About us

Diversity and Inclusion

Newsroom

Claims

Contact us

Ransomware still dominates most cyber risk conversations, and for good reason.&nbsp; But artificial intelligence, deepfakes and increasingly connected businesses are reshaping the threat landscape in Canada, and broker advice needs to keep pace.&nbsp; &ldquo;What we&rsquo;re starting to see, and what we expect to keep seeing, are AI-enabled attacks, more convincing social engineering and growing supply chain exposure,&rdquo; says Leanne Taylor, Senior Manager, Tech &amp; Cyber at Sovereign Insurance.&nbsp; Attacks are getting faster and more targeted, and increasingly aimed at the people and partners businesses rely on, rather than their technology alone.&nbsp; AI changes the rules&nbsp; Cybercrime activities that used to take real time and technical skill can now happen in seconds, at a scale never seen before, Taylor explains. &nbsp; Threat actors are personalizing phishing messages and automating reconnaissance, shrinking the gap between finding a weakness and exploiting it.&nbsp; The same AI tools creating new defensive capabilities are also creating new exposure inside the businesses adopting them. &nbsp; Taylor names three specific exposures commercial clients should watch: prompt injection, where a threat actor overrides an AI agent&rsquo;s instructions; data poisoning, where manipulated data corrupts an AI system&rsquo;s training; and shadow AI, where employees run unapproved tools and feed them sensitive information.&nbsp; &ldquo;Employees using AI tools outside of what&rsquo;s approved by their company, and putting sensitive information into those tools, is a huge risk,&rdquo; she adds.&nbsp; People and partners are targets &nbsp; Cyber attackers are increasingly targeting trust rather than defences, says Taylor.&nbsp; Voice cloning and deepfake video make it possible to convincingly impersonate an executive, and a fraudulent request can now arrive by email or video, using channels employees have been trained for years to rely on. &nbsp; &ldquo;People are targeted because they have access and the trust of others around them,&rdquo; Taylor says. &ldquo;It&rsquo;s often easier to persuade someone to authorize a payment than it is to defeat a well-configured technical control.&rdquo;&nbsp; Cybersecurity training helps, but simple verification habits often stave off such attacks. &ldquo;If a request is unusual, urgent or sensitive, pause before acting,&rdquo; she says. &ldquo;Verify through an independent, trusted method, and only then proceed.&rdquo;&nbsp; Outside vendors are often an overlooked exposure that can compromise a client&rsquo;s supply chain, Taylor adds. &nbsp; &ldquo;A client can have strong internal controls and still experience a major interruption because a critical provider is unavailable or compromised,&rdquo; she says.&nbsp; When several parts of a business depend on the same cloud platform or software provider, one event can disrupt all of them at once, with effects that reach far beyond the company that was targeted, including lost revenue and reputational damage.&nbsp; &ldquo;Organizations need to move from a prevention-only mindset to a resilience-focused approach,&rdquo; Taylor says. Multi-factor authentication and regular patching remain baseline protections, paired with governance and an incident response plan. &nbsp; &ldquo;A plan should not simply exist in a document,&rdquo; she says. &ldquo;The organization should test it and make sure decision makers understand their roles.&rdquo; &nbsp; Brokers can also ask clients whether their backups are isolated and tested, and if there&rsquo;s a workaround if a critical vendor goes down, she adds. The broker opportunity&nbsp; Looking ahead, next-gen cyber threats give brokers the opportunity to move the conversation from policy placement to business resilience, says Taylor.&nbsp; Instead of starting with limits and deductibles, brokers can ask what systems are essential to a client&rsquo;s operations and how they verify payment changes. Those questions translate technical exposure into business consequences clients already understand, like delayed production or interrupted service.&nbsp; &ldquo;Brokers don&rsquo;t need to become cybersecurity engineers,&rdquo; Taylor says. &ldquo;Their job is connecting a client&rsquo;s operational exposure to their risk management and insurance strategy.&rdquo;&nbsp; Supply chain dependency deserves a direct look at coverage. Sovereign advises brokers to check whether a policy addresses contingent business interruption and whether key providers fall within its definitions.&nbsp; That means treating the coverage conversation as continuous, instead of a renewal exercise. &nbsp; &ldquo;Cyber risk changes the moment a client adopts a new platform or acquires a new business,&rdquo; she says. &ldquo;Regular conversations let the policy evolve with the business.&rdquo;&nbsp; While technology will keep changing, Taylor says organizations that understand their dependencies and prepare for recovery before an incident happens will be best positioned to respond when it does. That&rsquo;s exactly where brokers&rsquo; trusted advisor role begins.&nbsp;

The Next Generation of Cyber Risk: Is Your Advice Keeping Up?

