Cyber Market on Edge. Bigger Limits, Bigger Threats in 2026

There is certainly an increase in activity and frequency, but that doesn't really translate to severity. Ransomware continues to persist. The number of clients actually paying a ransom is really only 30 percent. We're not talking as much as capacity or focusing on that as we are in the product options that have become available. Hello everyone, welcome to Insurance Business TV and welcome to our first Canadian Cyber Insurance Power Panel of 2026. Yes, the band is back together, so let's meet them again. We have Derek May, Vice President of Technology and Cyber at Hub International Insurance Brokers. Adi Sharma, Senior Vice President and Cyber Growth Leader at Aon. And Mila Arraggio, AVP, Digital Shield, Personal Cyber Practice Leader North America at NFP and Aon Company. So welcome all and how about this? Mosaic has more than doubled its Canadian cyber capacity to US$25 million, that's Canadian $40 million per risk effective from January 1st this year. Of course, it's explicitly aiming to close a long-standing capacity gap where most domestic carriers were capped at 10 to 15 million Canadian dollars. So how is this step change an available limit, reshaping how you structure cyber towers, allocate primary versus excess layers and indeed compete for larger Canadian risks in 2026? Adi, I'll start with you. Yeah, sure. Thanks, Paul. Certainly big update from Mosaic and one trend that we definitely saw in 2025 from a buyer standpoint was that a lot of organizations did strive to right-size their programs. Obviously, we continue to remain in a soft market, which means excess capacity is more affordable than it has ever been before. So a lot of organizations, especially large risk managed organizations, did right-size their programs and really grab those limits while they were available at some very competitive rates, which was very smart. Now, as I said, certainly very big update from Mosaic and definitely a welcome change to the Canadian cyber insurance market. However, I still don't think it's going to change things drastically because at this point in time, just given the Canadian economy and the composition of companies that exist in Canada, there's only a handful of companies buying some very large towers in Canada. Well, not a handful, maybe a little bit more, but there are still not as many companies as you would, for example, find in the US. So while this is certainly big news and a welcome change, I don't think it's going to have any drastic impacts, at least in 2026. Yeah, Adi is talking around the bigger towers there, Derek, but any comments around the smaller towers? Yeah, I would agree with Adi's comments. I mean, it's nice to have the welcome capacity, but there's already so much capacity out there that what we're doing on smaller towers, and we're talking maybe 10 million limits, 15 million limits, 20 million limits, or something like that, we're really stacking maybe in 5 million increments. And that allows you to obviously have a little bit more flexibility with the marketplace, especially when it comes to first party limits. So on the first party side, as brokers and underwriters are probably aware, there's typically coverage lines like, you know, it could be cybercrime is capped at 250,000 limits. And if you buy a 5 million primary and then stack that up with 10, 15, 20, what we can do is also stack up the cybercrime. So it goes from 250 to 5 to 750 to a million. So it's one easy way that we can quickly get some of those sublimits up. Whereas if you had a 10 million primary limit with a 250,000 for cybercrime, it is really difficult then to kind of get the adequate coverage under that insuring agreement that you need. So mechanically, we definitely work a little bit differently on the smaller tower side, which, you know, doesn't take into consideration, you know, Miller, just to bring you in as well. Any thoughts from the personal line standpoint? Yes, from a personal line standpoint, it's been quite interesting. We're not talking as much as capacity or focusing on that as we are in the product options that have become available in particular over the past year. So what we're seeing are new product options. And this opens up the opportunity to look at strategies to layer coverage and look at that stacking so that individuals are able to obtain the greater coverage limits that they're really looking for overall. So although we have some restrictions and coverage limits, we have more options now to kind of layer. And we're not just restricted to one offering or one option. And this applies, you know, this benefits both individuals in the personal risk space, as well as, you know, our commercial accounts. We have commercial executive opportunities that we look at or group benefits opportunities where we can really fill in some gaps with these options as well. Yes, well, we may be in a new year, but some subjects in the cyber world do not change. We have to talk about ransomware. Of course, there was a late 2025 report from QBE that publicly named ransomware victims on leaked sites will climb from around five thousand and ten in 2024 to more than seven thousand by the end of 2026, with Canada accounting for about 30 significant incidents at six point seven percent of the global total over the last two years. So, Derek, how are you reflecting this projected 40 percent rise in ransomware activity into your Canadian outlook for 2026? Yeah, it's definitely something that we're watching closely, but the stats don't lie other than the fact that while ransomware continues to persist, the number of clients actually paying a ransom is really only 30 percent. And now you could see different stats from different insurers, of course, but I think the consensus is it's about 30 percent of those that are getting hit by ransomware actually paying a ransom to man. And so that said, if if if a threat actor, you know, either doesn't get paid or does get paid and they still decide to dump information onto one of those leak sites, we're still not seeing a lot of financial impact to our clients because we really need to see the sheer number of of records dumped to be in the tens or hundreds or even millions of records. We've had scenarios where we've spoken to legal counsel on a breach where maybe we had, you know, 2000 people impacted with social insurance numbers and things like that that were dumped on these leak sites. And really, that doesn't push the needle when it comes to class action lawsuits or individual lawsuits, really, for there to be enough reason or money in it for a lawyer to get involved. They definitely need to see the sheer number go way up. And so thankfully, we haven't really seen that third party claim activity in Canada. Yeah, it's good we haven't seen too much of that. But Adi, from your perspective, has it been