MALVERN, PA — U.S. cybercrime losses surged 31% to nearly $21 billion in 2025, exposing a widening financial protection gap among small and midsize businesses despite declining insurance premiums, according to a new analysis from the Insurance Information Institute (Triple-I).
The increase from approximately $16 billion in 2024 coincided with a rise in reported cybercrime incidents to more than 1 million, compared with 859,532 a year earlier, according to FBI data cited in Triple-I’s Commercial Cyber Insurance: State of the Risk report.
The findings underscore a growing disparity between the financial consequences of cyberattacks and businesses’ adoption of insurance coverage. Just 10% to 20% of small and midsize businesses carry cyber insurance, according to estimates from Swiss Re.
The coverage gap persists even as commercial cyber insurance rates have declined for four consecutive years. Rates fell approximately 5% through the reporting period in 2026, following a 13% decline in 2025.
Triple-I identified limited understanding of available policies and their benefits as a potential obstacle to broader adoption, particularly among smaller companies that lack dedicated cybersecurity budgets and specialized defenses.
“Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges,” said Sean Kevelighan, chief executive officer of Triple-I.
“Cyber insurance is an important part of a comprehensive risk management strategy, particularly for small and midsize businesses with fewer resources to recover from an attack,” he added.
The financial consequences of individual incidents are also increasing. Average cyber insurance claim severity among large U.S. businesses more than doubled to exceed $4.4 million in 2025, even as claim frequency for that segment declined 34%, according to Chubb.
Ransomware remains a major source of exposure. Verizon’s 2026 Data Breach Investigations Report found ransomware was involved in 48% of examined data breaches, although 69% of victims declined to pay ransom demands, partly reflecting improvements in backup systems and incident preparation.
Digital supply chains represent another vulnerability. Approximately 15% of data breaches examined in 2026 originated from supply-chain compromises, with an average cost of about $5 million, according to IBM figures cited by Triple-I.
Artificial intelligence is adding to the threat environment by enabling more sophisticated phishing, impersonation and social engineering attacks. The FBI recorded nearly $893 million in losses associated with AI-related incidents in 2025.
The same technology is also being deployed to reduce security costs and improve detection. IBM found that organizations using security AI and automation experienced average breach costs of $4 million, compared with $5.93 million for organizations without those capabilities.
That $1.93 million difference illustrates the potential financial significance of automated security tools, although the comparison does not establish that AI alone produced the lower costs.
The global cyber insurance market continues to expand, but at a moderate pace. Swiss Re estimates annual premium growth of approximately 5% since 2022, with global premiums projected to reach $16.4 billion in 2026 and $17.1 billion in 2027.
North America accounts for roughly two-thirds of the market, making U.S. businesses a major source of demand for cyber risk coverage.
Triple-I’s analysis also examined regulatory developments affecting cyber incident reporting and state oversight of artificial intelligence in insurance, adding compliance considerations to the financial and operational risks businesses face.
A separate Triple-I and Munich Re US RiskScan study identified cyber incidents and artificial intelligence among leading concerns across five industry segments, including consumers and small business owners.
Kevelighan said effective protection requires businesses to combine insurance with preventive controls and incident-response planning rather than treating coverage as a substitute for cybersecurity.
“Prevention, preparedness and insurance coverage must work together to strengthen resilience and help businesses recover when an attack occurs,” he said.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.