Managing Risk

Hot Topics

Opportunity and uncertainty have a strange habit of arriving together. Because while commercial rates have fallen by 7 percent in Q2 and capacity is still abundant, beneath the surface the risks threatening businesses are becoming more difficult to manage. From record-breaking climate losses to increasingly sophisticated cyber threats, the gap between a softening price cycle and a hardening risk reality is deepening. That widening space between price and protection is the resilience gap. It&rsquo;s within that gap that Sovereign Insurance has defined its niche. As Colette Taylor, chief operating officer at Sovereign Insurance, explains, a soft market isn&rsquo;t an excuse to simply cut prices in pursuit of growth. Instead, it&rsquo;s an opportunity to demonstrate the value of underwriting expertise and disciplined risk selection. &ldquo;While property rates have declined for nine consecutive quarters, underwriting discipline and risk selection have become more important to us, not less,&rdquo; says Taylor. &ldquo;It&rsquo;s about understanding the quality of the book, being clear on the risks that you want to write and when you need to walk away.&rdquo; &ldquo;At Sovereign, our underwriting expertise makes all the difference,&rdquo; Taylor notes. &ldquo;That&rsquo;s what gives us the confidence to seek out opportunities in our target areas and to be competitive with them. We understand that sustainable growth comes from the quality of the business that you&rsquo;re writing, not simply just the volume of business that you can put into your portfolio.&rdquo; It&rsquo;s a strategy that&rsquo;s been honed over recent years, with Sovereign focusing on deepening partner relationships and maintaining underwriting standards while its people remained highly engaged throughout periods of real change.&nbsp; &ldquo;We have proven the individual pieces,&rdquo; says Taylor. &ldquo;The next four years are about connecting them so they compound. Under-writing expertise, partner relationships, and how we operate should each make the others stronger.&rdquo; For Taylor and her team, success depends on maintaining those relationships and growing from there, while leaning into Sovereign&rsquo;s homegrown roots.&nbsp; &ldquo;Sovereign is Canadian owned and operated,&rdquo; she says, &ldquo;and I think that&rsquo;s more important than ever right now. That means all of our underwriting authority, all our decision-making, is done here in Canada. Having that so close to our partners allows us to be nimble. It means we can make decisions fast, empowering the people within Sovereign to respond to our partners about opportunities quickly.&rdquo; Sovereign is also deliberately focused, which is a choice rather than a limitation. Being part of the Co-operators Group gives it the best of both worlds: the financial strength and values of Co-operators combined with its own underwriting authority, appetite, and the specialist relationships that define Sovereign itself. That focus is what allows Taylor and her team to put the right resources and expertise against the right relationships, which leads to better outcomes for everyone involved. &ldquo;It creates more consistency in how we&rsquo;re able to show up,&rdquo; Taylor says. &ldquo;Because when we&rsquo;re making decisions, we&rsquo;re making them with great confidence &minus; which our partners can feel.&rdquo; Sovereign reaches the market one way: through brokers and MGAs. There is no Sovereign direct channel, no second route to the same client. When a partner grows, Sovereign grows. And as the broker landscape consolidates, that commitment carries even greater weight.&nbsp; The 10 largest broker groups now control roughly one-third of national broker-distributed premium, up from about 28 percent in 2022 &minus; meaning status now has to be earned with fewer partners who have real leverage. For Taylor, this is further confirmation that Sovereign is on the right path.&nbsp; &ldquo;We&rsquo;re very intentional about the partners we work with,&rdquo; she says. &ldquo;It allows us to dedicate our expertise and resources to those relationships to create meaningful opportunities along the way. For us, it&rsquo;s about being easy to do business with. You have to be competitive from a pricing standpoint, have a market-leading proposition, and people have to enjoy dealing with you too.&rdquo; It&rsquo;s that level of care coupled with industry expertise that Taylor believes will define Sovereign&rsquo;s success in the years to come. As for growth opportunities, she tells Insurance Business that they focus on &ldquo;going deeper before going wider.&rdquo; &ldquo;There&rsquo;s significant opportunity in our core mid-market business,&rdquo; she notes, &ldquo;and headroom to grow in the segments where we have strong underwriting expertise, established capabilities, and a clear understanding of the risks we want to write.&rdquo;
Energy and natural resources is another area where Sovereign is deliberately building, as is cyber. Worryingly, Canadian organizations are paying a record $7.11 million on average for a data breach, according to IBM&rsquo;s Cost of a Data Breach Report 2026 &ndash; and yet just 22 percent of respondents carry any form of cyber insurance, and only 12 percent hold a dedicated stand-alone policy, according to IBC. For Taylor, this isn&rsquo;t a demand problem - it&rsquo;s a design fault. &ldquo;As an industry, we&rsquo;ve built cyber products for specialists to sell to other specialists,&rdquo; says Taylor, &ldquo;which works well when brokers have deep cyber expertise and are then able to sell that product on. However, it makes it much harder to navigate for brokers who don&rsquo;t. Brokers need the confidence to speak the language. We are building cyber so that a generalist broker can sell it with confidence. That is how the protection gap actually closes.&rdquo;
Aside from cyber, Sovereign is also looking at AI and its impact on underwriting, claims, and risk identification.&nbsp; &ldquo;AI will help our underwriters analyze information more efficiently,&rdquo; Taylor says, &ldquo;meaning they can focus on the risks that require deeper judgment &minus; because decisions that need empathy will always require the human touch. The opportunity here goes beyond simple automation; it&rsquo;s to use technology to give our people more time to focus on the areas where they add the most value. The test is whether our partners feel it: faster answers, clearer decisions, and more underwriter time on the risks that need judgment.&rdquo; And in a market where opportunity and uncertainty are increasingly going hand in hand, that human-led trust may prove to be Sovereign&rsquo;s most valuable differentiator of all.&nbsp; For Taylor, that is the point of the strategy: to make resilience an advantage Canadian businesses can buy, not just an outcome they hope for. &ldquo;We&rsquo;re not trying to win a headline this year,&rdquo; says Taylor. &ldquo;We&rsquo;re trying to be the insurer the industry looks to, and the one Canadian businesses trust with the risks that matter most to their future.&rdquo;

