Seventy Percent Now Buy Cyber. They Are Buying Faster Than They Are Governing.

Estimated reading time: 6 minutes

Seventy percent of US business insurance buyers now carry cyber cover. That is the highest share Travelers has recorded since its Risk Index turned cyber-focused in 2018. The same buyers report 89 percent day-to-day AI use across their workforce. Fifty-nine percent have formal practices governing that use.

They are buying the policy faster than they are writing the rules.

Cyber Insurance Adoption Rose At Every Size

The 2026 Travelers Risk Index puts purchase at 70 percent, up seven points on last year. Large businesses reached 82 percent, from 73. Small businesses reached 50 percent, from 43.

One qualification travels with those numbers. Hart Research surveyed 1,202 US business insurance decision-makers, not businesses generally. The figure describes people who already buy commercial insurance and have now added cyber. Half of the small businesses in that group still have not.

Cyber insurance take-up data stays scarce. Vendors publish threat counts, and carriers publish claims figures. Few publish what share of buyers actually purchase the product. That makes this the most useful number in the release.

The small business figure is the one to sit with. Half of the small businesses in a survey of insurance buyers still carry no cyber cover. These are companies that already buy commercial insurance and already talk to a broker. If the conversation about cyber happened, the answer was no.

Cyber Insurance Adoption Against A Softer Market

Set the Travelers figure beside another from earlier this year.

Cyber Insurance News reported Howden finding the cyber market down 27 percent since 2022. That measures market size. Travelers measures US buyer behavior. The two are not in conflict. Read together, they describe a shape brokers will recognize. More buyers are arriving while pricing softens. Distribution widens as rates fall.

Europe shows the same pull from a different angle. Research has pointed to the continent as the route back to growth. Cyber insurance adoption there has room to run.

The Thirty-Point AI Governance Gap

John Menefee, vice president and enterprise cyber lead at Travelers, named the finding himself. “This 30-point gap really stands out, and it cuts both ways,” he said.

Menefee then went further than carrier executives usually do in public. Companies are right to focus on what criminals do with AI. They should be “equally focused on the risks created by their own AI use” when practices and policies are missing.

That argument arrived twice this week from two carriers. AXA XL published research naming four AI loss scenarios that engage different policies. Travelers now reports nine in ten buyers running AI daily. Four in ten govern it informally or not at all.

Menefee framed the timing. AI is “creating opportunities for attackers just as companies are making progress on basic defenses,” he said.

Respondents named two external AI threats in particular. Attackers using AI to find and exploit system vulnerabilities. AI-generated phishing, deepfakes, and social engineering aimed at employees or customers.

Controls Moved Up, And One Still Lags

Every control Travelers tracks rose year on year.

• Firewall use reached 81 percent, from 76.
• Data backups reached 81 percent, from 76.
• Employee background checks reached 79 percent, from 70.
• Onboarding and offboarding protocols reached 74 percent, from 63.
• Multifactor authentication for administrative users reached 72 percent, up from 60.

That last figure carries the most weight for an underwriter. It means 28 percent of these buyers still do not require MFA on their administrative accounts in 2026.

Presence is not the whole question either. Our podcast episode on MFA and the claim that failed anyway covers the rest of it. A control can appear on the application form and prove absent at the moment of loss.

Sophos has recorded identity attacks dominating 2026. That is the exposure those 28 percent are carrying.

Cyber Threats Top The List Again

Cyber ranked as the top overall business concern for the fifth time in eight years. Fifty-eight percent of respondents worry some or a great deal about it.

• Broad economic uncertainty followed at 55 percent, having led last year.
• Medical cost inflation took 53 percent.
• The global economy’s impact on a company took 49 percent.
• Global and political conflict, terrorism, and social unrest took 48 percent.

Concern about a cyber event involving AI ranked as the second-highest specific cyber worry. Travelers reports it nearly tied with fears of a traditional security breach.

What The Confidence Numbers Say About Carriers

Two-thirds of respondents now rate themselves extremely or very confident in their cyber practices. Ninety-two percent said they are confident in their carrier’s cybersecurity expertise and guidance.

That second figure deserves attention from anyone selling this product. Buyers are treating carriers as security advisers rather than only as payers of claims. It also raises the standard. A broker who cannot answer an AI governance question now sits below what the client expects.

Travelers has been making that case through its own channels. Matthew Butler is Director of Cyber Risk services at the carrier. He described attackers compressing victims’ decision time on our podcast this month. Rising cyber insurance adoption puts more of those conversations in front of brokers who have to hold them.

Methodology And Disclosure

Hart Research conducted a national online survey of 1,202 US business insurance decision-makers between 15 and 28 June 2026. Travelers commissioned it. All findings are self-reported. Travelers sells cyber insurance. The survey reports rising demand for cyber insurance and high confidence in carriers. The 2025 all-respondent figure of 63 percent is arithmetic from the seven-point rise Travelers reports. The company did not publish it directly.

FAQ – Cyber Insurance Adoption

What share of businesses buy cyber insurance?

Travelers reports 70 percent of the US business insurance decision makers it surveyed have purchased cyber insurance, up seven points on 2025. That describes buyers of commercial insurance rather than US businesses generally.

How does purchase rate vary by company size?

Large businesses reached 82 percent, up from 73 percent. Small businesses reached 50 percent, up from 43 percent. Both figures rose year on year.

What is the AI governance gap?

Eighty-nine percent of respondents report day-to-day AI use across their workforce. Fifty-nine percent have formal practices governing that use. Travelers calls the 30-point difference a gap that cuts both ways.

Which cyber controls are most widely adopted?

Firewalls and data backups lead at 81 percent each, followed by employee background checks at 79 percent, onboarding and offboarding protocols at 74 percent, and multifactor authentication for administrative users at 72 percent.

Do businesses trust their insurance carriers on cyber?

Ninety-two percent said they are confident in their carrier’s cybersecurity expertise and guidance. Two-thirds rate themselves extremely or very confident in their own cyber practices.

Who conducted the survey?

Hart Research surveyed 1,202 US business insurance decision-makers between 15 and 28 June 2026. Travelers commissioned the research and sells cyber insurance.

Related Cyber Insurance Posts

• Cyber Insurance: A Must-Have for Businesses in the Digital Age(Opens in a new browser tab)
• Cyber Threats Remain Top Business Concern in 2025 Travelers Risk Index(Opens in a new browser tab)
• Vanta and Vouch Introduce Embedded Cyber Insurance to Simplify Compliance(Opens in a new browser tab)
• Cyber Risk Tops Business Concerns as Threats Surge, Travelers Report Finds(Opens in a new browser tab)
• Travelers Launches Cyber Risk Services to Support Policyholders(Opens in a new browser tab)