Canada’s cyber insurance market finds its footing

By Mahan Azimi, Director – Catastrophic and Emerging Risk Policy, IBC —

Encouragingly, the Canadian cyber insurance market continues to stabilize, thanks in part to stronger underwriting practices, more predictable loss trends and a broader array of products. But the threat landscape is evolving at an unprecedented pace. Cyber criminals are increasingly using artificial intelligence (AI) to craft sophisticated attacks, while most small and medium-sized enterprises (SMEs) remain vulnerable and underinsured.^[1]

In a new report, The Canadian Cyber Insurance Market, Insurance Bureau of Canada (IBC) analyzes the defining trends in cyber insurance and offers key recommendations to protect Canada’s digital future.

Cyber insurance has firmly established itself as a key component of the Canadian commercial insurance landscape. The market’s growth has been dramatic as organizations large and small seek financial protection against cyber incidents. However, this rapid growth was accompanied by increases in claims frequency and severity, especially during a period of heightened ransomware events. Between 2019 and 2023, Canadian cyber insurers’ combined loss ratios averaged approximately 155%, reflecting significant underwriting losses.^[2] This culminated in a challenging market by 2021–2022, requiring insurers to reassess coverage and pricing to better manage emerging risks.

One of the most significant developments in the cyber threat landscape is the weaponization of AI by malicious actors. For example, criminals may use AI-powered phishing campaigns that generate highly persuasive emails, making it harder for employees to distinguish phishing lures from legitimate communications.

Another alarming development is the use of deepfake technology. Generative AI can create realistic audio and video imitations of trusted people. Cyber criminals have begun exploiting this in schemes such as business email compromises and executive impersonations.

Effective cyber security requires more than market-driven solutions. It also depends on clear, enforceable regulatory frameworks. In Canada, progress on this front has been uneven. In June 2025, the federal government introduced Bill C-8, which reintroduces the former Bill C-26, including the Critical Cyber Systems Protection Act and amendments to the Telecommunications Act. Bill C-8 signals the federal government’s renewed commitment to standards for critical infrastructure operators including establishing mandatory cybersecurity standards , enhanced regulatory oversight , and baseline standards for cyber risk management and incident reporting.

While this proposed legislation has yet to be enacted, existing public-private initiatives with the federal government, like Canadian Cyber Defence Collective and the broader National Cyber Security Strategy, represent meaningful progress in strengthening Canada’s cyber resilience.

SMEs form the backbone of the Canadian economy, yet when it comes to cyber risk and insurance, they are disproportionately vulnerable and underinsured. The low rate of cyber insurance among SMEs has several consequences. For individual businesses, a minor cyber breach could cost tens or hundreds of thousands of dollars, which many small firms could struggle to afford, while severe attacks could shut them down entirely. At a macro level, widespread SME underinsurance means the Canadian economy may be forced to absorb losses without the financial safety net that insurance provides. The challenge lies in advancing solutions that balance the long-term viability of insurance offerings with affordability for SMEs.

Through its annual Cyber Savvy Canada public education campaign, IBC empowers businesses to enhance their cyber resilience and make informed decisions about risk mitigation, such as adopting cyber insurance. IBC also shares research findings on employee behaviors that may jeopardize their organization’s cybersecurity or data safety, along with SME owners’ attitudes toward cyber risk.

IBC has developed a free Cyber Insurance Guide to help SME owners understand the impact of cyber attacks and how insurance can support recovery. It explains coverage details, offers protection and recovery tips, outlines the application process and shares resources to boost cyber resilience. The guide, along with other resources, is available at www.cybersavvycanada.ca.

Notes

1. Survey conducted by Angus Reid on behalf of Insurance Bureau of Canada from August 6 to 15, 2025. Full report available at www.cybersavvycanada.ca.

2. IBC, 2024.

About Insurance Bureau of Canada

Established in 1964, Insurance Bureau of Canada (IBC) is the national industry association representing Canada’s private home, auto and business insurers. Its member companies make up the vast majority of Canada’s highly competitive property and casualty (P&C) insurance market. As the leading advocate for Canada’s private P&C insurers, IBC collaborates with governments, regulators and stakeholders to support a competitive environment for the P&C insurance industry to continue to help protect Canadians from the risks of today and tomorrow. IBC believes that Canadians value and deserve a responsive and resilient private P&C insurance industry that provides insurance solutions to both individuals and businesses. For more information, visit www.ibc.ca.

Source: Insurance Bureau of Canada (IBC)