The commercial cyber insurance market is strong and growing, but small to midsize businesses may be falling behind as cybercriminals ramp up AI efforts.
“Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges,” said Sean Kevelighan, CEO of the Insurance Information Institute (Triple-I). A new members-only issues brief, Commercial Cyber Insurance: State of the Risk, examines the state of the cyber market as well as emerging threats and opportunities.
“Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack,” Kevelighan said. “However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs.”
Increasing cyber losses
U.S. cyber-related losses reached nearly $21 billion in 2025, up from approximately $16 billion in 2024, according to the FBI’s Internet Crime Report. More than 1 million incidents were reported, compared with 859,532 the previous year.
Average cyber claim severity among large U.S. businesses more than doubled to over $4.4 million in 2025, even as claim frequency declined 34% for that segment, according to Chubb statistics cited by Triple-I.
Growing premiums, declining rates
Global cyber insurance premiums have grown at an annual rate of approximately 5% since 2022, according to Swiss Re. Premiums are projected to reach $16.4 billion in 2026 and $17.1 billion in 2027, with North America accounting for roughly two-thirds of the market.
At the same time, cyber insurance rates have declined for four consecutive years, falling approximately 5% year-to-date in 2026, compared with a 13% decline in 2025.
Small businesses slow to adopt
Despite lower rates and growing risks, adoption remains low among small- and mid-sized businesses, with the market penetration for cyber insurance estimated at just 10% to 20%, according to Swiss Re. These businesses face a double threat, lacking dedicated cybersecurity budgets and advanced defenses as well as cyber insurance.
In the face of more affordable coverages, cost may not be the primary barrier to cyber coverage. Misunderstandings about cyber insurance options and benefits may also contribute to the gap, making it critical that the insurance industry help businesses better understand and manage evolving cyber risks and the specific ways in which their organizations may be vulnerable.
For example, approximately 15% of data breaches in 2026 originated from supply-chain compromises, with an average cost of approximately $5 million, according to IBM.
