Cyberattacks across North America are growing bigger and more connected, raising questions about whether cyber insurance is prepared for today’s risks. Over the past year, there have been major ransomware and supply chain incidents that shut down critical infrastructure and hit big retailers in the US and Canada. These attacks show how digital systems are tightly linked, meaning one breach can ripple through entire industries.
Data shows the damage is getting more expensive, too. IBM’s 2025 report says the average cost of a data breach worldwide is $4.7 million. Meanwhile, Sophos reports that nearly 60% of organizations faced ransomware attacks in the last year. With cyber threats evolving rapidly, insurers and brokers are wondering if current policies and underwriting practices can keep up.
At Tokio Marine HCC, experts point out that many of last year’s biggest cyber incidents weren’t simple breaches. Instead, they caused widespread disruption across supply chains, cloud services, and whole sectors. Xavier Marguinaud, head of international cyber at Tokio Marine HCC, explained that cyber risk today is more about operational breakdowns and identity theft than isolated hacks. “The most significant attacks spread across suppliers, cloud platforms, and entire industries,” he said, highlighting how connected digital systems have become.
There’s also a growing concern over “clusters” of attacks hitting companies that use similar technology or share suppliers. For example, UK retailers like Marks & Spencer, Co-op, and Harrods suffered incidents around the same time, showing how industries can be vulnerable if their tech stacks overlap. Isaac Guasch, cybersecurity lead at Tokio Marine HCC, noted that this pattern indicates attackers may be strategically targeting groups of similar businesses, especially retailers who are highly sensitive to downtime due to its immediate impact on revenue and customer trust.
The tactics of cybercriminals are changing, too. Instead of just using technical tricks, attackers now often exploit trusted relationships by stealing credentials, hijacking tokens, or compromising third-party connections. Guasch emphasized that companies need to take this seriously by improving identity controls, monitoring closely, managing token use, and overseeing AI-related risks within their networks.
Looking ahead, Marguinaud advises organizations to focus on understanding their critical dependencies, minimizing how far damage can spread, strengthening identity security, and regularly testing their ability to recover from attacks. He believes the key theme for 2026 will be bouncing back quickly rather than trying to stop every attack before it happens.
Artificial intelligence adds another layer to the challenge. While AI can speed up hacking efforts, experts caution it isn’t creating completely new types of risks. Guasch explained that AI mostly helps attackers do familiar damage faster or at a larger scale. Because of this, Tokio Marine HCC is updating its risk models but doesn’t see the need for a major overhaul just because of AI. Their focus remains on access control, resilience, and managing dependencies.
As more systems share the same providers and software, there’s a bigger chance of wide-reaching cyber events that affect multiple sectors at once. Experts warn this concentration risk could lead to huge losses and strain the cyber insurance market’s ability to cope. Marguinaud and Guasch say successful defense comes down to how well organizations understand their risks and have strong recovery plans.
To handle these challenges, insurers are investing in better modeling tools, stress tests, and spreading risk across different industries and regions. Tokio Marine HCC also uses outside models to verify their assumptions and make sure they’re not underestimating possible losses.
The insurance industry knows it will need strict discipline to face systemic and AI-driven cyber threats. Sustainable underwriting, sensible pricing, and careful selection of risks are all vital for keeping the market stable and ready for whatever comes next.