Executive Summary 

• The Terrorism Risk Insurance Program (TRIP), set to expire in 2027, has materially changed the terrorism insurance market since its creation in 2002; with commercial terrorism coverage now broadly available, substantially greater private insurance and reinsurance capacity, and terrorism premiums generally representing a relatively small share of commercial insurance premiums. 

• The principal insurance challenge now extends beyond conventional terrorism to nuclear, biological, chemical, radiological, and cyber risks, which can produce unusually severe and correlated losses while raising distinct questions about whether private insurance will cover the underlying peril and whether those losses can qualify for the federal backstop. 

• The program’s scheduled 2027 expiration provides an opportunity to reassess the allocation of catastrophic terrorism risk, with policymakers able to consider greater private-sector participation while preserving a federal backstop for risks that private markets may be unable to diversify efficiently. 

Introduction 

Updated September 2026 

The market for terrorism risk insurance looks very different today than it did in the aftermath of September 11, 2001,—and even from when this primer was originally published in 2014. The private insurance market has developed substantially, insurers have accumulated more capital and better catastrophe models, and Congress has repeatedly modified the federal backstop. At the same time, the fundamental economic problem that motivated federal intervention has not disappeared: A sufficiently large terrorist attack can generate highly correlated losses across many insurers and policyholders at the same time. 

The federal government currently addresses that risk through the Terrorism Risk Insurance Program (TRIP), established by the Terrorism Risk Insurance Act of 2002 (TRIA). The program is scheduled to expire on December 31, 2027 (the House and Senate have passed separate versions of bills that would reauthorize TRIA for another seven years). The central question facing TRIA as its expiration approaches is whether the federal backstop remains necessary after more than two decades of growth in private terrorism insurance and reinsurance capacity. The risks themselves have also changed: Conventional terrorism has become increasingly insurable, while nuclear, biological, chemical, radiological (NBCR), and systemic cyber risks pose potentially larger and more correlated losses that may be difficult for private markets to diversify. The policy challenge is therefore no longer simply whether terrorism insurance can be provided, but whether and where the federal government remains necessary to support coverage for risks that private markets may be unable to absorb efficiently. 

The Policy Problem 

The insurance market’s response to the September 11, 2001, terrorist attacks exposed a problem that had received relatively little attention before the attacks: Insurers had provided terrorism coverage without adequately pricing, modeling, or reserving for the possibility of a catastrophic man-made event. The problem was not simply the size of the losses, but their correlation across insurers and lines of business. An event that was highly improbable from the perspective of an individual policy could generate claims across a substantial portion of the insurance industry simultaneously. Treasury estimates that the 9/11 attacks generated approximately $59 billion in insured losses in 2024 dollars. 

Terrorism presents unusual problems for conventional insurance because insurers ordinarily rely on diversification and historical experience to estimate risk. A major attack can generate property, business interruption, workers’ compensation, liability, aviation, and other claims simultaneously, while the limited historical record makes the frequency and severity of future attacks difficult – perhaps even impossible – to estimate. The resulting uncertainty makes it challenging to determine how much capital insurers should hold and what premiums are sufficient to compensate them for assuming the risk. 

The problem becomes more acute for NBCR attacks. A conventional attack may produce severe but relatively concentrated property losses, whereas an NBCR event could produce large and highly correlated losses involving property, workers’ compensation, medical costs, business interruption, liability, and contamination over a much wider area or longer period. A biological attack, for example, could produce losses through widespread illness and business interruption rather than conventional property damage, while a nuclear attack could generate catastrophic property and workers’ compensation losses concentrated in a metropolitan area. 

TRIA does not solve this problem by making every terrorist loss insurable. The program generally requires participating insurers to make terrorism coverage available on the same terms as other covered perils, but it does not require them to cover risks otherwise excluded from the underlying policy. Nuclear, pollution, contamination, and related exclusions can therefore limit coverage for NBCR events. This creates an important distinction between the federal government’s willingness to share an insured terrorism loss and the private market’s willingness to insure the loss in the first place. 

