7 min read<\/p>\n
87 percent of German companies fell victim to cyberattacks last year. Total damage: \u20ac289 billion. Companies with cyber insurance: just 7 percent. This gap isn\u2019t an IT department oversight – it\u2019s a strategic failure at the C-level – and under NIS2, it carries personal liability.<\/strong><\/p>\n The Bitkom Economic Protection 2025 study<\/a> delivers a stark picture no boardroom presentation should omit: 87 percent of companies experienced data theft, industrial espionage, or sabotage in the past 12 months. 34 percent were hit by ransomware. 15 percent paid ransom. Total damage: \u20ac289.2 billion – a 30 percent jump from the previous year.<\/p>\n And yet only 7 percent hold cyber insurance. This isn\u2019t the result of a deliberate risk decision. In most cases, it reflects the fact that the question was never raised at the C-level. Over half of affected companies don\u2019t even know whom to contact in a crisis.<\/p>\n The global view confirms the pattern. According to the Munich Re Global Cyber Risk and Insurance Survey<\/a>, 87 percent of surveyed C-level decision-makers rate their organization\u2019s cyber protection as insufficient. Globally, Arctic Wolf reports only 47 percent of eligible organizations carry any cyber insurance at all – meaning Germany\u2019s 7 percent lags far behind an already low benchmark.<\/p>\n Root causes are structural: Many executives underestimate residual risk after technical investments. Others shy away from premium costs without weighing them against potential losses. And in more than a few cases, there\u2019s simply no awareness that cyber insurance is a board-level decision – not one to be negotiated within the IT department.<\/p>\n What is cyber insurance?<\/strong> Cyber insurance covers financial losses resulting from cyberattacks, data breaches, or IT system failures. Covered costs include IT forensics, crisis communications, business interruption, GDPR-mandated notifications to affected individuals, and legal counsel. It does not<\/em> replace IT security – it complements it as a financial safety net when all technical safeguards fail.<\/p>\n Munich Re\u2019s figures<\/a> reveal the scale: The global cyber insurance market will reach approximately $16.3 billion in premiums in 2025. By 2030, that figure is projected to double – to over $32 billion. Europe accounts for $3.3 billion (about 21 percent of the global total) and is growing fastest at 26 percent annually – a sign that European companies are slowly recognizing the gap.<\/p>\n According to Allianz Commercial, roughly 60 percent of major cyber insurance claims (exceeding \u20ac1 million) in the first half of 2025 stemmed from ransomware. Manufacturing leads in claim volume – a consequence of a 71 percent surge in attacks targeting the sector and increasing digitalization of production systems. The flip side: Average claim size dropped by over 50 percent during the same period, as insured companies demonstrated stronger incident-response processes.<\/p>\n Source: Bitkom Economic Protection 2025 (n = 1,003 companies with 10+ employees)<\/p>\n Cyber insurance is treated as an IT issue in many companies. That\u2019s wrong. The decision whether – and to what extent – a company insures itself against cyber risks touches three executive domains simultaneously: the CIO (risk assessment and security maturity), the CFO (premium budgeting and loss exposure), and the CEO (overall accountability and personal liability). None can decide alone.<\/p>\n NIS2 has enshrined this responsibility in law. Management bodies must approve and oversee cybersecurity risk management measures. Gross negligence may trigger personal fines of up to \u20ac10 million – or 2 percent of global annual turnover – as well as temporary professional bans. Whether a company needs cyber insurance forms part of this duty of care; ignoring it may constitute negligence.<\/p>\n For the financial sector, DORA adds further pressure: Every ICT third-party provider – including the insurer itself – must be registered and assessed. Its ability to deliver in a claim must be documented. A board unable to demonstrate systematic evaluation of the insurance question leaves itself exposed.<\/p>\n \n“We must continue raising our investments in IT security.” Wintergerst\u2019s call goes beyond technical measures. According to Bitkom, the share of IT budgets allocated to security has risen to 18 percent – up from 9 percent in 2022. Forty-one percent of companies already invest 20 percent or more. Yet technology alone isn\u2019t enough: The question isn\u2019t whether<\/em> an attack will happen – but when<\/em>. And then, insurance determines whether the company survives financially.<\/p>\n After two years of declining premiums, Munich Re forecasts a 15-20 percent rise for 2026<\/a>. Why? Claims frequency is outpacing premium income. Ransomware groups are becoming more professional; attack surfaces are expanding through remote work and IoT; and recovery costs are climbing alongside IT infrastructure complexity.<\/p>\n Insurers are responding with stricter underwriting criteria. Multi-factor authentication (MFA), tested backup strategies, documented incident-response plans, and regular penetration tests are no longer optional extras – they\u2019re prerequisites for coverage at acceptable rates. Companies lacking these fundamentals either receive no policy – or pay premiums that blow their budget.<\/p>\n For leadership, this means: If you lack cyber insurance today, you\u2019ll pay more tomorrow. And if you want to buy it, you\u2019ll first need to prove your organization meets basic security standards. Insurers\u2019 minimum requirements largely align with NIS2 obligations – fulfilling one prepares you for the other. That makes investing in security infrastructure doubly valuable.