Building a sustainable cyber market in the AI era

Swiss Re's latest data demonstrates that while the internal growth dynamics of the cyber market are largely unchanged year-on-year, its external risk environment is not. Ransomware, supply-chain dependencies, geopolitical tensions and rapid technological change are reshaping organisations’ exposures. At the heart of this development is artificial intelligence (AI), with its clear potential to strengthen operations and cyber resilience while also potentially amplifying existing cyber risks.

Across the industry, AI has quickly become one of the defining discussion topics, given its potential to transform insurance operations and decision-making. At the same time, there is ongoing debate about the extent to which this value-creating technology might intensify existing risks across multiple lines of business.

In the cyber sector, AI appears primarily to be reshaping and amplifying existing cyber risks rather than creating entirely new categories of insured loss. Typical commercial cyber insurance products may already respond to a subset of AI-driven cyber incident scenarios, as AI models can fall within policy definitions of computer systems. Resulting losses could be covered under different sections of standard commercial cyber policies today, making it essential for insureds and insurers to develop a common understanding of how current wordings respond to AI-driven incidents.

Table 1: Six AI-driven cyber incident scenarios

Today, AI is increasingly being used in both cyber offence and defence. For threat actors, it can accelerate vulnerability identification, automated attacks and next-generation phishing capabilities. For organisations, however, it can serve to strengthen their threat detection, automated incident response and cyber resilience.

AI-related cyber claims remain limited today, but insurers will need to monitor how technology, regulation and loss trends develop — and ensure that coverage intent remains clear as exposures evolve. Against this backdrop, adequate cyber protection is becoming increasingly important to organisations of every size. But will the combination of evolving risk and growing protection needs accelerate global premium growth?

Graph 1: Global cyber insurance premium by underwriting year (bn USD)

Year-on-year, cyber premium CAGR¹⁶ has remained stable at 5%, as from 2022. As Swiss Re projects full-year premium to reach USD 16.4 billion in 2026 and USD 17.1 billion in 2027, cyber is still producing attractive premium growth compared to other lines of business, although this is being tempered by ongoing rate reductions.

Graph 2: Global cyber rate change versus prior underwriting year

Swiss Re data indicates that rate has decreased for a fourth consecutive year. This decline eased from around -13% in 2025 to -5% in 2026 globally, driven largely by pricing stabilisation in the US market where carriers are responding to profitability pressure. In other regions, particularly in Europe, price competition remains strong and rate continues to decline more sharply.

With supply still outweighing demand, the industry needs to focus on growing the cyber market itself, while ensuring that premium, limits, policy language and cybersecurity controls adequately reflect the changing risk landscape.

Visual: Global market premium USD 16.4 billion in 2026 – regional split

In 2026, North America is still the dominant market, commanding about two-thirds of global premium (USD 10.7 billion).

Europe, which accounts for 21% of global premium share (USD 3.42 billion), is gaining weight. This has largely been driven by moves from global carriers and international cyber-MGAs to invest heavily and form new partnerships to expand in the region and harvest its untapped growth potential.

APAC ranks as the third-largest market for cyber premium with a 10% global premium share (USD 1.7 billion). Meanwhile, the Latam and MEA regions are still comparatively small in terms of current cyber insurance premium, with each accounting for circa 2% of global premium (USD 0.28 billion and USD 0.31 billion respectively).

Graph 3: Global market premium USD 16.4 billion in 2026 – insured segment split

With global premium growth remaining in the single-digit range and low penetration across multiple geographic regions, the cyber protection gap represents a material opportunity for cyber growth. This can take one of three avenues: attracting new buyers to the market, exploring the potential for higher limits among existing buyers – or a combination of the two.

Today, micro-SMEs and SMEs are largely uninsured, with estimated penetration ranges of only 5–10% and 10–20%, respectively. Despite very low take-up, however, these businesses will generate an estimated USD 4.9 billion in premium in 2026, highlighting that this segment is still the cyber market's largest growth avenue in terms of premium footprint.

In the mid-market, penetration is higher at 40–50% but the market is by no means fully tapped and this segment is expected to bring in premium of approximately USD 4.1 billion in 2026. As such, there is still meaningful growth potential in the mid-market space and this growth can come from both attracting new buyers and increasing existing insureds' limits to reflect their evolving cyber risk exposure.

Large corporates continue to dominate the market both in terms of premium – an estimated USD 7.4 billion in 2026 – and penetration – at 60–70%. Here, the volatile threat landscape and recent high-profile attacks on manufacturers and retailers have underscored the importance of adequate cyber protection.

Swiss Re estimates that average limits purchased by large corporates are approximately USD 120 million in the US and USD 90 million in Europe, reflecting a focus on protection against severe events rather than smaller, attritional losses.

Swiss Re’s Cyber Claims Database also shows that, over the past five years, an average of ten losses per year would have exceeded the USD 120 million benchmark. This comparison raises the question of whether large corporates may be underinsured against the losses they most want their insurance programmes to absorb.

Losses of this magnitude are predominantly associated with ransomware and privacy violations or data breaches. For large corporates, severe cyber incidents can combine prolonged digital business interruption, lost revenue, restoration costs, supply-chain disruption and reputational damage.

Accelerating AI adoption may further increase digital dependency and expand the attack surface, while losses could exceed limits calibrated to historical benchmarks.

A doubling of current average limits may therefore be needed in some cases, although adequate capacity will always depend on the individual company’s activities, geography and risk profile.

Across the market, the growth opportunity therefore differs by segment: expanding penetration among SMEs, combining increased penetration with higher limits in the mid-market, and improving limit adequacy among large corporates.

Reinsurance capacity helps insurers manage volatility and accumulation risk as cyber portfolios and limits grow. This role is becoming more important as AI adoption increases digital dependency and changes cyber risks.

As a leading cyber reinsurer and trusted client partner, Swiss Re adds value beyond risk transfer. Our cyber underwriting teams are close to regional markets and clients, providing first-hand insight into local market dynamics, risk developments and protection needs.

At the same time, our global reach enables us to identify broader trends and share experience across markets. Combining global cyber know-how with extensive risk insights from Swiss Re’s Cyber Data Lake¹⁷ and tailored training programmes, we support our clients in managing cyber risks and growing their business sustainably.

Sharp corrections characterised earlier phases of the cyber market's development, creating volatility for insurers and uncertainty for buyers. Today, the market has a real chance to learn from the cycles of the past and avoid repeating abrupt shifts in pricing, capacity or coverage.

With digital dependency increasing and AI reshaping cyber risks, demand for risk transfer is likely to continue growing. But it must be supported by disciplined underwriting and deliberate market development.

A sustainable cyber market in the AI era will require insurers and reinsurers to monitor emerging exposures and loss trends proactively, clarify how wordings respond to AI-related scenarios, and ensure pricing reflects the risk being assumed.