Why Are Insurers Still Pricing Digital Risk Like It's 2015?

Gates aren't guarantees

Online harm rarely emerges from a single failure. It develops through a sequence of events: who entered a system, how they interacted within it, and how early signals were interpreted or missed. When access pathways are weak or treated as a fixed assumption, downstream controls inherit disproportionate liability. Moderation teams, enforcement mechanisms, and response protocols are left managing risk that has already compounded. This concentrates exposure at a later layer of the system, increasing both severity and cost when harm materialises.

How harm escalates

None of this implies that platforms carry automatic or unlimited liability for all harm. Nor does it suggest that digital environments can be rendered risk-free. It does, however, raise a quieter underwriting question: whether current models over-index on visible controls, while under-pricing the conditions that shape risk before those controls ever engage. In other sectors, from fraud to fire prevention, insurers routinely distinguish between early-stage risk governance and post-incident response. The same distinction is possible in digital environments, but it requires visibility into systems that most underwriting frameworks do not yet capture.

A model gap

There is a growing case for evaluating digital risk closer to the point of entry, where identity, intent, and behavioural patterns first intersect. Systems that surface early indicators of elevated risk alter the loss profile in ways that enforcement alone cannot. They change not just outcomes, but frequency, severity, and predictability: the variables underwriting ultimately depend on.

Recognise real mitigation

Treating access as a static prerequisite rather than an active risk layer leaves a gap between how digital harm forms and how it is currently priced. As digital environments continue to scale, liability is increasingly tracing back upstream. The question for insurers is no longer simply what controls exist, but where in the system risk is actually being governed.Frameworks that assess and document risk at the point of entry, rather than inheriting it downstream, are not theoretical. They exist. The question is whether underwriting models are built to recognise their value.