<\/p>\n A counterpoint is valid: Not every organization needs full coverage. For those with highly mature security postures, self-insurance may be economically rational. But that choice must rest on a documented risk analysis – not inaction. The board must be able to demonstrate it consciously addressed the question.<\/p>\n These questions form the core of responsible cyber-risk strategy. Each demands a documented answer – for internal governance and for NIS2 compliance verification.<\/p>\n 1. What is our maximum potential loss exposure?<\/strong> A ransomware-induced operational shutdown costs between \u20ac50,000 and \u20ac5 million per day, depending on industry and company size. The board must know its own organization\u2019s loss ceiling – both to inform insurance decisions and to meet NIS2\u2019s risk documentation requirements.<\/p>\n 2. Which risks do we insure – and which do we retain?<\/strong> Not every policy covers every loss. War exclusions, systemic infrastructure failures, and state-sponsored attacks are frequently excluded. The board must understand coverage gaps – and document why specific residual risks are consciously accepted.<\/p>\n 3. Do we meet insurers\u2019 minimum requirements?<\/strong> Without MFA, backups, and an incident-response plan, affordable protection is off the table. These requirements mirror NIS2 obligations – meeting one prepares you for the other.<\/p>\n A 7 percent insurance rate amid 87 percent victimization isn\u2019t a statistic – it\u2019s a wake-up call. Cyber insurance doesn\u2019t belong in the IT department. It belongs on the C-level agenda. NIS2 makes that discussion mandatory. And rising premiums make waiting more expensive than acting. The first step: A documented risk analysis quantifying maximum loss exposure. Without that number, rational decisions on insurance – or security investment – are impossible.<\/p>\n Premiums vary widely by industry, company size, and security maturity. For a firm with 100-500 employees and baseline security controls, annual premiums typically range from \u20ac5,000 to \u20ac50,000 – covering sums of \u20ac1 million to \u20ac10 million. Companies lacking MFA or current backups pay significantly more – or receive no coverage at all.<\/p>\n<\/details>\n Typical coverage includes business interruption, IT forensics, crisis communications, GDPR-mandated notifications to affected individuals, legal counsel, ransom payments (policy-dependent), and data restoration. Exclusions usually apply to state-sponsored attacks (\u201cWar Exclusion\u201d), reputational harm, and pre-existing vulnerabilities known before policy inception.<\/p>\n<\/details>\n No. Cyber insurance is a financial safety net – not a substitute for IT security. Insurers require foundational safeguards as a condition of coverage: multi-factor authentication, regular backups, patch management, and an incident-response plan. Organizations lacking these either get no policy – or premiums become commercially unviable.<\/p>\n<\/details>\n After two years of falling premiums, Munich Re forecasts a 15-20 percent increase. Drivers include rising ransomware claim frequency, higher recovery costs, and tightening regulatory demands under NIS2 and DORA. Demand is also surging as more companies seek coverage.<\/p>\n<\/details>\n NIS2 does not mandate cyber insurance outright. However, it obliges management bodies to approve and monitor cybersecurity risk management – including assessing the financial impact of cyber incidents. A board that neither purchases insurance nor documents its rationale for declining it opens itself to allegations of negligence.<\/p>\n<\/details>\n Header Image Source: Pexels \/ Vlada Karpovich (px:7433929)<\/p>\n","protected":false},"excerpt":{"rendered":" 7 min read 87 percent of German companies fell victim to cyberattacks last year. Total damage: \u20ac289 billion. Companies with cyber insurance: just 7 percent. This gap isn\u2019t an IT department oversight – it\u2019s a strategic failure at the C-level – and under NIS2, it carries personal liability. TL;DR 7 percent insured: Only 7 out […]<\/p>\n","protected":false},"author":114,"featured_media":14675,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyberattacks","_yoast_wpseo_title":"Cyberattacks: Protect your business from digital threats","_yoast_wpseo_metadesc":"Cyber insurance 93% of German companies lack protection against cyberattacks, risking massive financial losses\u2014get covered today and secure your business now.","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[678,702,673],"tags":[],"class_list":["post-14992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","category-managed-services-en","category-reboot-germany","entry"],"wpml_language":"en","wpml_translation_of":14676,"yoast_head":"\nTL;DR<\/h2>\n
\n
7 Percent: The Number That Should Wake Up the Executive Suite<\/h2>\n
What Cyber Insurance Covers – and What It Doesn\u2019t<\/h2>\n
Why the Board Must Decide<\/h2>\n
\nDr. Ralf Wintergerst, President of Bitkom (Bitkom Economic Protection 2025)<\/cite>\n<\/p><\/blockquote>\nThe Premium Trap: Why Insurers Are Scrutinizing Applications More Closely<\/h2>\n
Three Questions the Board Must Answer<\/h2>\n
Conclusion<\/h2>\n
Frequently Asked Questions<\/h2>\n
How much does cyber insurance cost for a mid-sized company?<\/strong><\/summary>\n
What losses does cyber insurance cover?<\/strong><\/summary>\n
Does cyber insurance replace technical security measures?<\/strong><\/summary>\n
Why did premiums rise in 2026?<\/strong><\/summary>\n
Does NIS2 explicitly require boards to purchase cyber insurance?<\/strong><\/summary>\n
Editor\u2019s Reading Recommendations<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n