At a June 27, 2024 House hearing, witnesses described obstacles that can make cyber insurance hard to obtain or understand for some U.S. businesses—especially natural-gas utilities and small and midsize businesses (SMEs). They cited limited insurer options, confusing exclusions, higher premiums and uncertainty about what policies cover. The hearing was testimony, not a representative nationwide survey, so it does not establish that businesses generally cannot get coverage.
What lawmakers heard about access to cyber insurance
Kimberly Denbow, vice president of security and operations at the American Gas Association, told lawmakers that only a limited pool of cyber insurers was willing to write policies for natural-gas utilities. She also said that exclusion wording could be hard for operators—particularly smaller ones—to interpret. “The terms of exclusions vary widely and are difficult for many operators, particularly smaller ones, to understand what is covered,” she said, according to CyberScoop’s June 27, 2024 hearing report.
Guy Carpenter managing director of cyber broking Matthew McCabe pointed to uncertainty over war exclusions. Businesses may question whether a policy covers losses connected to state-linked cyber operations or active conflict. That uncertainty can matter when a company tries to assess what protection it is buying.
Witnesses and lawmakers also discussed rising premiums, demand for coverage, inconsistent terminology, limited historical data and insurers’ reluctance to write some policies. These were explanations raised at the hearing; the record does not quantify how much each factor affects prices or availability.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What the often-cited SME insurance-gap figure means
Jack Kudale, founder and CEO of Cowbell, wrote in testimony submitted for the hearing that “Nearly four out of five SMEs in the US are either uninsured or underinsured when it comes to cyber insurance.” This is a figure Kudale supplied in 2024 testimony, not a government estimate or a current 2026 measurement of the market. The testimony also cited SMEs as more than 99% of U.S. businesses and 44% of U.S. GDP; those figures should likewise be understood as claims in his testimony, not independent current estimates. The written testimony and hearing transcript record what was presented and discussed, but do not independently validate the statistics.
In the transcript, Representative Eric Swalwell referred to Kudale’s statements and described demand, higher premiums and insurer reluctance as creating a “perfect storm.” The exchange illustrates concerns raised at the hearing; it does not establish current denial rates or access conditions across all U.S. businesses.
How a business can evaluate a policy’s real coverage
For a company comparing quotes, the practical question is not only whether a policy is available, but whether its wording fits the losses the company is trying to insure. Ask the broker to explain the contract language and show how the answers are reflected in the policy form.
- Covered loss types: Separate first-party costs, such as the company’s own incident-response expenses, from third-party liability claims. Check which are covered and under what conditions.
- Limits and sublimits: Compare the overall policy limit with any lower limits that apply to particular costs or events.
- Exclusions and definitions: Read the precise wording for war and related events, and ask how the policy defines terms that could apply to a suspected state-linked operation.
- Incident-response services: Confirm what help the policy provides after an incident, who supplies it and whether the insurer must approve a provider or expense.
- Security prerequisites: Identify required controls and attestations, and verify that the business can meet them accurately before applying.
- Likely loss scenarios: Ask how the policy would respond to the incidents most relevant to the business, then check that the broker’s explanation matches the written terms.
These are comparison questions, not a guarantee that a particular claim will be paid. Coverage depends on the contract wording and facts of a loss; a qualified broker or insurance professional can help interpret the policy.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
What federal action has—and has not—been established
In a January 2025 release, Senators Shelley Moore Capito and John Hickenlooper described reintroducing the Insure Cybersecurity Act. Their release said the proposal would direct the National Telecommunications and Information Administration to convene an interagency working group and publish understandable cyber-insurance information for prospective customers and industry participants. That description establishes the sponsors’ account of the proposal, not its current enactment status. See the sponsors’ release.
A separate question is whether the federal government should provide a response to catastrophic cyber losses. The Government Accountability Office recommended that CISA and Treasury’s Federal Insurance Office jointly assess whether those risks and potential financial exposures warrant one. In its April 2026 update, GAO said the recommendations remained open. Treasury had continued research and stakeholder engagement but had not provided GAO a timeline for completing its overall assessment or reporting results to Congress. A federal backstop is therefore under study in the cited evidence, not an established insurance program. GAO’s report and status update also identify issues a possible response would need to address: clear coverage criteria, cybersecurity requirements, a funding mechanism, and safeguards against moral hazard and taxpayer exposure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the hearing does—and does not—show
The June 2024 testimony documents specific concerns from witnesses working in insurance and the natural-gas sector, alongside a witness-provided estimate about SMEs. It does not provide a current national count of businesses unable to buy cyber insurance, denial rates, premiums, or comparable availability by state, sector or company size. A business should use its own quotes and policy forms—not a single hearing statistic—to judge its access and coverage.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