The post-September 11 contraction in terrorism reinsurance nevertheless raised a broader economic concern. Commercial property insurance is frequently required by lenders and investors, so reduced availability or sharply higher prices can affect commercial real estate, construction, and other capital investment even when the probability of an attack is small. Congress therefore confronted not only an insurance problem but a potential disruption in credit and investment markets. 

The Policy Response 

Congress responded by enacting TRIA in November 2002, creating TRIP as a federal backstop for qualifying terrorism losses. Congress has subsequently reauthorized the program several times, most recently in 2019, with the current authorization expiring December 31, 2027. 

TRIA does not make the federal government the primary provider of terrorism insurance. Participating insurers must make terrorism coverage available to commercial policyholders in covered property and casualty lines, although policyholders may decline the coverage. Federal payments require certification by the Treasury Secretary, in consultation with the Attorney General and Secretary of Homeland Security, as well as satisfaction of the program’s statutory thresholds. The current program trigger is $200 million in aggregate industry insured losses. 

The allocation of risk has shifted significantly toward private insurers since 2002. An insurer’s deductible is now 20 percent of its prior-year direct earned premiums in TRIA-eligible lines; above that deductible and the program trigger, the federal government covers 80 percent of additional insured losses and the insurer retains 20 percent. The program also has a $100 billion annual aggregate cap. TRIA includes recoupment provisions under which the federal government can recover specified payments through assessments on the commercial insurance market. The Government Accountability Office (GAO) has found that successive reauthorizations reduced the government’s explicit fiscal exposure, while the market remained stable. 

The statutory definition of terrorism creates additional complications for emerging risks. A catastrophic event must satisfy requirements concerning its nature, perpetrators, purpose, and resulting losses before it can be certified. These requirements can be difficult to apply to cyberattacks, where attribution and intent may be uncertain, and to NBCR events, where losses may result primarily from illness, contamination, or business interruption rather than conventional physical destruction. 

TRIA: How Has It Worked? 

The terrorism insurance market today bears little resemblance to the market immediately after September 11. Insurance coverage is broadly available, private reinsurance capacity has developed, insurers have accumulated more experience modeling terrorism exposures, and Treasury has substantially more information about terrorism insurance purchases and pricing. Treasury has generally found terrorism insurance to be available and affordable, while GAO’s most recent review found that TRIA has contributed to market stability.  

The evidence does not, however, establish that TRIA alone produced these changes. Insurers have accumulated capital, catastrophe modeling has improved, reinsurance markets have expanded, and the absence of another attack comparable to September 11 has allowed insurers to build experience without absorbing a similar loss. TRIA has nevertheless become an established component of insurers’ capital and reinsurance planning, making it difficult to determine how much private capacity would remain if the federal backstop disappeared. 

Treasury data indicate that terrorism coverage remains widespread among eligible commercial policies. Treasury’s June 2026 report says that the 2025 take-up rate was 56 percent when measured by direct earned premiums, while the policy-count measure was around 80 percent. The 56 percent figure has declined gradually from 63 percent in 2018. Property-limit take-up was 41 percent in 2025, while liability-limit take-up was 77 percent. Coverage remains widespread, but the amount of terrorism risk being purchased has declined on several measures. 

Pricing has also become less disruptive than immediately after September 11. Treasury’s recent data indicate that terrorism premiums generally represent only a small portion of premiums in TRIA-eligible lines, although prices vary substantially by geography, industry, and exposure. The changes in TRIA itself have also shifted more risk toward private insurers through higher deductibles, higher program triggers, and stronger recoupment provisions. GAO has found that these changes reduced federal fiscal exposure while insurers adjusted to their increased risk.  

