A first-of-its-kind study by Fenix24 and the Insurance Information Institute (Triple-I) reveals where insurers’ own cyber defenses fall short of the standards they set for policyholders.

What You’ll Learn

• Why most insurer recovery tests don’t reflect real ransomware conditions
• Where authentication and access controls still leave gaps for threat actors to exploit
• How patching cadence compares to the speed of modern vulnerability exploitation
• What separates systematic preparation from a false sense of security

The cyber insurance market reached $15.3 billion in net premiums written in 2024. Insurers evaluate risk, enforce security controls, and pay the claims when defenses fail. But when it comes to their own infrastructure, the findings tell a more complicated story.

Download the full report to see where the industry stands.