The 2026 Cyber Renewal Looks Calm. The Exclusion Stack Behind It Doesn't.

The cyber renewal proposal on the desk this spring is going to read like a buyer's market. Marsh's U.S. cyber update has primary rates trending flat to negative ten percent across most industries. WTW's Marketplace Realities 2026 — Cyber Risk reads the same way for well-controlled accounts. The trade press is calling it the most favorable cyber buying environment in five years.

That read is half of the picture. The other half is on the schedule of endorsements.

Lloyd's of London updated its standalone cyber market requirements to formally exclude losses arising out of state-backed cyberattacks — even attacks occurring in peacetime, even attacks where attribution is contested. Insurance Thought Leadership's 2026 exclusions forecast adds shadow AI activity, non-consensual deepfake liability, zero-day exploits, and connected-IoT exposures to the list of exclusions carriers are filing into the 2026 renewal cycle. Wiley's 2026 cyber forecast describes a market increasingly defined by ambiguity at the policy edges — not by predictable protection inside them.

The premium is moving down. The promise is moving with it.

That is the gap the captive was built for.

The Captive Response Is Already on the Page

Marsh's 2025 captive landscape report makes the trend line unmistakable. The number of Marsh-managed captives writing cyber has increased more than seventy-five percent in recent measurement periods. Cyber premium volume inside those captives is up fifty-seven percent. Marsh-managed captives wrote more than one hundred seventy million dollars of cyber premium in 2024, with eighteen percent of the firm's largest captives now carrying a cyber line. Cyber sits inside the top ten most-written risks across captive programs — a position the line could not have held ten years ago. Across the broader captive market, Marsh-managed premium has grown to roughly seventy-nine billion dollars, with one hundred eighteen new formations in 2025 alone.

Tennessee owners are inside the strongest version of that story.

Tennessee now has one hundred ninety-two pure captives and six hundred ninety-four active cells. Twelve new pure captives and ninety-five new cells were licensed in the state during 2024. The Tennessee captive regime lowered minimum capitalization from two hundred fifty thousand to one hundred thousand dollars, allowed series LLC structures, and added formal pathways for cell spin-off and dormancy. The State of Tennessee itself formed a captive to handle property and cyber risks the commercial market would not price at terms the state would accept. The domicile is not waiting for the market to fix the cyber exclusion stack. The domicile built the regulatory infrastructure to let the buyer fix it.

What Is Actually Moving Underneath the Calm Renewal

First, the carve-out is doing the underwriting now. A flat or down primary cyber renewal that comes with a broader war exclusion, a shadow-AI exclusion, an IoT-event sublimit, and a tightened business-interruption trigger is not a softer policy. It is a smaller policy at a lower price. The buyer who reads the premium line and skips the schedule is buying a number — not a coverage posture. The captive structure is the only place where the buyer controls the form, not the carrier.

Second, the systemic-event ceiling is real and the captive sits underneath it. S&P Global Ratings projects global cyber premium climbing fifteen to twenty percent annually to roughly twenty-three billion dollars by year-end 2026. Allianz reports ransomware accounts for sixty percent of the value of large cyber claims. AM Best's stable outlook on the segment for 2026 sits on top of an industry consensus that nation-state-scale events are functionally uninsurable in the private market. The captive does not solve the systemic ceiling. The captive sits inside the layer between the deductible and the first commercial layer — the layer that holds the loss inventory the parent organization can quantify, control, and document on its own balance sheet.

Third, the structure now matches the mid-market. Cell captive growth in 2026 is concentrated in three lines — property, cyber, and medical stop-loss. The cell structure carries the lower capital requirement, the faster formation timeline, and the ability to merge, transfer, or convert into a single-parent captive as the program matures. Europe's first dedicated cyber group captive, MIRIS, was targeting fifty members by 2026 — the same group-captive logic American mid-market manufacturers have applied to workers' compensation for thirty years, now applied to the most volatile peril on the balance sheet.

The Discipline Move

The traditional broker move on a softer cyber renewal is to take the lower premium, hold the existing limit, and treat the new exclusions as cost-of-market. That move produces a buyer who pays less for less — and discovers the exclusion at the first claim. The PFTN 4-Step Strategic Process was built for the other direction. Strategic Discovery surfaces the actual cyber exposure inventory and the contractual indemnity tied to it. Risk Assessment reads the schedule of endorsements line by line. Solution Design pairs the commercial layer with a cell or single-parent captive structure that catches what the commercial form is now writing out. Ongoing Optimization re-checks the exclusion stack and the captive utilization at every cycle.

The 2026 cyber renewal looks calm. The discipline behind the renewal does not get to be.