Cyber Insurance Rates Keep Falling, but Most Small Businesses Still Have None

Cyber losses are climbing and coverage has gotten cheaper for four straight years, yet most small and midsize businesses still don't carry it.

Cyber losses in the US hit nearly $21 billion in 2025, up from about $16 billion in 2024, according to the FBI's Internet Crime Report. More than 1 million incidents were reported, up from 859,532 the year before. At the same time, cyber insurance rates have fallen for four years running, down about 5% so far in 2026 after a 13% drop in 2025, according to Swiss Re.

You'd think cheaper coverage against a growing threat would mean everybody buys it. They don't. Swiss Re puts cyber insurance penetration among small and midsize businesses at just 10% to 20%. Sean Kevelighan, CEO of the Insurance Information Institute, put it plainly in a new Triple-I issues brief: "Cyber threats are evolving faster than many businesses can adapt, creating significant financial and operational challenges."

Here's my take: when the price keeps falling and the demand doesn't follow, price was never the real problem. Kevelighan said as much too, cyber insurance is "an important part of a comprehensive risk management strategy," but "insurance alone is not enough." If owners don't understand what a policy actually covers, cutting the price doesn't change their decision.

AI Is on Both Sides of This Fight

AI-powered phishing, impersonation and social engineering are making cyberattacks more sophisticated and easier to pull off at the same time. The FBI tied nearly $893 million in losses in 2025 to AI-driven incidents.

But AI cuts the other way too. IBM found organizations using security AI and automation had average breach costs of $4 million, compared with $5.93 million for those without, a gap of $1.93 million. Ransomware showed up in 48% of the breaches examined in Verizon's 2026 Data Breach Investigations Report, and 69% of victims refused to pay, which Verizon credits partly to better backups and planning.

That's the honest version of the AI story for a small business owner: the attackers have a new tool, and so do the defenders, but only one side has been buying it.

Underinsurance Looks the Same in Every Line of Coverage

I see this same pattern in property and liability insurance, not just cyber. Business owners assume a general policy covers something it doesn't, or they skip a coverage because nobody explained what it actually protects against. Underwriting language can make a policy hard to read, and a lot of owners never ask the follow-up question that would clear it up.

That matches what Triple-I is pointing at here: with rates falling four years straight, cost isn't the main barrier anymore, misunderstanding is. About 15% of data breaches in 2026 came from supply chain compromises, costing an average of $5 million, according to IBM. If you run a small business and don't know whether your vendor's software counts against your own exposure, that's exactly the kind of gap a broker should be closing before a renewal, not after a claim.

What a Bad Year Does to Jobs and Payrolls

For big companies, the claim data looks better in one sense and worse in another. Claim frequency for large US businesses fell 34% in 2025, but average severity for those claims more than doubled to over $4.4 million, according to Chubb numbers cited by Triple-I. Fewer hits, but the ones that land are bigger.

A company with reserves and a risk team can absorb that. A small business with no cushion and no policy usually can't, and that's where it hits jobs directly: payroll, hours and sometimes the business itself.

You can see a milder version of that same fragility show up outside of cyber entirely, in ordinary earnings season.

Comtech's latest quarter shows orders down by half even as the company banked more cash, leaning on its 9-1-1 and emergency communications unit while it waits to sell off its satellite business. A company with options can manage a swing like that. A small business owner with no cash cushion and no cyber coverage, hit with a $5 million supply chain breach, doesn't get the same runway, and that's often where the first cuts come out of payroll.

What to Ask Before Your Next Renewal

If you own a small or midsize business, don't wait for a quote to tell you whether cyber coverage is worth it. Ask your agent or broker these questions directly.

Rates are down for the fourth year running. There's rarely been a cheaper time to close this gap.

• Does my current business policy exclude cyber losses, or do I need a standalone cyber policy?
• Am I covered if a vendor or software provider I rely on gets breached, not just if I get breached directly?
• What does my insurer require for backups and incident response, since better backups is a big reason 69% of ransomware victims didn't pay?
• Is my industry or state adding new cyber incident reporting rules I need to track?