On September 30, 2026, Insurance Business reported that active assailant insurance is growing while most commercial lines get cheaper. The Council of Insurance Agents & Brokers found that average commercial property and casualty premiums fell 1.2% in the first quarter of 2026, the first decrease across all account sizes since the third quarter of 2017, as Leader's Edge reported. Marsh's terrorism placement advisory leader told Insurance Business that the number of organizations buying active assailant cover had risen about 30% a year over the previous four years. The same article reported that, as of 2024, renewal increases were running in the mid-to-high single digits, similar to the standalone terrorism market.
A specialty line that holds its price in a soft market is telling owners something. The message is not mainly about how often attacks happen. It is about who pays after one, and how little of that cost a standard insurance program may answer.
Frequency is not what is driving the market
The FBI designated 34 active shooter incidents in the United States in 2025, up from 24 in 2024 but below the five-year average of 43, according to the FBI's 2025 report as summarized by WaterISAC. Insurance Business, citing the same report, said businesses were the most common location in 2025. Yet buyers kept arriving as the FBI count fell from 61 incidents in 2021 to 24 in 2024, Insurance Business noted.
Underwriters point instead to liability. The settlement over the October 2017 Las Vegas festival shooting was expected to total between $735 million and $800 million, funded by insurers, and Insurance Business reports that underwriters still cite it. After an attack, the costly question is often whether the owner or operator provided reasonable security, and Insurance Business lists negligent security claims among the pressures behind rising liability awards.
Where a standard program can leave a gap
Three features of an ordinary insurance program can leave an owner exposed after an active assailant event.
1. Terrorism cover may not respond
Terrorism wordings are mostly written around physical damage, and some require a link to a political motive. As Insurance Business notes, a lone attacker who does little damage to property may fall outside both conditions. Separately, the federal backstop applies only to acts the Treasury Secretary certifies as terrorism.
2. Property cover needs physical damage
Business interruption under a property policy usually depends on direct physical loss. A building closed for weeks after a shooting, or a retail center whose visitors stay away, may have lost income without a covered property loss. Marsh lists “non-physical damage coverage” and “loss of attraction and denial of access coverage” among the components of its active assailant product, which is a useful map of what a general program may not carry.
3. Liability forms are narrowing
Insurance Business reports that ISO's general liability filing, with a proposed effective date of January 1, 2026, added new assault and battery exclusions. Owners whose general liability renews on standard forms should check whether those exclusions have been attached, and whether their umbrella follows form.
Why investors and lenders should care
For owners of public-facing real estate, these gaps sit directly on the income statement. Beazley underwriter Justin Peterson named education, hospitality, health care, commercial and residential real estate, retail and nonprofits as the sectors showing the most interest in the cover. Each depends on people choosing to come through the door. An event that closes a property, drives tenants to exercise lease rights or produces a long liability case can impair value well beyond any physical repair.
That makes the security posture of a building a diligence item, not only an operational one. A lender or buyer who would not close without a property condition report should be asking a parallel set of questions about how the asset would perform, and who would pay, after a violent event.
| Question | What a good answer shows |
|---|---|
| What threats does the security program assume? | A written design basis that names the threats considered and the ones excluded. |
| How is entry controlled? | Defined public, semi-public and secure zones, with the controls at each boundary described. |
| What do the policies say? | A wording review of terrorism, property, general liability and umbrella forms against an active assailant scenario. |
| Is standalone cover in place or considered? | A documented decision, including limits, sublimits and any prevention services included. |
| Is the program maintained? | Inspection, testing and training records that show the controls still work as designed. |
Prevention is becoming part of the product
Insurance Business reports that insurers are shifting from post-attack benefits, such as victim support, counseling and lost income, toward services delivered before an attack. That trend favors owners who can show what they have done. A documented risk assessment, a clear design basis and records showing that controls are inspected and maintained are the evidence an underwriter can use. The same file supports a negligent security defense, because it shows the owner considered foreseeable threats and acted on them.
Physical measures belong in that file when the assessment supports them. Entrance design, controlled vestibules, protected reception and security positions, and hardened interior refuges are construction decisions, and they are easiest to incorporate during design or a planned renovation. The point is not to fortify every lobby. It is to match the building to the threats the owner has decided to address, and to specify those protective elements as one coordinated package rather than as separate purchases.
What to do at the next renewal
Ask the broker to run an active assailant scenario against the current program, line by line, and to state in writing which costs would and would not be covered. Review the general liability and umbrella forms for assault and battery exclusions. Confirm whether terrorism cover was purchased, declined or sublimited. Then compare the answers with the building's security design basis. Where the insurance and the building assume different threats, one of them needs to change.
The market signal is clear enough to act on. Insurers are pricing the liability that follows an attack, not the attack itself, and owners who can document a reasoned security program are in a better position on both cost and defense.
Frequently asked questions
Does terrorism insurance cover an active shooter event?
Not always. Terrorism wordings are mostly written around physical damage, some require a political motive, and the federal backstop applies only to acts the Treasury Secretary certifies. A lone attacker may fall outside those conditions.
What does standalone active assailant cover add?
Marsh lists components including non-physical damage coverage, loss of attraction and denial of access coverage, legal liability coverage, and reimbursement for crisis management, counseling and added security costs. Terms and limits vary by insurer.
What should a buyer or lender request?
The security design basis, a description of entry control, the insurance wording review against an active assailant scenario, and maintenance and training records.
Need to frame a facility decision?
ISCoA helps owners organize physical security exposure, mitigation priorities and evidence requirements before product selection.
Request a preliminary review