Cyber Insurance Rates Are Dropping, but Exclusions Widen

## Executive summary: Organizations should carefully review cyber insurance policies as carriers increasingly add exclusions (social engineering, employee actions, outdated software, M&A issues, acts of war, and mass cyber events), impose sub-limits and panels for large coverage requests, and emphasize tail coverage; AI has not yet materially changed policy terms.