- US cybercrime losses reached nearly $21 bn in 2025, up from approximately $16 bn in 2024, while reported incidents exceeded 1 mn, according to the FBI.
- Average cyber claim severity among large US businesses more than doubled to over $4.4 mn in 2025, despite a 34% decline in claim frequency, according to Chubb.
- Global cyber insurance premiums are projected to reach $16.4 bn in 2026 and $17.1 bn in 2027, although coverage penetration among small and midsize businesses remains at just 10% to 20%.
Cybercrime is generating higher financial losses for US businesses as artificial intelligence, ransomware and digital supply chain vulnerabilities increase the complexity of attacks, according to a report from the Insurance Information Institute (Triple-I).
The members-only issues brief, “Commercial Cyber Insurance: State of the Risk,” examines rising claims severity, changing cybercriminal tactics and persistent gaps in insurance coverage, particularly among small and midsize businesses.
US cyber-related losses reached nearly $21 bn in 2025, compared with approximately $16 bn in 2024, according to the FBI’s Internet Crime Report. Reported incidents exceeded 1 mn, up from 859,532 the previous year.
Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges.
Sean Kevelighan, CEO of Triple-I
“Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack. However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs”, Sean Kevelighan noted.
Insurance penetration remains limited among smaller companies. Swiss Re estimates that only 10% to 20% of small and midsize businesses have cyber insurance, despite their often limited cybersecurity budgets and lack of advanced defensive capabilities.
The financial consequences of cyber incidents are becoming more severe even where claim frequency is falling.
According to Chubb, average cyber claim severity among large US businesses more than doubled to exceed $4.4 mn in 2025. Claim frequency in the same segment declined 34%, indicating that fewer reported claims did not translate into lower average losses.
Ransomware remains a substantial source of exposure. Verizon’s 2026 Data Breach Investigations Report found that ransomware was involved in 48% of examined data breaches.
At the same time, 69% of ransomware victims declined to meet payment demands, partly reflecting improvements in data backup systems and cybersecurity preparedness.
Digital supply chains represent another significant vulnerability. IBM reported that approximately 15% of data breaches in 2026 originated from supply chain compromises, with an average cost of about $5 mn.
Artificial intelligence is also changing the methods available to cybercriminals. AI-powered phishing, impersonation and social engineering techniques are making sophisticated attacks more accessible, increasing the potential exposure of businesses that lack adequate safeguards.
The FBI recorded nearly $893 mn in losses associated with AI-driven cyber incidents in 2025. Despite these developments, the commercial cyber insurance market has maintained relatively steady growth.
Swiss Re estimates that global cyber insurance premiums have increased at an annual rate of approximately 5% since 2022. Premium volume is projected to reach $16.4 bn in 2026 and $17.1 bn in 2027, with North America accounting for roughly two-thirds of the global market.
Pricing conditions have remained favorable for insurance buyers. Cyber insurance rates have declined for four consecutive years, including a decrease of approximately 5% year-to-date in 2026, following a 13% reduction in 2025.
The combination of falling premiums and low penetration among smaller businesses suggests that insurance affordability may not fully explain the protection gap. Triple-I identified limited understanding of available policies and their benefits as another potential factor affecting adoption.
Artificial intelligence also offers businesses and insurers opportunities to improve cybersecurity performance.
AI-based security systems can help organizations identify vulnerabilities, detect suspicious activity and accelerate responses to cyber incidents. Insurers can also benefit from technology that improves their understanding and assessment of emerging exposures.
According to IBM, organizations using security AI and automation experienced average data breach costs of $4 mn, compared with $5.93 mn for organizations without those capabilities.
The difference of $1.93 mn indicates a substantial association between the use of automated security technologies and lower breach costs.
As AI adoption expands, Triple-I emphasized the importance of effective oversight, employee training and data protection practices to reduce emerging operational and cybersecurity risks.
The need for stronger cyber risk management is also evident in broader assessments of business and consumer concerns.
A recent Triple-I/Munich Re US RiskScan study identified cyber incidents and artificial intelligence among the leading risk concerns across five major industry segments, including consumers and small business owners.
The findings indicate that awareness of cybersecurity threats is widespread, although translating that awareness into effective prevention and financial protection remains a challenge.
Businesses need to understand not only the financial consequences of a cyberattack but also the proactive steps they can take to reduce their exposure.
“Greater education and collaboration among insurers, businesses and cybersecurity professionals are essential to strengthening cyber resilience and helping organizations better prepare for, respond to and recover from an attack.”
The Triple-I report also examines regulatory developments affecting commercial cyber insurance, including requirements for reporting cybersecurity incidents and state-level initiatives governing the use of artificial intelligence in insurance.
For businesses, the findings point to the need to combine insurance coverage with cybersecurity investment, incident response planning and employee preparedness. These measures become increasingly relevant as average claim costs rise and attackers adopt more advanced technologies, even as commercial cyber insurance pricing continues to decline.
