Chen Zhi is the baby-faced tycoon who remains at large. He is accused of operating a multinational network based in Southeast Asia, perpetrating online scam operations. Disturbingly, suspected trafficked workers were brought in to defraud people globally.
It’s cyber fraud on an epic scale – exactly the sort fueling cyber incidents across the region. According to Aon’s 2025 Cyber Risk Report, released in August, cyber incidents in APAC in 2024 rose 29% year-on-year, and have increased 134% since 2020.
Although improved detection methods are leading to an increase in reported incidents, Aon attributes the driver behind the rises to emerging cyber risks. These include AI-driven deep fake attacks and social engineering scams.
A key challenge facing APAC insurance companies – both incumbents and new entrants seeking to expand their cyber footprint across the region – is incidents on the rise, coinciding with declining prices.
Market outlook and softening rates
London-headquartered CFC is one of Australia’s leading cyber providers.
Explaining the softening rates, CFC underwriting leader Scott Bailey notes that the market experienced a period of hardening starting around 2020, driven by escalating ransomware. Eventually, this resulted in rates reaching a more balanced and healthier level relative to the actual losses.
He observes: “I think, quite frankly, people have now seen some more profit from the class, and therefore new entrants have arrived. Therefore, there is an oversaturation of capacity, and therefore prices are coming down – so it’s the normal supply-demand imbalance.”
The scale of the price decline is striking. According to data from Marsh, Asia’s cyber insurance rates decreased by 5% in the third quarter of 2025, marking their seventh consecutive quarter of rate declines.
Digging deeper, some countries in the region have undergone very large price declines this year. China fell 13% in the second quarter, building on an 8% decline in the first. Thailand fell 18% in the first quarter and then 25% in the second quarter.
Scott Bailey
Underwriting Leader at CFCThe Asian lure
Despite the price drops, APAC remains an attractive cyber market. Capacity is still flushing into the region. For example, in September last year, Coalition, a successful US cyber insurtech, launched a cyber risk reinsurance intermediary. Coalition Re will help to provide capacity for cyber reinsurance treaties worldwide, including Asia Pacific.
In July, Lloyd’s Asia announced a new cyber capacity pooling arrangement, the ‘Lloyd’s XOL Cyber Insurance Facility’ developed with Antares, Munich Re Specialty – Global Markets, Syndicate Asia Newline and Tokio Marine Kiln.
Chris Baker
Head of Cyber, Asia at Munich ReExplaining the attraction, Chris Baker, Head of Cyber, Asia at Munich Re, said: “Based on Munich Re’s global cyber risk and insurance survey nearly 1 in 2 companies of the 7500 sample size had never been offered cyber insurance.
“Tackling this challenge of an enormous protection gap in a joint market effort is something Munich Re is actively supporting.
“We know that the economic burden from cyber incidents is increasing, yet the take up in cyber insurance is still very low compared to P&C. Given rapid risk dynamics in digital developments, Munich Re sees strong forces supporting a re-balancing of supply and demand.”
Alexandra Wrobel, Head of Cyber, Commercial Insurance Asia at Zurich, notes the increased capacity – but also the rising demand for cyber and the high need for coverage.
She says: “Globally, cyber claims are up nearly 29% year-on-year, and cyber insurance penetration in Asia remains relatively low, particularly among SMEs and middle-market clients.
“This acute protection gap is a pressing concern. At Zurich, we’ve seen a strong increase in uptake of our cyber solutions in APAC this year, reflecting the urgency of this issue.”
The SME protection gap
While multinationals are starting to embrace cyber across APAC, SME remains a huge opportunity.
Wrobel enthuses about serving SMEs digitally: “Many coverage options available to SMEs and smaller businesses do not reflect their digital exposure as they were designed for simpler models or traditionally designed for large enterprises and then ‘scaled down’ with the assumption that smaller businesses face smaller risks.
“The reality is that they have vastly different risk profiles from multinationals and require tailored solutions that address the nuances of their cyber exposure.
“Some SMEs also assume they do not qualify for coverage without realising how insurers can help them improve their risk posture through advisory, exposure assessments and resilience checks.”
CFC is a specialist in cyber-SME products and last year acquired Solution Underwriting, partly to bolster the proposition further.
Bailey says: “SME uptake is not high enough. I think we’re rallying, as many other carriers are, to increase that. With the larger corporate entities, it is very much a buyers’ market. Now’s the time to enhance your insurance placement.”
Alexandra Wrobel
Head of Asia Cyber, Commercial Insurance at ZurichNavigating a softer market
(Re)insurers may have optimism – but how do they navigate these softer market conditions and growing risks?
A major benefit to (re)insurers is that companies are getting better at cyber management.
Despite the increasing level of attacks, analysis of Allianz Commercial cyber claims shows severity is down by 50% and large claims frequency by 30% during H1 2025 to date, driven by larger companies’ elevated detection and response capabilities.
Added to this, insurers have high confidence in their own sophistication and infrastructure to handle the fast-evolving cyber threat.
Bailey says the best insurers offer a lot more than just risk transfer: “We have very intelligent underwriting tools that can dynamically detect risks and threats about the opportunities we’re seeing.
“So, we can sit here and from the outside looking into a business’s website, URL, infrastructure, we can see some of those challenges and issues.”
From the Munich Re perspective, Baker explains that the (re)insurer leans on regional experts across APAC, collaborating closely with global units to assess unique risks, exposures, and IT security postures.
Understanding both global trends and local industry nuances is essential, he stresses, especially given the evolving threat landscape.
Baker says: “Tailored expertise and local insights are crucial in navigating the complex, dynamic cyber risk environment across APAC.”
‘Very confident’
Looking ahead, Bailey predicts a turn in rates: “I don’t think it will be a long-term trend.
“I think that the market will find its sort of priced floor for the better phrase, and prices, rates will moderate at that point in time.”
Meanwhile, Munich Re is ‘very confident’ that cyber has the ingredients to grow.
Baker says: “The global market has doubled in the past 5 years, and we believe it has the potential to do it again over the next 5 years. Individual markets across APAC are at very different stages of maturity, and there will be a mix of SMEs and corporate clients who have never purchased cyber cover before. Munich Re remains passionate about actively tackling the protection gap.”
It’s clear that despite rising incidents and a softening market, (re)insurers remain bullish on APAC. Cyber in APAC may be less developed than US and Europe, but that also means overseas players can bring their sophistication and talent to address the protection gap. It’s no surprise capacity is still flushing in – when global carriers look for cyber premium growth, APAC is where they are placing their bets.
