Canada's Cyber Insurance Market Stabilizes After the Ransomware Peak, but the Insurance Bureau of Canada Warns of Shared-Vendor and AI Concentration Risk

The Insurance Bureau of Canada has published a report on the state of the country's cyber insurance market, and its central message is that the market has steadied while new sources of risk are emerging. Insurance Business Canada reported on October 20, 2026 that the report, titled The Canadian Cyber Insurance Market and released in October 2026, credits better underwriting and stronger cyber security controls with restoring stability after the peak of ransomware losses between 2019 and 2021. Insurers, the report says, are focused on underwriting discipline, loss severity and managing exposure.

The most significant finding, in the bureau's own description, concerns shared technology. Many businesses depend on the same cloud providers, software platforms and technology vendors. A disruption at one widely used provider can therefore affect organizations across many sectors at the same time, and insurers and reinsurers are watching these dependencies because they create the potential for correlated losses. In ordinary insurance terms, correlation is the problem that turns many small claims into one very large one. A house fire in one city does not make a fire in another city more likely, but an outage at a widely used cloud service can trigger business interruption claims from thousands of customers at once. The coverage notes that Moody's Ratings, in a survey of North American insurers, also warned that reliance on third-party models and cloud infrastructure raises exposure to incidents at critical vendors. A separate Insurance Business article on September 29 pointed to the July 2024 CrowdStrike update failure as a precedent for this kind of correlated loss.

Artificial intelligence is the second theme. According to the report, companies that adopt the same AI models, platforms and service providers could create new concentrations of cyber exposure. At the same time, generative AI can make phishing, social engineering and fraud easier to scale and harder to detect, while AI-powered security tools can help organizations detect threats and respond faster. IBC says insurers need to understand how businesses govern and secure their AI tools. The coverage does not give numbers on AI-related claims, and it states no loss ratios, claims totals or claim frequency figures, so the report's AI discussion should be read as a statement of emerging risk and not of measured losses.

The article describes the loss types that make cyber events costly. A single incident can trigger business interruption, fraud losses, legal costs, data recovery and privacy obligations, and ransomware remains a major source of severe losses. For pricing, underwriters increasingly review security practices, including multi-factor authentication, incident response planning and third-party risk management. For businesses, that means the controls that reduce the chance of an attack are also the controls that determine whether cover is available and at what price.

The small business gap is the most striking number. In IBC's survey, 22 per cent of small and medium-sized enterprises had cyber insurance, and only 12 per cent had stand-alone cyber cover. Insurance Business Canada's September 29 article described the survey as a 2026 survey while the October 20 article refers to a 2025 survey, so the date of the survey should be confirmed from the bureau's report. The bureau says closing the gap matters more as small businesses adopt AI tools that bring both benefits and new risks. The same September article quotes brokers on why uptake is low: Joseph Hines of Gallagher attributed it mainly to perception and awareness rather than cost, and said that many organizations have not connected cyber insurance to business survival. It also reports that only 48 per cent of small-business respondents believe their business is vulnerable to a cyberattack or data breach, and cites Business Development Bank of Canada data showing that 73 per cent of small businesses have experienced a cybersecurity incident.

The market's history is told in two numbers. The October 20 article, citing an earlier IBC analysis, says Canadian cyber liability premiums grew from $18 million in 2015 to $550 million in 2023. That is roughly a thirty-fold increase, a simple ratio of the two figures, and it reflects both rising demand and the sharp rate increases of the hard market. The September 29 article adds that IBC's report recorded a combined ratio averaging 153 per cent from 2019 to 2023. A combined ratio above 100 per cent means insurers paid out and spent more than they collected in premiums, so a figure of 153 per cent describes a period of heavy losses, which explains why insurers tightened underwriting.

The pricing picture today is softer. According to the September 29 article, Canadian cyber rates fell 6 per cent in each of the first and second quarters of 2026, as new market entrants added capacity in primary and excess layers and competition reached its highest level since before the hard market of 2020 to 2022. Derek May of Hub International described the rate environment as a race to the bottom over the past couple of years, despite claims continuing, and said he expects Canada to follow US carriers that are pushing increases of 5 to 10 per cent within 12 to 18 months. Hines said underwriters believe rates are about right but that claim frequency is not declining, and that a rapid rise in severity or frequency, or a large systemic loss, could quickly test current pricing. The article also cites a Coalition figure that the average Canadian cyber claim in 2025 was US$226,000, more than double the US average of US$108,000.

For brokers, the coverage recommends using the stable market to approach small and medium-sized clients, many of whom lack stand-alone cyber cover and may wrongly assume that a limited package endorsement is enough. Clients can improve their eligibility by putting multi-factor authentication, backups and incident response plans in place before applying. Brokers should also ask commercial clients which cloud, software and AI providers they depend on, and whether their policy covers outages or breaches at those vendors, since contingent business interruption cover varies widely between policies.

The picture that emerges is of a market that has recovered its footing while its biggest risks are shifting from individual ransomware attacks to concentration in the technology stack. The next test will be whether insurers can keep discipline as rates soften and whether small businesses, the largest group without cover, come to treat cyber insurance as part of basic business survival.