Triangulating Market Softening Across Risk-Adjusted Indices, Renewal Pricing, and Capacity Flows: A Stronger Indicator of Cyber Excess of Loss Reinsurance Market Pricing
The January 2026 renewal season has delivered a conspicuous inflection point for cyber excess of loss reinsurance, particularly in cyber aggregate excess of loss and related stop-loss structures. The operative phrase in market commentary has been “softening,” but that shorthand deserves a disciplined explanation: softening is not merely a lower quoted rate. It is a composite movement in risk-adjusted price, attachment, limit, retentions, exclusions, hours clauses, event definitions, reinstatement provisions, and claims cooperation mechanics. When those terms move in the cedant’s favor while capacity expands, the market is not simply cheaper. It is structurally easier to buy. Gallagher Re’s Global Cyber Aggregate Excess of Loss Risk Adjusted Rating Index is a credible and decision-useful indicator of this shift, BUT it is best treated as one instrument in a wider triangulation that includes primary market rate indices, broker market surveys, and renewal-specific reinsurance placement intelligence. For a more profound view of softening, you cannot rely on the Gallagher RAR alone.
Gallagher Re’s updated index reports an average risk-adjusted rate change of negative 32 percent for cyber aggregate excess of loss at the 1/1/2026 renewals, explicitly attributing the move to an oversupply of reinsurance capacity and noting concurrent improvement in structural terms for buyers (Gallagher Re 2026). The analytical value of this index is methodological: it is not a simple “rate on line” statistic. Gallagher Re positions the measure as a risk-adjusted rating framework that incorporates its proprietary “view of risk,” including underlying rate changes, loss trends, the choice of volatility parameters, and catastrophe model selection, thereby attempting to normalize price for changing risk rather than treating price in isolation (Gallagher Re 2026; Artemis 2026). In cyber, where exposure is non-physical, correlated, and sensitive to security posture and systemic dependencies, that normalization is an important step toward comparability.
I have issues. A portfolio-derived index (no matter how well designed) remains a lens with a particular field of view. To convert “Gallagher says -32 percent” into an industry-level inference, the appropriate move is to check for congruence across independent methodologies. The first cross-check is the primary cyber insurance market itself, because reinsurers price cyber XOL with a forward-looking view of underlying frequency, severity, and insurer gross written premium momentum. Marsh’s Global Insurance Market Index reports that cyber insurance rates decreased globally, with declines observed across regions, indicating ongoing primary market competition and easing conditions into 2026 (Marsh 2025a). Marsh also reported continued overall commercial insurance rate declines through 2025, attributing improvements to capacity and competition, with favorable reinsurance pricing identified as a contributing driver in the broader market (Marsh 2025b). This matters because cyber reinsurance, especially aggregate XOL and stop loss, is ultimately a leveraged bet on the distribution of portfolio losses. When primary pricing continues to soften, cedants frequently seek more efficient aggregate protection, and reinsurers, facing competitive pressure and capital deployment targets, may offer improved terms to maintain relevance.
Another ‘cross-check’ is the market-wide “rate outlook” approach used by large intermediaries and advisors that are not limited to a single cyber aggregate XOL index. WTW’s Insurance Marketplace Realities 2026, while not a reinsurance-only instrument, reflects line of business expectations and provides a bounded forecast range for cyber risk pricing, signaling a generally stable to modestly decreasing environment rather than a tightening phase (WTW 2025a). Its companion market report emphasizes the role of abundant capital, citing industry surplus and reinsurance capital at historically large levels, which is consistent with the supply-side conditions that typically accompany softening, even when underlying hazard remains elevated (WTW 2025b). Capital availability does not guarantee lower prices, but it materially increases the probability that competitive dynamics, rather than scarcity pricing, will dominate renewals.
A third cross-check is renewal-specific intelligence from reinsurance brokers that are active in cyber placements, especially where commentary is anchored to observable deal flow rather than generalized sentiment. Guy Carpenter market commentary about the January 2026 renewal period indicates that non proportional cyber pricing declined, reported as reductions “up to” the mid twenties in some contexts, alongside an evolution in program design, including increased momentum for risk excess of loss solutions and a movement away from heavier reliance on quota share and aggregate stop loss toward structures better aligned to volatility and accumulation risk (Guy Carpenter 2025). That structural evolution supports the thesis that softening is not only a cheaper renewal; it is a market willing to re-trade form and function, enabling cedants to buy protection that is closer to their loss distribution and governance needs.
