Canada's cyber insurance market is showing signs of stabilization following years of volatility, according to a new report from the Insurance Bureau of Canada (IBC).
The report, The Canadian Cyber Insurance Market, outlined how improved underwriting discipline, better loss predictability and expanding product availability have helped restore balance to a market that once faced severe losses.
Between 2019 and 2023, Canadian cyber insurers recorded average combined loss ratios of about 155%, underscoring the strain from escalating ransomware and data breach claims. That period forced insurers to reassess pricing, tighten terms and conditions, and adopt stricter risk selection criteria. The result, IBC said, has been a more sustainable market, though the threat environment remains highly dynamic.
One of the biggest emerging risks is the weaponization of artificial intelligence. Cyber criminals are increasingly leveraging AI to automate and refine attacks, including phishing campaigns that mimic legitimate communications with near-perfect accuracy. The report also noted the growing use of deepfake technology in fraud and impersonation schemes, a trend that could further complicate loss prevention and claims assessment.
Meanwhile, the report emphasized that while insurance plays a key role in mitigating financial fallout, effective cybersecurity also depends on robust policy and regulation. Progress on this front has been uneven. The federal government’s recent reintroduction of Bill C-8, which includes the Critical Cyber Systems Protection Act, aims to establish mandatory cybersecurity standards, stronger oversight, and clearer incident reporting requirements for critical infrastructure operators.
IBC said collaboration between the public and private sectors will be vital in addressing the scale and sophistication of cyber risk. Initiatives such as the Canadian Cyber Defence Collective and the National Cyber Security Strategy are already advancing this goal, but further coordination will be necessary to build national resilience.
Small and medium-sized enterprises (SMEs) remain a particular area of concern. Despite accounting for the majority of Canadian businesses, SMEs are both highly exposed to cyber threats and significantly underinsured. IBC warned that the economic cost of widespread underinsurance could be substantial, leaving many businesses, and the broader economy, vulnerable to large, uninsured losses.
To close that gap, IBC continues to promote awareness through its Cyber Savvy Canada campaign and recently launched a free Cyber Insurance Guide to help business owners understand coverage options, recovery strategies, and risk management tools.
The report suggested that as cyber risks evolve, insurers will need to maintain pricing discipline and underwriting innovation, while policymakers and businesses work together to strengthen the country’s digital resilience.
