Cyber attacks cost Europe’s four largest economies ~€300bn in the last five years, according to Howden
Published
Read time
New research highlights urgent need for scaled cyber risk transfer amidst rising threats and low insurance uptake in Europe
- 49% of surveyed companies in France, Germany, Italy and Spain reported at least one cyber attack between 2020 and 2025, costing €307 billion
- €204 billion of losses could have been avoided through broader adoption of basic cyber security and insurance, more than offsetting the costs of protection
- Over 70% of surveyed businesses remain uninsured against cyber risk, underscoring the scale of the protection gap in the region
London, 24 September 2025 – Howden has today published new research on cyber risk, combining detailed insurance market analysis with real-world insights from companies in France, Germany, Italy and Spain. Amidst increasingly complex and costly cyber threats, the report reveals a strong return on investment from effective risk management and cyber insurance. It also highlights the considerable benefits for both businesses and insurers in expanding risk transfer in underpenetrated markets.
Howden’s analysis stresses the urgency of growing the cyber premium pool in the current softening market cycle. Rate reductions have accelerated over the last 12 months, with global pricing now 22% below the mid-2022 peak (see Figure 1). This trend has been driven by increased underwriting capacity, as insurers commit to a class that offers a strong track record of profitability. The most pronounced downward pricing pressure has been observed in international markets, where rates have declined by 12% since January 2024, compared to a more modest 5% drop in the US.
Download the full report (PDF)
Figure 1: Howden’s Global Cyber Insurance Pricing Index – 2014 to 3Q25
(Source: Howden)
Looking ahead, future growth will depend on securing new business. According to Howden, cyber exposures need to increase by 15% annually over the coming years to meet premium targets. The report offers extensive real-world data to help chart the path forward.
Building resilience is critical to the journey. Howden data shows that nearly half (49%) of surveyed businesses experienced at least one cyber attack in the past five years, equating to over €307 billion in direct costs.
Despite this, cyber insurance penetration remains relatively low across Europe. More than 70% of companies in the four countries are uninsured, notably above the UK’s 61%.
Encouragingly, 31% of surveyed businesses with annual revenues above €1 million intend to purchase cyber insurance for the first time within the next five years. The potential is even greater, given the high proportion of undecided non-buyers, which represents a clear call to action for the market to engage, educate and convert interest into uptake.
Figure 2: Cyber insurance penetration by country
(Source: Howden analysis of a YouGov survey)
Note: UK data from Howden’s The cyber security gap report in 2024
Howden’s analysis shows that, even before accounting for claims recoveries, insured companies incur lower costs following a cyber attack due to stronger governance and risk management best practices. A company with €500 million in annual revenue could save €16 million over ten years by holding a cyber insurance policy (as shown by Figure 3). This equates to a 19% return on investment, driven by reduced attack severity, more than offsetting the cost of cover. Claims payments in the event of a loss further enhance returns.
Figure 3: Estimated total cyber costs over a ten-year period for cyber insurance policyholders vs non-buyers with €500 million revenue
(Source: Howden analysis of a YouGov survey)
Note: risk management spend includes insurance premium for policyholders
By extrapolating the impact that cyber insurance and risk controls have on reducing attack frequency and severity across France, Germany, Italy and Spain, Howden’s analysis shows that total cyber-related costs could fall by 66%, a reduction of €204 billion over the period of 2020-25. The bulk of these savings emanate from reduced severity (€112 billion), with the remaining €92 billion attributed to lower attack frequency.
Jean Bayon de La Tour, Head of Cyber, International, Howden, said: “Howden’s report confirms the powerful role cyber insurance plays in mitigating one of the most critical threats facing businesses today. Cyber insurance is not just a protective measure, but a strategic enabler of resilience that accelerates recovery, strengthens risk management and reduces financial losses.
With penetration still low and demand rising, Europe and other international markets offer significant growth opportunities. Yet, the market must do more to communicate this value and simplify its offering. Improving accessibility will be crucial to realising the huge potential in Europe and other underpenetrated markets.”
Shay Simkin, Chair, Global Cyber, Howden, said: “Our research has quantified the costs of European attacks at roughly €300 billion since the turn of the decade. The cyber protection gap is a societal issue that demands urgent attention, and at Howden, we are committed to working with clients and markets to build lasting resilience. Through increased insurance penetration and education about implementation, we can help businesses improve their cyber resilience and protect against loss of revenue from these attacks.”