Observing the “totality of the circumstances”, these independent methods describe the same macro mechanism. Cyber reinsurance softening in early 2026 IS due to the interaction of supply, model-based confidence, and improved underwriting posture. On the supply side, more capacity (both traditional and alternative) was available and deployable. In an environment of ample capital, marginal participants compete by price and by terms, particularly in lines perceived as improving technically. On the technical side, the market has benefited from several years of underwriting and risk engineering tightening in cyber, including stronger baseline controls demanded by insurers, more selective risk acceptance, and more explicit sub-limits and exclusions for peak exposures. Even where threat activity remains significant, reinsurers price to expected loss and tail assumptions, and if they believe cedants have improved portfolio quality or that tail modeling is better parameterized, their risk-adjusted clearing prices can fall meaningfully. Gallagher Re’s methodology is explicitly built to capture this “risk versus price” dynamic. The broader market indicators show that the ecosystem conditions required for such a decline were present beyond a single intermediary’s book (Gallagher Re 2026; Marsh 2025a; WTW 2025b; Guy Carpenter 2025).
The eight-hundred-pound gorilla in the room for underwriters is that soft markets in cyber do not imply reduced hazard. Recent reporting on cyber claims and aggregate loss experience in some jurisdictions highlights that the loss environment can deteriorate rapidly, especially through correlated campaigns, supply chain compromise, and ransomware operations that scale across sectors (Financial Times 2025). This is why a rigorous assessment of softening must distinguish between price movement and risk movement. A risk-adjusted index can fall because price falls faster than risk, because risk improves faster than price, or both. The market’s apparent willingness to reduce attachment points and improve structures, alongside significant price reductions in cyber aggregate XOL, suggests competition and capital deployment pressure were powerful at 1/1/2026, but it does not eliminate the possibility of a sharp reversal if systemic loss experience challenges prevailing catastrophe assumptions.
My bottom line, the most accurate assessment is that cyber excess of loss reinsurance softening at 1/1/2026 was industry real, not merely idiosyncratic to Gallagher Re’s portfolio, but the magnitude of softening is distributional. Gallagher Re’s negative 32 percent risk adjusted number is best read as a strong directional signal in a defined product niche—cyber aggregate excess of loss—while other authoritative sources corroborate that cyber pricing conditions broadly eased and capacity was supportive, without always quantifying the same layer, peril definition, or contract form (Gallagher Re 2026; Marsh 2025a; WTW 2025a; Guy Carpenter 2025). For buyers, this is a window to upgrade program quality: secure cleaner event language, address silent cyber ambiguities, reduce frictional exclusions, and align aggregate structures to governance and stress testing. For reinsurers, it is a moment to ensure that price competition does not outrun disciplined tail assumptions, especially where systemic risk remains the line’s defining feature.
~ C. Constantin Poindexter Salcedo, MA, JD, CPCU, AFSB, ASLI, ARe, AINS, AIS
Bibliography
- Artemis. 2026. “Gallagher Re’s cyber aggregate XOL RAR index posts 32% decline at January renewals.” Artemis.
- Financial Times. 2025. “UK cyber insurance claims tripled in 2024, says trade body.” Financial Times.
- Gallagher Re. 2026. “Gallagher Re Cyber Risk Adjusted Rating (RAR) Index: 2026 Update.” Arthur J. Gallagher & Co. (Gallagher Re), News & Insights.
- Guy Carpenter. 2025. “Non-proportional cyber pricing falls up to 25% as XoL and hard retro gain ground at 1/1.” Renewal commentary as reported in Reinsurance News.
- Marsh. 2025a. “Global Insurance Market Index 2025.” Marsh, International Placement Services.
- Marsh. 2025b. “Global Insurance Market Index: Q2 2025.” Marsh, International Placement Services.
- WTW (Willis Towers Watson). 2025a. “Insurance Marketplace Realities 2026: Cyber Risk.” WTW Insights.
- WTW (Willis Towers Watson). 2025b. “Insurance Marketplace Realities 2026.” WTW Report.
