The role of cyber insurance in strengthening business resilience was discussed at the CIPR 2026 conference.
On 18 May, CIPR 2026 hosted an expert session entitled “Real-World Cyber Resilience Testing and Cyber Insurance in the Technology and Industrial Sectors”. Representatives of industry, the insurance market and information security companies discussed how businesses can build cyber resilience amid the growing number of attacks and why technical safeguards alone are no longer sufficient.
A key conclusion of the discussion was that, as cyberattacks become more frequent, companies need to move away from a “protect at any cost” mindset towards comprehensive risk management. This approach must combine preventive measures with mechanisms designed to mitigate the consequences of potential incidents.
Speaking at the session, Ivan Eremeev, Managing Director of RC Insurance Broker, noted that the Russian cyber insurance market is currently undergoing active development. “Different insurers currently take different approaches to risk assessment. There is no single methodology in place today. The market is still developing, and common practices have yet to be negotiated and established” — emphasized Ivan Eremeev.
According to Ivan Eremeev, the Russian insurance market can currently offer individual companies policy limits of up to 2–3 billion rubles. However, the number of major corporate policies remains limited, with approximately 200 contracts in force nationwide.
Approaches to cyber risk assessment are still evolving, while the lack of publicly available incident data remains one of the industry’s principal challenges. Nevertheless, the market is already able to provide businesses with substantial insurance capacity, and companies currently have an opportunity to secure particularly flexible terms.
“The cyber insurance market remains flexible. Insurers are learning how to assess this risk and are prepared to tailor terms to the needs of individual clients. In practical terms, cyber insurance can now be structured around a company’s actual business requirements. At the same time, the insurance market is already capable of providing coverage up to several billion rubles” — noted Ivan Eremeev.
One important conclusion of the discussion was that cyber insurance cannot replace an information security system, but it can become a valuable component of a comprehensive risk management strategy. Experts noted that, amid the growing number of attacks, businesses need to simultaneously invest in protective measures, regularly conduct independent resilience assessments, test post-incident recovery scenarios and establish financial mechanisms for compensating losses.
The session participants also emphasized the importance of openly sharing experience between companies. According to the experts, public analysis of real incidents allows the market to build practical expertise more rapidly, improve risk assessment methods and develop cyber resilience tools, including cyber insurance.