impacting pricing and limits at all? Yeah, and just, I mean, build on what Derek's saying, in Aon's experience, at least, we saw a 77% decrease in organizations that paid a ransom, right? So obviously, appreciating that the ransom demand is just one part of the claim. And, you know, just because you're not paying the ransom demand doesn't mean that the claim is going to be is not going to be substantial. There could be business interruption loss and whatnot. But there is certainly an increase in activity and frequency. But that doesn't really translate to severity. And that is, of course, keeping prices and rates and capacity where it is currently, which is, you know, we're still in a very bio-friendly and soft environment in Canada. So I think there is definitely a strong need for market stabilization in Canada. But I don't know if we'll see any drastic changes in rate stabilization or even hardening in 2026. There certainly is a lot more underwriting rigor and confidence within carriers on the business that they're writing and insuring today. Most importantly, they have a lot more lost data to know what they care about from a controls perspective and the lack of which controls are leading to events that carriers are very concerned by. So the increased competition, the increased capacity, plus the low severity doesn't really help with attracting market stabilization. So while ransomware activity is definitely up, severity might not be. And I don't think that's likely going to impact pricing drastically this year either. Okay. And on the personal side, Mila? So again, you know, the personal risk side of things, the product is still fairly new. And when we look at the claims that we're fielding or the calls that we're fielding from our clients, we're not seeing a very high risk of ransomware, you know, coming across in the claims that are being reported. However, what we do see, and again, keeping in mind that the personal cyber product was originally based on the commercial cyber products. So we see in the wordings and the way everything is structured that the ransomware limits are noted in the policy. So there are sublimits that apply specifically to ransomware. And as things have evolved, even in some cases, some of the social engineering risks that kind of get lumped in there with some carriers. So it can be very interesting to see how that is impacting the policy, even though we haven't had, you know, the timeline with experience with this product line to really report realistically on what percentage of the claims are going to ransomware on our side of things. We have seen some slight increases in premiums. We do see the reservation on the sublimits. But I think one of the strategies that we're using around this, and I think it's really important, is making sure to include new options and empowering our clients about knowing about what the risks are and which policies can respond to various elements of this. Whether this be to their own clients, you know, as offering personal cyber that does cover, you know, some of the risks, or whether it's something that becomes, you know, for home-based businesses and, you know, consultants, people who run small businesses from their homes, they seem to be very concerned about this. So it's a product that we're able to provide, and we can respond to some of these risks for them with it as well. Yeah, if I can stick with you for a minute, Mila, and just sort of build on this ransomware point. The Canadian Centre for Cybersecurity's January ransomware threat outlook concluded that ransomware will remain a growing threat to all Canadian organisations over the next two years, and indeed highlighted AI-enabled tactics plus the value of basic controls and early warning collaboration as well. So how are you seeing this outlook incorporated into insurers underwriting questions, the minimum control benchmarks and value-added services for Canadian insureds in 2026? So online scams and AI are an active threat, getting the attention of our personal risk clients. You know, ransomware, of course, comes in there because, you know, people get targeted, then they lose control of their information, and they could be targeted, you know, in a number of ways, including, you know, the ransomware. So employers are looking to protect employees. We've seen, you know, underwriting questions in some circumstances evolve where we're taking, you know, so what we're doing is we're taking the approach of highlighting value-added perks, trying to, you know, encourage people to stay on top of the threats by using, you know, these value-added services, access to security experts, very often you have access to 24-7, you know, services when you do have a personal cyber policy, and essentially empower individuals with information and education and the resources to navigate this challenging landscape and hopefully feel more comfortable so that they're less at risk. And in the event that there is a threat, you know, that comes up, that they have tools available to them to, you know, avoid having to pay the ransom or know how to navigate that to protect themselves and their families to the best of their abilities. Ah, yeah, well, let's flick it back over to the commercial side if we can. Derek, what are you seeing insurers do on that side of the equation? Yeah, I think you mentioned in your initial question, which was the early warning collaboration between insurers and insureds, and I think that has dramatically changed over the last five or six years. So it's very commonplace now that the insurers are going to have scanning technology that's often operating behind the scenes where they can proactively, if they spot something, reach out to our insureds directly. Usually the broker is hopefully copied in that communication so we can help to follow up as well. But what this has done is really removed this gray area between the insured and the insurer so that when something needs to be dealt with appropriately and very quickly, it can be done ASAP with that connection between the two parties. And so, just in speaking with our insurer partners, what we understand is that they've been able to thwart many, many attacks just by virtue of them being able to get directly in touch with the insured, have them make these system changes or network changes that are presenting vulnerabilities before a hacker can act on them. And so that's certainly reduced claims, reduced costs, and it's great to see moving forward and we hope that that trend continues. So Avi, I suppose overall there's just a need for us to continuously evolve? Yeah, I think in terms of underwriting requirements, be that questions, minimum controls or scans, as Derek mentioned, I think it's definitely an area that will continuously evolve just given cyber risk being a risk that's continuously evolving. But it's also important