whether defense erodes the limit.
Done: Defense structure is documented and understood by legal and finance.
Good looks like: Defense costs outside limits where obtainable, or an explicit decision to accept erosion.
4. Review privacy-specific exclusions and wrongful collection language.
Read exclusions tied to tracking technologies, biometric data, and unauthorized data collection. These are where litigation-driven losses often fall.
Done: Each relevant exclusion is flagged, and you've asked your broker for the carrier's position in writing.
Good looks like: Exclusions are narrow, or carved back through sublimited affirmative coverage.
5. Audit your Breach Coach and panel vendor access.
Confirm your Breach Coach, forensic, and notification vendors are on the insurer's approved panel, and that any Insurer Consent Requirement is satisfied before you engage outside providers.
Done: Panel contacts are in your incident response plan with 24/7 numbers.
Good looks like: Pre-negotiated rates and pre-approved vendors, tested in a tabletop exercise.
6. Map your Breach Notification Requirements.
List the state, federal, and international obligations that apply to your data, including any sector rules such as the Insurance Data Security Model Law if you're in or serve the insurance sector. For critical infrastructure, check CIRCIA, and for EU operations, check the Network and Information Security Directive (NIS2).
Done: A current matrix of triggers, deadlines, and regulators exists.
Good looks like: Counsel has reviewed it in the past 12 months and it's linked to your incident response plan.
7. Evaluate Business Interruption Coverage and waiting periods.
Check the waiting period, the loss calculation method, and whether system failure (not just security events) is covered.
Done: You've modeled a realistic outage against your policy terms.
Good looks like: Waiting period matched to your actual recovery time objectives.
8. Scrutinize Contingent Business Interruption.
Analysts warn that event risk persists as organizations rely on shared technology infrastructure and connected applications. Confirm Contingent Business Interruption Coverage extends to your critical vendors, including non-IT suppliers and cloud providers.
Done: Your vendor dependency list is matched to named or scheduled coverage.
Good looks like: Sublimits sized to your top dependency, not a generic default.
9. Align your controls to what sits between a vulnerability and a claim.
Newly identified security flaws rose 105% between January and September 2026 versus the same period in 2025, yet actively exploited vulnerabilities make up less than half a percent of the total pool. Defense-in-depth measures such as segmentation, allow-listing, and strong access controls do significant work between an exploited flaw and a claim. Document these controls.
Done: You can evidence segmentation, application allow-listing, and access controls to an underwriter.
Good looks like: Controls are mapped to NIST CSF Core Functions, with a current CSF Organizational Profile.
10. Set a vulnerability prioritization rule.
AI is speeding discovery, so patching everything is not a plan. Prioritize by exploitation evidence and asset exposure, and use Attack Surface Scanning to see what an attacker sees.
Done: A written prioritization policy exists with defined remediation timelines.
Good looks like: Known-exploited flaws on internet-facing assets are remediated first, with metrics reported to leadership.
11. Protect yourself on the Underwriting Questionnaire.
Treat every answer as a representation. An Application Fraud Warranty can void coverage if answers prove inaccurate.
Done: Each answer has an internal owner and supporting evidence.
Good looks like: A sign-off trail from IT, security, and legal before submission.
12. Use the softer market to negotiate, not just save.
Stabilizing pricing gives you room to trade premium savings for broader terms. Rest-of-world rates are down an estimated 24.5% versus 9.7% in the US since early 2024, so if you have international subsidiaries, ask how global program structure affects your pricing.
Done: You've requested terms for higher limits, lower retentions, or broader liability language alongside the pricing quote.
Good looks like: You're buying coverage improvements, not just a lower number.
13. Review Cyber Extortion Coverage and Data Restoration Coverage conditions.
Confirm sublimits, consent requirements, and any conditions tied to backups or controls.
Done: Conditions are mapped to your actual backup and recovery practices.
Good looks like: No coverage condition you can't currently meet.
Common Mistakes
- Treating stabilization as safety. Slower rate decreases don't reduce liability exposure. Claims from the 2023 underwriting year are still developing, and liability losses can take years to show up.
- Assuming small size means low litigation risk. Privacy claims are reaching smaller businesses. Don't size liability limits on the assumption that you're too small to be targeted.
- Chasing premium alone. A lower price with narrower privacy wording is a worse buy.
- Over-reading vulnerability counts. A large rise in discovered flaws is not the same as a rise in exploitation. Controls and prioritization matter more than raw numbers.
- Skipping the broker conversation on carrier stability. Reinsurance capacity is concentrated, and a significant market event could affect pricing across the board. Ask how your carrier's reinsurance is structured.
Next Steps
Schedule a renewal working session at least 90 days before expiry. Assign owners for items 1 through 13, collect evidence for each, and send your broker a gap list rather than waiting for the renewal submission. Revisit items 2, 8, and 9 mid-term, since privacy litigation trends and technology dependencies shift faster than annual cycles.
If your January 1 renewal is approaching, start with items 1, 2, and 11. They carry the most coverage risk and the most room for error.