Cyber risk presents a different challenge. Cyber insurance is increasingly important, but a catastrophic cyberattack may produce systemic losses across thousands of policyholders while raising difficult questions about attribution, intent, and whether the event satisfies TRIA’s statutory definition. GAO has noted that cyberattacks may not satisfy TRIA’s requirements concerning violence or danger to human life, property, or infrastructure, or its requirements concerning intent and geographic location. The expansion of cyber insurance therefore does not necessarily resolve the question of who would bear losses from a truly systemic cyber-terrorism event. 

The picture is less clear for NBCR risks. The existence of a broad terrorism insurance market does not imply comprehensive coverage for nuclear, biological, chemical, or radiological attacks, because underlying policies can exclude these risks. The result is an unusual policy problem: the risks that could generate the largest losses may be precisely those for which private insurance is least available. Treasury continues to collect data on NBCR coverage, and congressional analysis has identified the treatment of these risks as an issue for future reauthorization. 

Expiration of TRIA 

The expiration question is different from the one Congress faced in 2014. The market has now operated under TRIA for more than two decades, private capacity has expanded, and Congress has progressively increased the private sector’s share of catastrophic losses. The central issue is therefore whether private markets have developed enough capacity to operate with a smaller federal backstop. 

GAO’s 2025 review concluded that, absent a loss-sharing program, insurers would likely limit terrorism coverage, raise prices, or withdraw from some portions of the market. That finding suggests that expiration could materially affect insurance availability, but it does not establish the long-run consequences. Higher prices and reduced federal support could attract additional private capital, increase reinsurance capacity, or encourage greater policyholder retention. A short-term disruption could therefore produce a different long-term market equilibrium.  

The effects would also vary by risk. Highly concentrated commercial property exposures and workers’ compensation are more difficult to diversify than geographically dispersed risks. Workers’ compensation is particularly important because insurers generally cannot exclude terrorism exposure. NBCR risks present a still different problem because the question may be whether coverage exists at all rather than simply how much federal reinsurance is available. 

Is There a Market Failure? 

The economic case for government involvement rests on several characteristics of terrorism risk: Losses can be highly correlated, historical data are limited, probabilities are difficult to estimate, and a catastrophic attack can generate losses well beyond the capacity of individual insurers. Inadequate insurance can also affect lenders, investment, and commercial activity. 

Those characteristics explain why terrorism is difficult to insure, but they do not establish that taxpayers should bear the risk. The relevant question is whether private markets are able to provide coverage at prices and levels of capacity that produce an economically efficient allocation of risk, and whether the resulting effects create broader economic costs that private parties cannot internalize. 

The case is stronger for some forms of terrorism than others. Conventional terrorism has become increasingly amenable to private insurance and reinsurance. NBCR risks are more difficult because their frequency is highly uncertain and their potential severity is exceptionally large. A biological attack could produce losses across a broad population and over an extended period, while a nuclear attack could generate enormous concentrated property and workers’ compensation losses. These characteristics make diversification particularly difficult. 

Cyber terrorism presents a related but distinct problem. The principal issue may be less the existence of cyber insurance than the ability of private markets to absorb highly correlated losses from a systemic event. The question of whether a federal role is warranted therefore depends in part on whether private capital and reinsurance can efficiently diversify such losses and on whether a federal mechanism can be designed without substantially increasing moral hazard. GAO has identified moral hazard and the need to assess whether catastrophic cyber risks warrant a federal insurance response as important considerations.  

That does not necessarily establish that government should assume the risk. A federal backstop can spread losses across the broader economy, but it cannot eliminate them. Moreover, the existence of a federal backstop can reduce insurers’ incentives to hold capital against extreme losses or develop alternative forms of risk transfer. TRIA may therefore improve insurance availability while simultaneously slowing the development of private capacity that could eventually replace it. 