to understand and acknowledge that it has evolved a healthy amount since 2020. I think we've come a long way in terms of what questions we're asking and the quality of questions that we're asking an insured. And that is a product of having a lot more lost data and a lot more experience where insurers know what types of controls are important to protect against certain types of incidents that insurers are concerned about. So that has certainly led to a higher quality of information that we're asking. We obviously usually ask for a ransomware supplement, which has specific questions to do with ransomware and some of the controls that organisations have in place to protect themselves against ransomware. So yes, while there is a need to constantly evolve and you can always ask more questions, I think we have come a long way as an industry in the quality of information that we're asking compared to maybe back in 2020. I just have one final question to throw at you all. QBE and Control Risks reported that high severity cloud security alerts jumped 235% in 2024 and that nearly half of corporate data stored in the cloud is now considered sensitive, raising concerns about aggregation risk if a major cloud or identity provider were to be compromised. So Adi, just to continue with you as you look at your 2026 Canadian cyber portfolio, how are you adjusting wording, sublimits, vendor-specific endorsements and accumulation modelling to address systemic cloud and third-party risk? Yeah. I mean, Paul, as brokers or just cyber insurance professionals, we have a variety of different responsibilities, right? And one of those responsibilities is, of course, to ensure that our clients are adequately protected against any emerging exposures. And obviously the past year or the past couple of years with incidents such as CrowdStrike or CDK or some very large incidents in the aviation space as well as the manufacturing space have all kind of highlighted the importance of adequate third-party risk protection such as dependent business interruption, dependent system failure. These are all critical coverages which, yes, they were always available, but insureds didn't really pay much attention to some of these coverages and what they could potentially do for an insured in the event of an incident. So some of these situations that we saw over the past few years definitely highlighted the importance of these incidents. And as brokers, we definitely have the responsibility to make sure our clients are adequately protected and have these coverages. Now, also as brokers and individuals that are part of this industry, we have a responsibility to protect the market itself from systemic risk. There is the likelihood that we see something extremely dangerous that could potentially, worst case, blow up the cyber insurance market just because there's not enough premium to pay some of these very large systemic losses that could arise. So it's a double-edged sword. And I think if we want to ensure the longevity of the cyber insurance market, we certainly do have to be open to some carriers adding language or protections from systemic risk. Yeah, it seems there's plenty of responsibility to be taken. It's responsibility on your shoulders too, Derek. I imagine you're having to learn to adapt as well. Yeah, I think just to piggyback on what Addy said, as brokers, we're always trying to push the envelope, right? It's always us negotiating on behalf of our clients against or with the underwriters and we're trying to secure the best coverage possible. But you know what, this soft market has brought a really refreshing tone, I think, to our marketplace. There's really healthy competition out there. There's insurers that are really pushing the envelope on what is and isn't possible. Certainly, that's a benefit of clients pushing the brokers and the brokers pushing the underwriters. But I think in this soft market, the underwriters have really been stepping up and coming to the table, willing and ready to evolve the industry and to put us in a spot where a lot of these claims that maybe weren't considered a few years ago would now be covered under a cyber policy. So, we're throwing in crime coverage, we're throwing in media coverage, we're throwing in contingent business interruption and there could be property losses that are covered. This policy from 10 years ago has expanded considerably and obviously, we're meeting the need of the marketplace. It is a fine balance though, as Addy mentioned. One systemic risk could blow everything up. So, we do need to make sure that we're walking that line accordingly, that we're not overstepping that line, but we are meeting the need of the marketplace and I think we've done that so far. But the market ebbs and flows. We're going to push a little, we might need to pull back a little, then we'll push a little and I think at some point, we'll find a good middle ground. Yeah. Mila, any thoughts on the personal risk side? Yes. A lot of these points apply very much to the personal risk side of things in a similar way. Something that's very interesting is third-party risk on a personal risk space. When someone is talking about their own personal policy or they're worried about their own items, they seem to have this false conception that they're in control of what happens to them. And what's really interesting is the third-party risk, as we've seen in growing numbers year over year, is that people are exposed even if they take all the best precautions, they have great cyber hygiene, they're doing everything that they can, but it's not all in their hands. And so the product line that we're developing and we see developing across all of the different carriers in the personal risk actually addresses a lot of that from a cyber crime perspective, as opposed to a traditional what people would call cyber liability. So in personal risk, we're looking at policies that can respond to the evolving cyber crimes and respond to situations where the person really has done everything that they possibly can, or the employee has done everything that they possibly can to protect what's in their care. And because they get exposed somewhere, it can create a situation that puts not only themselves, their homes, their families, or maybe even their co-workers or employers at risk. So overall, I think as brokers, this highlights the importance for us as well to really advise our clients, let them know what's available, and help them understand that there are products there that can support them and that can provide compensation so that they don't end up in a severely damaging financial situation or putting their company or employers at risk as well. Yeah, strong message to end on and indeed great thoughts from everyone. As always, remember they will be here throughout 2026. So keep it right here on Insurance Business TV.