Pen Underwriting to Double UK Cyber Cover to £10 Million for SMEs as Cyber Threats Mount

Pen Underwriting, a UK managing general agent (MGA), announced it will double its cyber insurance cover limit to £10 million ($13.3 million) for small and medium-sized enterprises (SMEs) with revenue of up to £600 million, effective July 1, 2026. The expansion reflects both growing demand for cyber protection and the escalating severity of cyber threats facing businesses of all sizes.

The move comes amid stark warnings from across the insurance industry about the cyber risk landscape. USAA chief executive Juan Andrade described cyberattacks as 'one of the most existentialist threats' facing the industry today, noting that his company blocked eight billion intrusion attempts last year as AI gives adversaries powerful new tools to identify and exploit vulnerabilities. This dual-edged dynamic — where AI accelerates both the sophistication of attacks and the precision of insurers' underwriting — is reshaping the cyber insurance market.

Industry experts have also raised concerns about the structure of cyber coverage itself. Trium CEO Josh Ladeau warned that enterprise clients requiring vendors to carry cyber insurance are often relying on policy limits shared with dozens of other customers — a structure that creates a false sense of financial security and breaks down in aggregated loss events where a single incident affects many policyholders simultaneously. This 'accumulation risk' has become a central concern for regulators including Germany's BaFin.

The expansion of cyber limits for SMEs is significant because smaller businesses are increasingly targeted by cybercriminals yet often lack the resources and expertise to defend themselves. By raising available coverage, Pen Underwriting addresses a protection gap in a segment that has historically been underserved. The development fits within a broader market context in which Munich Re estimates the global cyber insurance market reached approximately $15 billion in premiums in 2025, with growth projected to continue at double-digit annual rates through 2030 as regulatory mandates and rising threat frequency drive adoption.