New Analysis Examines AI-Driven Threats and Cyber Resilience

MALVERN, Pa.: Cybercrime is becoming more costly and complex, exposing businesses to growing financial risks even as the commercial cyber insurance market remains strong, according to a new Insurance Information Institute (Triple-I) members-only issues brief, Commercial Cyber Insurance: State of the Risk.

The brief examines rising claim severity, AI-powered phishing and social engineering tactics, and increasing digital supply chain exposure, highlighting the importance of helping businesses better understand and manage evolving cyber risks.

U.S. cyber-related losses reached nearly $21 billion in 2025, up from approximately $16 billion in 2024, according to the FBI's Internet Crime Report. More than 1 million incidents were reported, compared with 859,532 the previous year.

“Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges,” said Sean Kevelighan, CEO of Triple-I. “Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack. However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs.”

Cyber insurance adoption among small and mid-sized businesses remains relatively low, with market penetration estimated at just 10% to 20%, according to Swiss Re. These businesses often lack dedicated cybersecurity budgets and advanced defenses, increasing their vulnerability to potentially costly attacks.

Triple-I’s Issues Brief highlighted several developments shaping the cyber insurance market:

• Rising cyber losses: Average cyber claim severity among large U.S. businesses more than doubled to over $4.4 million in 2025, even as claim frequency declined 34% for that segment, according to Chubb.
• Growing ransomware exposure: Ransomware was involved in 48% of data breaches examined in Verizon's 2026 Data Breach Investigations Report. However, 69% of victims declined to pay ransom demands, due in part to better data backups and cybersecurity planning.
• Supply-chain vulnerabilities: Approximately 15% of data breaches in 2026 originated from supply-chain compromises, with an average cost of approximately $5 million, according to IBM.
• Increasing AI-related threats: AI-powered phishing, impersonation and social engineering schemes are making cyberattacks more sophisticated and accessible. The FBI reported nearly $893 million in losses associated with AI-driven incidents in 2025.
• Steady but limited market growth: Global cyber insurance premiums have grown at an annual rate of approximately 5% since 2022, according to Swiss Re. Premiums are projected to reach $16.4 billion in 2026 and $17.1 billion in 2027, with North America accounting for roughly two-thirds of the market.

Cyber insurance rates have declined for four consecutive years, falling approximately 5% year-to-date in 2026, compared with a 13% decline in 2025. Yet adoption remains low among small and mid-sized businesses, suggesting affordability alone may not be the primary barrier to coverage. Misunderstandings about cyber insurance options and benefits may also contribute to the gap.

Artificial Intelligence Presents Risks and Opportunities

While AI is enabling cybercriminals to launch increasingly sophisticated attacks, it is also helping businesses and insurers strengthen defenses, identify vulnerabilities and respond more quickly to cyber incidents.

According to IBM, organizations using security AI and automation experienced average breach costs of $4 million, compared with $5.93 million for organizations without those capabilities, a difference of $1.93 million.

As AI adoption accelerates, effective oversight, employee training and data security will become increasingly important to managing emerging risks and supporting responsible deployment.

Building Cyber Resilience

A recent Triple-I/Munich Re US RiskScan study found cyber incidents and AI ranked among the leading risk concerns across five key industry segments, including consumers and small business owners. The findings reinforce the importance of translating risk awareness into effective protection.

“Businesses need to understand not only the financial consequences of a cyberattack but also the proactive steps they can take to reduce their exposure,” Kevelighan said. “Greater education and collaboration among insurers, businesses and cybersecurity professionals are essential to strengthening cyber resilience and helping organizations better prepare for, respond to and recover from an attack.”

Triple-I’s Issues Brief also examined the evolving regulatory landscape, including cyber incident reporting requirements and state-level initiatives addressing the use of artificial intelligence in insurance.

About the Insurance Information Institute (Triple-I)

Since 1960, the Insurance Information Institute (Triple-I®) has been the trusted voice of risk and insurance, delivering unique, data-driven insights to educate, elevate and connect consumers, industry professionals, policymakers, and the media. An affiliate of The Institutes, Triple-I represents a diverse membership accounting for nearly 50% of all U.S. property/casualty premiums written. Our members include mutual and stock companies, personal and commercial lines, primary insurers and reinsurers – serving regional, national and global markets.

Triple-I is a registered trademark of the Insurance Information Institute. All rights reserved.

About The Institutes

The Institutes® are a not-for-profit dedicated to helping people and organizations succeed in the essential disciplines of risk management and insurance. Through numerous affiliated business units and brands, we educate, elevate, and connect students, professionals, and organizations by equipping them with the knowledge, skills, and collaboration they need to tackle the most complex risk management and insurance challenges. Backed by more than 115 years as a trusted knowledge partner, we empower people and organizations to create a more resilient world.

The Institutes is a registered trademark of The Institutes. All rights reserved.

Fonte: Business Wire