The Insurance Information Institute (Triple-I), a US-based organisation that provides research, insights and analysis on insurance-related issues, has warned that businesses face mounting financial and operational pressures as cyber threats become more sophisticated and expensive to manage.
In its latest members-only report, Commercial Cyber Insurance: State of the Risk, Triple-I examines the factors influencing the commercial cyber insurance market, including rising claims costs, AI-enabled fraud and weaknesses within digital supply chains.
The report emphasises the need for businesses to take a combined approach to cyber risk, bringing together preventative security measures, incident response planning and appropriate insurance protection to limit potential losses and support recovery.
Data from the FBI’s Internet Crime Report shows that reported US cyber-related losses rose to nearly USD $21 billion in 2025, compared with approximately USD $16 billion in 2024. The number of reported incidents also increased, exceeding one million in 2025, up from 859,532 a year earlier.
Sean Kevelighan, CEO of Triple-I, commented: “Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges. Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack. However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs.”
Triple-I’s analysis also draws attention to the limited uptake of cyber insurance among small and medium-sized businesses. Swiss Re estimates that only 10% to 20% of businesses in this category have cyber insurance, leaving many without dedicated financial protection against cyber-related losses.
According to Triple-I, smaller organisations can face additional challenges because of restricted cybersecurity budgets and limited access to advanced security systems. These constraints may make it more difficult to prevent attacks, contain breaches and recover from their financial consequences.
The report identifies the increasing cost of cyber claims as a key concern for insurers and businesses. Figures from Chubb show that the average cost of cyber claims involving large US businesses rose to more than USD $4.4 million in 2025, more than double the previous level. This increase occurred even as claim frequency for these businesses fell by 34%, indicating that fewer claims do not necessarily translate into lower financial losses.
Ransomware continues to contribute to the cyber risk landscape. Verizon’s 2026 Data Breach Investigations Report found that ransomware featured in 48% of the data breaches analysed. However, 69% of affected organisations or individuals chose not to pay the ransom, with stronger backup arrangements and improved cybersecurity planning among the factors helping victims avoid payment.
Triple-I’s report also highlights the financial consequences of attacks targeting digital supply chains. According to IBM, approximately 15% of data breaches in 2026 originated from supply-chain compromises, with the average cost reaching around USD $5 million. These incidents demonstrate how weaknesses involving external suppliers and connected systems can create additional exposure for businesses beyond their own IT environments.
Triple-I notes that cybercriminals are using AI to make phishing campaigns, impersonation attempts and social engineering schemes more convincing and easier to carry out. The FBI recorded nearly USD $893 million in losses associated with AI-driven incidents in 2025, highlighting the financial implications of these methods.
Despite the increase in cyber risks, the insurance market continues to grow. Swiss Re estimates that global cyber insurance premiums have risen by approximately 5% annually since 2022. The market is forecast to reach USD $16.4 billion in premiums in 2026, increasing to USD $17.1 billion in 2027. North America is expected to account for approximately two-thirds of the global market.
Triple-I’s findings indicate that pricing conditions have also become more favourable for policyholders. Cyber insurance rates have fallen for four consecutive years, with a year-to-date decrease of approximately 5% in 2026 following a 13% reduction in 2025. However, lower premiums have not resulted in widespread adoption among small and medium-sized businesses.
The organisation suggests that cost may therefore be only one factor behind the coverage gap. Limited understanding of policy options, the protection available and the potential benefits of cyber insurance may also influence whether businesses choose to purchase cover.
AI is not solely a source of increased exposure, according to Triple-I’s analysis. The technology can also help organisations and insurers improve their security arrangements, detect weaknesses and respond more efficiently when incidents occur.
Research from IBM found that organisations using security AI and automation recorded average data breach costs of USD $4 million. This compared with USD $5.93 million among organisations that did not use these capabilities, representing a difference of USD $1.93 million.
As AI becomes more widely integrated into business operations, Triple-I highlights the importance of appropriate governance, staff training and robust data protection. These measures can help organisations manage potential vulnerabilities while making responsible use of the technology.
The importance of addressing cyber risks is also reflected in a recent US RiskScan study conducted by Triple-I and Munich Re. The research identified cyber incidents and AI among the leading risk concerns across five major industry segments, including consumers and small business owners.
Triple-I said the findings highlight the need for businesses to move beyond recognising cyber threats and take practical steps to reduce their exposure. This includes understanding the potential financial impact of an incident, assessing existing security measures and considering how insurance could support recovery.
“Businesses need to understand not only the financial consequences of a cyberattack but also the proactive steps they can take to reduce their exposure,” Kevelighan added. “Greater education and collaboration among insurers, businesses and cybersecurity professionals are essential to strengthening cyber resilience and helping organisations better prepare for, respond to and recover from an attack.”
