The French benchmark: the July 2026 LUCY study
AMRAE, the French association of risk managers, publishes LUCY ("Light Upon Cyber Insurance") every year. The 2026 edition, released on 9 July 2026, covers 20,996 policies and 1,251 claims from 2025, contributed by twelve brokers and one insurer (AMRAE, 2026 edition).
It illustrates each size band with a worked example. The micro-enterprise, under €2m of revenue, pays €645 a year for a €627,000 policy limit. The small company, €2m to €10m, pays €1,600 for a €701,000 limit (AMRAE, 2026 edition). Expressed against the limit, that is roughly 0.10% and 0.23% a year (AlgoPolis calculation).
Two years earlier, the 2024 edition, on 2023 policies, had its micro-enterprise paying €500 for a €350,000 limit (LUCY 2024, study PDF). The example's price went up 29% and its limit 79%: a euro of limit cost 0.14% and now costs 0.10% (AlgoPolis calculation, on two examples that are not the same company).
Read these amounts as a range. Small companies are the least well measured segment of the study, because some of them buy without a broker and fall outside the sample (source sheet).
Further up the scale, the same fall
For larger firms, LUCY tracks price as a share of the limit, and it has dropped two years running. Large companies paid 2.37% in 2023, then 1.90% in 2024 (LUCY 2025, English edition), then 32% less again in 2025; mid-sized companies (ETI in French terms) paid 23% less in 2025 (AMRAE, 2026 edition). The number of insured mid-sized companies in the sample went from 1,145 to 2,002 in a year (a broker's summary of the 2026 edition).
The global cycle: the 2021 spike, the fall since 2023
The quarterly index of a large international broker is the market's usual thermometer. In the fourth quarter of 2021, at the height of the ransomware wave, it showed cyber rates up 130% in the United States and 92% in the United Kingdom year on year (Insurance Journal, 2 February 2022).
The cycle has turned. In the third quarter of 2025 the same index had cyber rates down 6% globally and 12% in Europe (October 2025 release). In the second quarter of 2026 they fell another 4%, after 5% in the first: twelve straight quarters of decline (July 2026 release). The index mostly follows mid-sized and large accounts; for a small French firm it gives the direction, not the level.
The fall does not mean the risk has calmed down. In the United States, claims and claim expenses took 53% of cyber written business in 2025, against 49% in 2024, according to Fitch's reading of the regulator's data (The Insurer, 15 April 2026, France Épargne). A soft market can harden fast, as 2021 showed.
What to take away
A small firm's price starts with its size: LUCY sorts companies by revenue, and the examples change scale with it. Sector comes next, though insurers do not publish their sector relativities. Then come the answers to the underwriting questionnaire: multi-factor authentication on email and remote access, isolated and tested backups, patching, a recovery plan. An inaccurate answer usually surfaces at claim time, and French insurance law (articles L. 113-8 and L. 113-9 of the Code des assurances) then voids the policy or scales down the payout. The market cycle, finally, moves everything from one year to the next. AlgoPolis publishes these figures with their date and scope; this page prices no one's risk and does not say what to buy.