Cyber's next phase starts here - Howden Re's outlook for H2 2026

Howden Re's cyber leaders gathered for a roundtable discussion ahead of the Rendez-Vous de Monte Carlo, to discuss the market signals likely to shape cyber reinsurance through the 1 January renewals. These include early evidence of a potential shift in ceding behaviour, primary pricing diverging sharply by geography, and a sustained run of benign catastrophe years continuing to reshape how non-proportional cover is priced.

Luke Foord-Kelcey, Global Head of Cyber at Howden Re, Matthew Webb, Head of Cyber Clients and Strategy, and Harriet Gruen, Head of Cyber Threat Intelligence, shared their read on the market as attention turns to how 1 January renewals will take shape.

Quota share buying shows early signs of reversing

For three to four years, the pattern has held steady. Cedents have gradually reduced quota share cessions year-on-year and leaned more heavily on non-proportional cover. That downward trend in cessions is slowing and may even be reversing for some cedents. 

Howden Re's placement data shows the pace of decline slowing. The weighted average cession across quota share placements live on 1 July 2026 sits at 47.1%, down just 1.5 points on the position at the same point last year, with some early signs of that weighted average creeping back up.

"We're seeing some of the market's larger buyers rethink their quota share strategy for the first time in several years," said Foord-Kelcey. "It is certainly too early to call it a widespread reversal, but it's the first evidence in several years of that trend being bucked, and worth watching closely as 1.1 conversations begin."

Original market rates begin to stabilise

Howden Re's own pricing data shows cyber rates continuing to soften, but at a decelerating pace. The mid-year risk-adjusted rate change (RACR) reforecast across the market stands at -5.4% for 2026, an improvement on the -8.2% seen in 2025 and -7.3% in 2024. The RACR reforecast for 2026 also appears more accurate than previous years, with the original projection of 4.9%, lining up well with actuals at 5.4%. Between 2023 – 2025 we saw over an 8-percentage point delta between forecast and actuals. 

The picture diverges sharply by geography. Since the start of 2024, US rates are down an estimated 9.7%, while rest of world pricing is down 24.5%. Competition has increased in international markets because of the opportunities presented by lower penetration rates and a more favourable loss environment. Within the US, SME and small business rates have been broadly stable, while middle-market and large corporate accounts continue to see the steepest cuts on new business. Renewals across the book look to be finding more of a floor.

"The US and international markets are behaving quite differently right now," said Webb. "We're seeing signs of stabilisation in parts of the US book, particularly on renewals, but the rest of the world remains competitive."

Benign cat years continue to pressure non-proportional structures

A sustained run of years without a major cyber catastrophe loss continues to make non-proportional cover more competitive. Across aggregate stop loss placements live on 1 July 2026, the weighted average attachment point sits at 108% of the underlying limit, down 8 points on 2025, while the rate on line has eased to 7.23%. After adjusting for exposure, risk-adjusted rate reductions on business placed at mid-year averaged close to 20%, ranging from 10% to 40% depending on the placement.

"Several years without a major cyber catastrophe event have given non-proportional buyers real leverage," said Foord-Kelcey. "Attachment points keep coming down and pricing keeps following. The question for 1.1 is how much further that can go before the market resets."

AI and the exploitation gap

AI is creating two distinct challenges: it is becoming a source of insured exposure while simultaneously accelerating how attackers and defenders operate. Large language model penetration still trails mature technologies such as cloud services: AWS EC2 penetration among $5bn+ revenue companies sits above 60%, versus roughly a quarter for the leading LLM providers in the same band.

AI is also acting as an enabler on both sides of the fight. It is lowering the skill required to attack and giving defenders new tools of their own, from faster malware reverse engineering to accelerated vulnerability discovery. Howden Re's own tracking has identified at least 120 CVEs that reference Claude, one sign that LLMs are already reshaping how vulnerabilities get found in the first place.

The average time between a vulnerability being disclosed and exploited has fallen sharply over the past two years, and the share of exploited vulnerabilities that are zero-days, meaning they are already being exploited before a patch exists, keeps climbing.

This creates what Howden Re sees as an emerging exploitation gap. That ratio has trended down in 2026 compared with the past three years. Large language models appear to be driving the increase in vulnerabilities being identified in the first place, but that has not yet translated into a corresponding rise in exploitation.

"It's an open question," said Gruen. "Time-to-exploit is shrinking and zero-day exploitation is becoming more common, pointing towards more attacks. We're not seeing the overall exploitation rate rise to match it yet, but with threat actors moving faster and vulnerability discovery accelerating, this isn't a gap to get comfortable with. It's one we'll be watching closely over the next few renewal cycles.”

Outlook

Taken together, these signals point to a market recalibrating rather than one losing its footing. Buying behaviour is changing, pricing is beginning to diverge and threat dynamics continue to evolve. These shifts are likely to shape renewal discussions well beyond Monte Carlo.

Howden Re's cyber team will be in Monte Carlo throughout the week to talk through what it all means for 1.1.