The commercial cyber insurance market is strong and growing, but small to midsize businesses may be falling behind as cybercriminals ramp up AI efforts.
“Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges,” said Sean Kevelighan, CEO of the Insurance Information Institute (Triple-I). A new members-only issues brief, Commercial Cyber Insurance: State of the Risk, examines the state of the cyber market as well as emerging threats and opportunities.
“Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack,” Kevelighan said. “However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs.”
Increasing cyber losses
U.S. cyber-related losses reached nearly $21 billion in 2025, up from approximately $16 billion in 2024, according to the FBI’s Internet Crime Report. More than 1 million incidents were reported, compared with 859,532 the previous year.
Average cyber claim severity among large U.S. businesses more than doubled to over $4.4 million in 2025, even as claim frequency declined 34% for that segment, according to Chubb statistics cited by Triple-I.
Growing premiums, declining rates
Global cyber insurance premiums have grown at an annual rate of approximately 5% since 2022, according to Swiss Re. Premiums are projected to reach $16.4 billion in 2026 and $17.1 billion in 2027, with North America accounting for roughly two-thirds of the market.
At the same time, cyber insurance rates have declined for four consecutive years, falling approximately 5% year-to-date in 2026, compared with a 13% decline in 2025.
Small businesses slow to adopt
Despite lower rates and growing risks, adoption remains low among small- and mid-sized businesses, with the market penetration for cyber insurance estimated at just 10% to 20%, according to Swiss Re. These businesses face a double threat, lacking dedicated cybersecurity budgets and advanced defenses as well as cyber insurance.
In the face of more affordable coverages, cost may not be the primary barrier to cyber coverage. Misunderstandings about cyber insurance options and benefits may also contribute to the gap, making it critical that the insurance industry help businesses better understand and manage evolving cyber risks and the specific ways in which their organizations may be vulnerable.
For example, approximately 15% of data breaches in 2026 originated from supply-chain compromises, with an average cost of approximately $5 million, according to IBM.
Increasing AI-related threats
AI-powered phishing, impersonation and social engineering schemes are making cyberattacks more sophisticated and accessible. The FBI reported nearly $893 million in losses associated with AI-driven incidents in 2025.
While AI is enabling cybercriminals to launch increasingly sophisticated attacks, it is also helping businesses and insurers strengthen defenses, identify vulnerabilities and respond more quickly to cyber incidents.
According to IBM, organizations using security AI and automation experienced average breach costs of $4 million, compared with $5.93 million for organizations without those capabilities, a difference of $1.93 million. Ransomware was involved in 48% of data breaches examined in Verizon’s 2026 Data Breach Investigations Report. However, 69% of victims declined to pay ransom demands, due in part to better data backups and cybersecurity planning.
Building Cyber Resilience
A recent Triple-I/Munich Re US RiskScan study found cyber incidents and AI ranked among the leading risk concerns across five key industry segments, including consumers and small business owners.
In a recent Risk Index from insurer Travelers, 58% of respondents said they worry a great deal or some about cyber risks. The concern outpaced those involving economic or geopolitical risks and ranked as the top overall business concern for the fifth time in eight years.
These findings reinforce the importance of translating risk awareness into effective protection, Kevelighan said. As AI adoption accelerates, effective oversight, employee training and data security will become increasingly important to managing emerging risks and supporting responsible deployment.
“Businesses need to understand not only the financial consequences of a cyberattack but also the proactive steps they can take to reduce their exposure,” Kevelighan said. “Greater education and collaboration among insurers, businesses and cybersecurity professionals are essential to strengthening cyber resilience and helping organizations better prepare for, respond to and recover from an attack.”
Triple-I’s Issues Brief also examined the evolving regulatory landscape, including cyber incident reporting requirements and state-level initiatives addressing the use of artificial intelligence in insurance.
Topics Trends Cyber Commercial Lines Business Insurance Pricing Trends
Was this article valuable?
Here are more articles you may enjoy.
AI’s Water Strain Includes Surging Demand From Electricity Use 
A Timeline of Developments in AI Safety Since the Attack on Hugging Face 
Hurricane Isaias Reaches Cat 3 Status as Insurers, Adjusters, Property Owners Prepare 
Kroger Plans to Slash 37% of Corporate Jobs in Next Three Years 
