Cyber insurance in India: From breach recovery to business resilience

India faced over 2.04 million cyber security incidents in 2024. It is time for businesses to treat cyber insurance as a strategic tool, not just a safety net.

In brief

• Today, it is a growing priority across industries. India's rapid digital transformation, cloud migration and fintech expansion have made cybersecurity a board-level issue.
• The Digital Personal Data Protection Act, 2023. An act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
• Yet, coverage gaps persist. Many policies still focus narrowly on data breaches, even as threat vectors expand. Forward-looking businesses are re-evaluating their insurance needs in light of evolving risk exposure and compliance expectations.
• This point is not present in the article. Should ideally be first mentioned in the article body and then here.

As cyber threats become more frequent, sophisticated and costly, insurers are rethinking how they underwrite, price and structure cyber coverage. India, in particular, has emerged as both a high-risk market and a hub for cyber innovation. According to a recent report by CERT-In, 2.04 million cybersecurity incidents were reported in India, underlining the scale of the risk. With regulatory changes, AI-enabled attacks and a growing dependence on third-party ecosystems, the traditional playbook for cyber insurance is fast becoming obsolete. In this evolving environment, understanding emerging risks is the first step toward building more resilient risk models and informed coverage strategies.

Insurers are recalibrating their risk models as the attack surface widens. Here are six key threats reshaping the landscape.

The future landscape of cyber insurance

Several key trends are shaping what cyber insurance will look like in the next few years:

• Rising premiums and tighter underwriting: Due to growing losses, cyber insurance premiums rose by 50% in 2023. Insurers are now more selective, often requiring proof of cybersecurity maturity before issuing policies.
  
  
• Policy customization: Standardised policies are fading. Industry-specific risks — like IP theft in pharma, or system outages in manufacturing — are leading to more tailored policy frameworks.
  
  
• More active collaboration: Regulators, insurers and CISOs are sharing threat intelligence and response models. Platforms like India’s National Cyber Coordination Centre (NCCC) are facilitating real-time data exchange — which may soon influence underwriting.
  
  
• Global regulatory pressure: With India’s DPDP Act in effect and frameworks like ISO 27001 being widely adopted, compliance will become a prerequisite to obtain or renew policies in the coming years.
  
  
• AI-related exclusions and policy clauses: With the rise of generative AI and autonomous systems, insurers are introducing specific clauses to address AI-related risks — such as liability for AI-generated content, deepfake attacks or model misuse. Expect future policies to include AI-specific exclusions or require compliance with standards like ISO/IEC 42001.
  

To stay ahead of cyber risk — and sifting insurance market dynamics —businesses must move from reactive to strategic. This means conducting annual cyber risk assessments aligned with business impact, mapping and monitoring third-party digital dependencies, and aligning cybersecurity investments with both regulatory frameworks and insurer expectations. Most importantly, cyber insurance should be treated not as a fallback but as a strategic lever in enterprise risk management.