There is also a case for a predictable federal mechanism even if private markets could theoretically insure terrorism. Governments may face pressure to provide assistance after an extraordinary attack regardless of whether a formal program exists. A pre-established backstop can therefore be preferable to an uncertain ex post response, although that does not necessarily justify the current structure or level of federal exposure. 

The experience since 2002 provides evidence on both sides. Private capacity has increased substantially and terrorism insurance is broadly available, but GAO continues to find that the federal backstop contributes to market stability. The evidence therefore supports neither an assumption that permanent federal involvement is necessary nor the proposition that private markets could immediately replace TRIA. 

A Policy Proposal 

The experience of the past two decades supports incremental reform rather than either immediate elimination of TRIA or indefinite continuation without change. Congress has already moved risk toward private insurers through higher deductibles, higher triggers, and stronger recoupment. The next stage should continue that direction where evidence indicates that private capacity can absorb additional risk without materially reducing insurance availability. 

A gradual reduction in federal exposure would preserve a predictable mechanism for catastrophic losses while strengthening incentives for private insurers, reinsurers, and policyholders to develop alternative capacity. Policymakers should monitor prices, take-up rates, policy limits, reinsurance capacity, insurer capital, and geographic concentration as the 2027 expiration approaches rather than relying on a fixed timetable. Changes could include a higher industry aggregate retention, higher insurer deductibles, or other adjustments to the federal co-share, depending on the resulting effects on private capacity and insurance availability. GAO has found that increasing the industry aggregate retention could have a greater effect on reducing federal fiscal exposure than comparable changes to the deductible or co-share.  

Cyber risk warrants more explicit treatment. A future program should address the circumstances under which a cyber event can qualify as terrorism, the treatment of systemic losses affecting large numbers of policyholders, and the extent to which private cyber insurers and reinsurers can absorb such losses. The question is not simply whether cyber insurance exists, but whether private markets can provide sufficient capacity for an event whose losses could be highly correlated across the economy. Treasury’s 2026 modeling illustrates the potential scale of systemic cyber risk: a modeled ransomware event affecting the broader TRIP portfolio generated losses of $3.3 billion at a 100-year return period and $49.2 billion at a 1,000-year return period, illustrating the potential for correlated cyber losses to exceed the capacity of individual insurers. Any federal role should also consider mechanisms to limit moral hazard, including appropriate private retention or risk-management requirements. 

NBCR risks warrant separate consideration because simply increasing the private share of losses may accomplish little where insurers exclude the underlying peril. If policymakers determine that a federal role remains necessary, they would need to decide whether NBCR coverage should remain within TRIA, receive a separate federal backstop, or be addressed through some other mechanism. Each approach would allocate risk differently among insurers, policyholders, and the federal government, and each would present different problems involving moral hazard, insurer solvency, and taxpayer exposure. 

More broadly, future changes to TRIA should be evaluated against measurable indicators of private-market capacity rather than a predetermined timetable for reducing federal support. This would allow Congress to increase private risk-bearing where markets have demonstrated capacity while retaining federal support where the underlying risk remains unusually difficult to diversify. 

Conclusion 

The original rationale for TRIA was that the private insurance market had effectively stopped functioning for terrorism risk following September 11, and that is no longer an accurate description of the market. Commercial terrorism coverage is broadly available, private reinsurance capacity has expanded, and the federal government’s share of catastrophic losses has declined substantially since 2002. The private market has demonstrably developed, but development has not eliminated the rationale for federal risk sharing across all categories of terrorism risk.  

The remaining policy challenge is more differentiated: Conventional terrorism has become increasingly insurable, while NBCR and systemic cyber risks continue to present unusual problems of correlation, uncertainty, and private capacity. As Congress considers the program’s scheduled 2027 expiration, policymakers should therefore continue shifting risk toward private markets where capacity exists while preserving a clearly defined federal backstop for risks that private insurance cannot efficiently diversify, with future changes guided by evidence on insurance availability, affordability, insurer capital, reinsurance capacity, and the fiscal exposure of the federal government.