How India is turning cyber insurance into a mass-market service

India is fast becoming one of Asia’s largest cyber insurance markets. A rise in cyberattacks, business digitalisation and new data protection requirements are pushing companies to invest not only in insurance cover, but also in incident response, monitoring and cybersecurity services. For Russian companies, this opens up opportunities in security operations centres (SOCs), anti-fraud, digital forensics and risk management technology.

Why cyber insurance is going mainstream in India

Four key market drivers:

1. Threats are scaling fast—in 2025, the number of cyberattacks in India rose by around 70% compared with 2024, and private companies are recording hundreds of millions of detections across millions of devices. Cyber risks are becoming a pervasive problem for businesses.
2. Regulatory pressure is mounting—the newly introduced Digital Personal Data Protection Act (DPDP) Rules 2025 give companies until May 2027 to establish data protection and regulatory compliance processes. Cyber insurance is becoming a tool for managing risks and meeting regulatory requirements.
3. India has more than 15 million registered micro, small and medium enterprises (MSMEs), which account for about a third of the country’s GDP. At the same time, business digitalisation is rising—the UPI instant payment system handles around 85% of all digital retail transactions. This makes cyberattacks a direct risk to revenue and operations.
4. Despite rapid market growth, cyber insurance penetration in India remains limited, especially among MSMEs. Industry sources estimate that many companies still lack dedicated cyber risk cover. Against a backdrop of more frequent cyber incidents, digitalisation and tighter data protection requirements, this points to strong potential for further market growth.

Currently, around 70% of demand is concentrated in the financial sector (banking, financial services, and insurance) and technology companies, mainly among larger players. The biggest growth potential lies in simplified solutions for MSMEs (basic cyber hygiene, incident response and insurance cover).

India cyber insurance market forecast, 2025–2034 (USD million)

Source: IMARC

More than just a policy: what businesses really get

The cyber insurance market is gradually redefining the product: alongside insurance cover, companies are increasingly getting incident response, recovery and case management services.

• Today, businesses are not really buying an insurance payout, but a ready-made response infrastructure. In 2025, Indian companies lost USD 2.2 billion to cybercrime, and the average loss per incident was estimated at around USD 2.5 million. The main costs include digital forensics, legal support, customer notification and crisis communications. The value of a policy therefore lies in a fast, coordinated response immediately after an incident.
• Cyber insurance is becoming a service-based product. Major insurers already include data recovery, legal support, digital forensics, crisis management and IT consultancy in their cover. For MSMEs, such a policy replaces an in-house response team, so demand for managed services and outsourced cybersecurity functions is growing.
• The global trend is a hybrid model combining insurance, cybersecurity requirements, continuous monitoring and access to external experts. Policies now cover more: social engineering fraud, supply chain attacks and even certain types of physical damage linked to cyber incidents.
• Regulators are also strengthening the cyber insurance ecosystem. The Insurance Regulatory and Development Authority of India (IRDAI) requires insurers to have chief information security officers (CISOs), response plans and round-the-clock monitoring. This brings insurance products closer to SOC, digital forensics, incident response and legal support. Cyber insurance is gradually becoming a comprehensive response infrastructure.

Opportunities for Russian—Indian solutions

India’s insurance market is both large and fast-growing. As of March 2025, the country had 74 insurers and reinsurers, and the market remains one of the fastest-growing among major economies. The regulator is also widening access for foreign capital—up to 100% in certain segments—and promoting the Insurance for All by 2047 strategy, which envisages further digitalisation of the industry, broader insurance cover and the development of remote services.

Against this backdrop, the structure of demand is shifting. Insurers and corporate clients are increasingly investing not only in traditional insurance products, but also in technology services that help reduce losses, cut response times and meet data protection requirements. Solutions that combine insurance, cybersecurity and data analytics are drawing particular interest.

As a result, the main entry point for external players today lies less in insurance underwriting itself (that is, the assessment and acceptance of insurance risks) than in the service and technology infrastructure around it. This means fraud-prevention systems, SOCs and incident response centres, digital forensics, cyber incident management, vulnerability assessment and tools for monitoring compliance with the DPDP and other data protection rules.

A further factor is the growth in trade between Russia and India and the wider use of national currencies for settlements. This makes it easier to launch joint service models, local partnerships and long-term contracts in risk management and information security technologies.

Practical steps for market entry

• Start with a pilot project: choose industries with high cyber exposure and low insurance penetration (manufacturing, healthcare, and education), where proving the product’s value is easiest and fastest.
• Choose a presence model: avoid a formal representative office with no commercial function. Prioritise service contracts, partnerships with licensed insurers and brokers, or a local operating structure.
• Design the product around service-level requirements. Provide round-the-clock response, prepare ready-made incident playbooks and coordinate with contractors and lawyers, taking into account the regulator’s tight notification deadlines.
• Localise settlements and documentation: set up pricing, invoicing, claims settlement and customer support in line with Indian law and currency regulations.
• Build digital distribution: use the country’s well-developed payment and digital infrastructure to scale sales and services beyond the largest cities.