Canada’s cyber insurance market has continued to stabilize after the losses of the ransomware years, but shared technology and the rapid adoption of artificial intelligence are creating new risks of losses that hit many businesses at once, according to the Insurance Bureau of Canada (IBC).
IBC’s latest report, The Canadian Cyber Insurance Market, released this month, says better underwriting and stronger cyber security controls have restored stability since the peak ransomware period from 2019 to 2021.
Insurers are now focused on underwriting discipline, loss severity and managing exposure.
IBC described shared technology as one of the report’s most significant findings. Many businesses depend on the same cloud providers, software platforms and technology vendors, so a disruption at one widely used provider can affect organizations across many sectors at once. IBC said insurers and reinsurers are paying closer attention to these dependencies and the potential for correlated losses.
AI adds to that concern. As companies adopt the same AI models, platforms and service providers, IBC said insurers will need to consider whether those dependencies create new concentrations of cyber exposure or pathways for losses to spread across many policyholders.
That echoes findings elsewhere this month. Moody’s Ratings’ survey of North American insurers warned that reliance on third-party models and cloud infrastructure increases insurers’ exposure to cyber incidents at critical vendors.
IBC said generative AI can make phishing, social engineering and fraud easier to scale and harder to detect. At the same time, AI-powered security tools can help organizations spot threats and respond faster. A single cyber event can still trigger business interruption, fraud losses, legal costs, data recovery and privacy obligations, and ransomware remains a major source of severe losses.
Underwriters increasingly look at an organization’s security practices when pricing cover, including multi-factor authentication, incident response planning and third-party risk management. IBC said insurers will also need to understand how businesses govern and secure AI tools.
The protection gap among small and medium-sized businesses remains wide. In IBC’s 2025 survey, only 22% of SMEs had cyber insurance, and just 12% had stand-alone cyber cover. IBC said closing that gap is especially important as SMEs adopt AI tools that bring business benefits but also new risks.
The market has grown significantly. IBC’s earlier analysis found that Canadian cyber liability premiums rose from $18 million in 2015 to $550 million in 2023.
For brokers, the stable market is a chance to close the SME gap. Most small business clients still don’t have stand-alone cyber cover, and many may assume a limited package endorsement is enough. With underwriting now focused on controls, brokers can help clients qualify by getting multi-factor authentication, backups and incident response plans in place before applying.
The concentration findings also matter for commercial clients. Brokers should ask which cloud, software and AI providers a client depends on and whether their policy responds to an outage or breach at a vendor, an area where cover for contingent business interruption varies widely between policies.
