In its recently released report, “The Canadian Cyber Insurance Market”, Insurance Bureau of Canada (IBC) examines the trends shaping Canada’s cyber insurance landscape. The report finds that the market has continued to stabilize following several years of elevated claims and underwriting losses, supported by stronger underwriting practices and improved cyber security controls.
Yet, significant challenges remain. Large cyber incidents continue to generate costly losses, businesses increasingly rely on shared digital technologies, the rapid adoption of artificial intelligence (AI) is introducing new and evolving cyber risks, and many small and medium-sized enterprises (SMEs) remain underinsured and vulnerable to cyber threats. Together, these trends are reshaping how cyber risk is understood, managed and insured.
Market conditions stabilize
Today’s Canadian cyber insurance market looks very different than it did during the peak ransomware years from 2019 to 2021. Improved underwriting practices and stronger cyber security controls have helped restore stability, while insurers continue to focus on underwriting discipline, loss severity and exposure management.
Increasingly, an organization’s cyber security practices, including multi-factor authentication, incident response planning and third-party risk management, influence how insurers assess and price cyber risk. As AI becomes more widely integrated into business operations, insurers will also need to understand how organizations govern and secure these technologies and how AI may change their overall cyber exposure.
Large losses remain challenging
Despite improved market conditions, cyber incidents continue to generate significant financial and operational consequences.
A single cyber event can trigger multiple costs, including business interruption, fraud losses, legal expenses, data recovery and privacy-related obligations. Ransomware attacks remain a significant source of severe, complex losses across sectors.
AI adds another dimension to this evolving threat environment. Generative AI can make some forms of phishing, social engineering and fraud easier to scale and more difficult to identify. At the same time, AI-enabled security tools can help organizations identify threats, detect unusual activity and respond more quickly. The implications for cyber risk are therefore not one-sided: AI is changing the capabilities available to both attackers and defenders.
Cyber insurance can help organizations recover from these events by providing financial protection for covered losses and, depending on the policy, access to specialized legal, forensic and recovery expertise.
Shared technology reshaping cyber risk
One of the report's most significant findings is that shared technology and digital interconnections increasingly shape cyber risk.
Many businesses rely on the same cloud providers, software platforms and technology vendors. As a result, disruptions affecting a widely used provider can simultaneously impact organizations across sectors. As businesses become more digitally connected, insurers and reinsurers are paying closer attention to these shared dependencies and the potential for correlated losses.
Growing reliance on AI adds to this challenge. As organizations adopt common AI models, platforms and service providers, insurers will increasingly need to consider whether these dependencies could create new concentrations of cyber exposure or pathways for losses to affect multiple organizations simultaneously.
Closing the protection gap
The report also highlights the ongoing cyber protection gap among Canadian SMEs. According to an IBC survey, only 22% of SMEs carried cyber insurance in 2025, while just 12% held stand-alone cyber coverage.1
Given the important role SMEs play in Canada's economy and supply chains, improving cyber preparedness and increasing awareness of cyber insurance remain critical priorities. This becomes increasingly important as SMEs adopt AI-enabled tools and services, which can provide significant business benefits but may also introduce cyber risks that organizations need to understand and manage.
Helping businesses better understand and manage cyber risk will be an important part of strengthening Canada's overall cyber resilience.
Strengthening cyber resilience
This is where education and awareness play an important role. IBC’s annual Cyber Savvy public education campaign empowers SMEs to enhance their cyber resilience and make informed decisions about risk mitigation, such as adopting cyber insurance.
To help businesses better understand cyber insurance, IBC has developed a free Cyber Insurance Guide. It explains common cyber insurance coverage considerations, offers protection and recovery tips, outlines the cyber insurance application process and shares resources to boost cyber resilience. For the guide and other resources, visit www.cybersavvycanada.ca.
1 Insurance Bureau of Canada, 2025 Cyber Security Survey.
)