Canada’s cyber insurance market has stabilized. That is the good news in the Insurance Bureau of Canada’s new report, The Canadian Cyber Insurance Market, released this month: better underwriting and stronger security controls have restored stability since the ransomware peak of 2019 to 2021. The finding brokers should read twice sits further in. The next large cyber loss may not belong to one client — it may belong to every client who shares the same technology.
IBC describes shared technology as one of the report’s most significant findings. Businesses in every sector run on the same small set of cloud providers, software platforms and technology vendors, so a disruption at one widely used provider lands on many balance sheets at the same moment.
Many businesses depend on the same cloud providers, software platforms and technology vendors, so a disruption at one widely used provider can affect organizations across many sectors at once.
The loss insurers are now underwriting is correlation
IBC says insurers and reinsurers are paying closer attention to these dependencies and the potential for correlated losses — claims that arrive together, from one event, across a whole book. The market has the scar tissue to take the point seriously: between 2019 and 2023, Canadian cyber insurers’ combined loss ratios averaged approximately 155%, and the stability since was bought with underwriting discipline, not luck.
The market underneath is far larger than it was. Canadian cyber liability premiums grew from $18 million in 2015 to $550 million in 2023, according to IBC’s earlier analysis. More premium written on the same shared infrastructure means the concentration grows along with the market.
For a broker, correlation has a practical meaning that has nothing to do with reinsurance math. The client whose operation stops when a major cloud provider fails will not be filing an unusual claim. They will be filing the same claim as thousands of other businesses that morning, into the same claims departments, behind the same vendor status page. What their own policy says — not the market’s sympathy — decides how that week goes.
AI stacks a second concentration on the first
The report’s second warning is that AI adoption repeats the pattern. As companies adopt the same AI models, platforms and service providers, IBC says insurers will need to consider whether those dependencies create new concentrations of cyber exposure, or new pathways for a loss to spread across many policyholders at once.
Moody’s Ratings reached the same place this month. Its survey of North American insurers warned that reliance on third-party models and cloud infrastructure increases insurers’ exposure to cyber incidents at critical vendors. When the bureau, the rating agency and the reinsurers all point at the vendor stack, the vendor stack becomes an underwriting subject — and a broker conversation.
AI also cuts the other way in the report: generative tools make phishing, social engineering and fraud easier to scale, while AI-powered defenses help insureds spot threats and respond faster. Neither direction changes the concentration point. The tools differ; the rails are shared.
July 2024 already ran this scenario
The scenario is not theoretical. In July 2024, a defective software update — not a cyberattack — crashed millions of Windows devices worldwide and halted airlines, hospitals, banks and thousands of smaller businesses for hours. The operational losses were indistinguishable from an attack’s.
The coverage lesson was sharper. Most dependent business interruption wording requires a security failure at the vendor. A defective update is an operational, or system, failure. Some policies have since added system-failure triggers to close that gap; many have not. Two clients, same outage, same downtime — one policy responds and one does not, and the difference is a definition neither client has read.
Whether the policy responds turns on five checks
Contingent — or dependent — business interruption is where a cyber policy answers for a vendor’s bad day, and it varies more between policies than almost any other part of the form. Allianz’s cyber research put contingent business interruption at 15% of large cyber claims by value in the first half of 2025, up from 6% in 2024: this is no longer a tail case. We walked through those numbers in when someone else’s outage becomes your claim. Before renewal, five wording checks decide most outcomes:
- The trigger. Does dependent coverage require a security failure at the vendor, or does it also respond to a system failure — an outage with no attacker involved? July 2024 made this the first question, not a footnote.
- The vendor list. Some policies respond to any dependent business; others only to named providers, and some exclude basic infrastructure providers outright. A critical vendor that is not covered on paper is not covered.
- The waiting period. Dependent business interruption typically starts accruing only after a waiting period, commonly 6 to 12 hours. An outage shorter than the wait is the client’s loss, however real it felt.
- The sublimit. Dependent coverage is usually capped at a fraction of the main business interruption limit. A full-limit number on the declarations page can hide a contingent limit that would not cover a week down.
- What counts. Some wordings pay lost net income only and exclude the extra expense of workarounds — the overtime, the manual processes, the rush migration. The period of restoration may also be defined differently for a dependent event than for an attack on the client itself.
The questions to ask while the market is still soft
IBC reports underwriters pricing on controls — multi-factor authentication, incident response planning, third-party risk management — and starting to ask how businesses govern and secure the AI tools they adopt. The broker who arrives with the client’s vendor map already drawn is answering questions the underwriter was about to ask. Four questions open that conversation:
- If each of your cloud, software and AI providers went dark for 24 hours, what stops? The answer is the client’s real dependency list, usually longer than the one on the application.
- Is each of those providers a covered dependent business under the current wording? Named, unnamed, or excluded — checked against the form, not assumed from the proposal.
- What are the waiting period and the sublimit on the dependent coverage? Two numbers, read off the policy, compared against what a day down actually costs this client.
- Who owns the AI tools entering the business? Every new AI service is a new vendor. If nobody inventories them, the dependency list is out of date before the ink dries.
Our broker dependency checklist walks the same ground from the broker’s side of the desk.
The clients who need it most are the least likely to have it
IBC’s 2025 survey found only 22% of Canadian SMEs carry cyber insurance at all, and just 12% carry stand-alone cover. Many of the rest assume a limited package endorsement is enough — an assumption that survives exactly until the day their one shared provider goes down and the endorsement’s dependent wording gets its first real reading.
A stabilized market is the moment to have this conversation. Capacity is available, pricing is competitive, and the controls that qualify a client — multi-factor authentication, backups, an incident response plan — are the same ones that shorten the outage when it comes. The question in the title is now an underwriting question as much as a coverage one. The broker who asks it first, with the wording open on the desk, is the one the client calls when the answer matters.