US Cyber Losses Reach $21B as Triple-I Warns of Rising Threats and Low Coverage

Despite four consecutive years of declining rates, the commercial cyber insurance market faces a widening gap between market pricing and claim severity. New data reveals that U.S. cyber-related losses reached nearly $21 billion in 2025, driven by AI-powered threats and supply chain vulnerabilities, posing significant capital and underwriting challenges for carriers and MGAs.

What was announced

The Insurance Information Institute (Triple-I) released a new members-only issues brief, Commercial Cyber Insurance: State of the Risk, detailing the current trajectory of the cyber insurance sector. The report highlights a sharp increase in financial exposure, noting that U.S. cyber losses rose from approximately $16 billion in 2024 to nearly $21 billion in 2025. This surge occurred alongside a rise in reported incidents, which surpassed 1 million in 2025 compared to 859,532 the previous year.

The brief identifies a significant shift in claim dynamics. While claim frequency for large U.S. businesses declined by 34%, the average claim severity for this segment more than doubled to over $4.4 million in 2025. Ransomware remains a dominant threat, appearing in 48% of data breaches, although 69% of victims now decline to pay demands due to improved backup strategies. Furthermore, supply-chain compromises accounted for roughly 15% of breaches in 2026, with an average cost of $5 million per incident.

From a market perspective, global cyber insurance premiums have maintained an annual growth rate of approximately 5% since 2022. Projections suggest premiums will reach $16.4 billion in 2026 and $17.1 billion in 2027, with North America continuing to represent two-thirds of the total market. However, adoption among small and mid-sized businesses (SMBs) remains low, with market penetration estimated at just 10% to 20%.

"Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges. Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack. However, insurance alone is not enough. Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs."

Sean Kevelighan, CEO of Triple-I.

The companies involved

The Insurance Information Institute (Triple-I) is an industry association that serves as a central source of data-driven insights and communications for the insurance sector. It focuses on improving public understanding of insurance—what it does and how it works—providing research and analysis to carriers, brokers, and policymakers. The organization is a key resource for professionals seeking to navigate complex risk landscapes, such as the evolving cyber market and the impact of emerging technologies.

Munich Re is one of the world’s leading providers of reinsurance, primary insurance, and insurance-related risk solutions. The group consists of the reinsurance and ERGO business segments, as well as the capital investment company MEAG. Munich Re is a major force in the global cyber insurance market and frequently collaborates with organizations like Triple-I to analyze systemic digital risks. Their joint RiskScan study recently identified cyber incidents and artificial intelligence as leading concerns across multiple industry segments, including small business owners and consumers.

What FF News has reported before

FF News has previously covered Triple-I’s efforts to quantify market pressures, including the launch of the Triple-I Launches Insurance Affordability Index to Track US Rate Drivers. This index was designed to provide a state-by-state view of the economic factors influencing insurance costs. Additionally, our reporting on risk mitigation includes analysis of how proactive measures can drastically reduce exposure, as seen in Guidewire HazardHub: 1M California Homes at High Wildfire Risk as Mitigation Cuts Losses by 70%. These reports underscore a recurring theme in the industry: the necessity of combining data-driven underwriting with active loss prevention to maintain long-term market stability.

What this means from an insurtech perspective

The disconnect between falling premiums—down 5% in 2026 following a 13% decline in 2025—and rising claim severity suggests a highly competitive but potentially volatile cyber market. For insurtech vendors and MGAs, the 10% to 20% penetration rate among SMBs represents a significant distribution failure that affordability alone has not solved. The industry is under pressure to move beyond "indemnity-only" products toward "active" insurance models that integrate AI-driven threat detection. As supply-chain vulnerabilities and AI-powered phishing increase loss ratios, carriers that fail to mandate or provide cybersecurity tools alongside coverage may find their current pricing models unsustainable as claim costs continue to escalate.