The insurer building resilience while the market cuts rate

The insurer building resilience while the market cuts rates

Cyberattackers in Canada are getting more sophisticated. They&rsquo;re exploiting people and trusted business relationships as much as the technology itself.&nbsp; &ldquo;Cyber is no longer an IT issue. It has become an operational and business resilience issue affecting organizations of every size and industry,&rdquo; says Leanne Taylor, Senior Manager, Tech &amp; Cyber, at Sovereign Insurance.&nbsp; Understanding how these threats are evolving can help brokers spot where clients remain vulnerable and connect coverage to broader cyber preparedness.&nbsp; &nbsp; Trust under attack&nbsp; While ransomware and business email compromise (BEC) remain significant concerns, two developments are emerging as top threats facing Canadian businesses: AI-enabled social engineering and a growing cybercrime-as-a-service economy.&nbsp; &ldquo;AI is making existing attacks faster, cheaper, more scalable, and harder to detect,&rdquo; says Taylor.&nbsp; AI now enables criminals to produce personalized, polished phishing messages within seconds, she adds, meaning typos and awkward phrasing are no longer reliable warning signs. Voice cloning and synthetic video can make a request look as if it&rsquo;s from a trusted executive.&nbsp; &ldquo;AI is also automating reconnaissance for ransomware groups, while cybercrime-as-a-service puts ready-made tools, phishing kits, and access credentials within reach of less-skilled attackers,&rdquo; she says. &nbsp; Canadian organizations&rsquo; heavy reliance on cloud providers, managed service providers, and other vendors also means a single weak link can give attackers a trusted way in.&nbsp; &ldquo;AI is pushing security leaders past questioning whether they have the right technology toward considering who and what they can trust,&rdquo; says Taylor. &nbsp; With the old warning signs gone, verification procedures, multifactor authentication, staff training, and incident response capabilities have become essential.&nbsp; &nbsp; Disruption drives losses&nbsp; The most common cyber losses Sovereign sees continue to involve ransomware, business interruption, social engineering, and privacy breaches.&nbsp; &ldquo;Cyber resilience is no longer about preventing every attack. It&rsquo;s about minimizing the disruption that follows and recovering quickly,&rdquo; she says.&nbsp; The most severe losses are usually driven by the operational disruption that follows an attack: lost revenue, interrupted service, reputational damage, forensics costs, legal expenses, and regulatory obligations.&nbsp; Social engineering and BEC are especially costly because they target human behaviour. &ldquo;A convincing payment request or compromised vendor account can produce a major loss even at organizations with strong technical controls,&rdquo; says Taylor.&nbsp; Claims frequently expose the same gaps: limited employee awareness, weak incident response planning, overreliance on third parties, and holes in identity and access management. &nbsp; &ldquo;There&rsquo;s a long-standing idea that cyber risk affects only certain industries,&rdquo; she says. &ldquo;But if you&rsquo;re connected to the internet, you&rsquo;re exposed.&rdquo;&nbsp; Exposure still differs by sector, she explains. Manufacturers face production and supply chain disruption. Healthcare organizations hold sensitive patient data alongside essential services that can&rsquo;t go down. Municipalities often run on legacy technology, making them attractive ransomware targets. Professional service firms hold valuable client information that draws BEC and data theft. Retailers face exposure through payment systems and customer data as e-commerce grows. And construction firms depend on connected project platforms and a web of suppliers and contractors.&nbsp; &ldquo;The type of cyber event may differ between sectors, but the potential for operational disruption is universal,&rdquo; says Taylor.&nbsp; &nbsp; A maturing market&nbsp; The Canadian cyber insurance market has matured considerably following earlier periods of rapid growth, significant ransomware losses, and tighter underwriting conditions. Today&rsquo;s market is more stable, Taylor says, built on stronger underwriting, improved risk selection, enhanced cyber controls, and greater client awareness.&nbsp; Due to rising regulatory expectations, boards increasingly recognize that a cyber incident can trigger regulatory, legal, financial, and reputational consequences, complicated by privacy and breach rules beyond Canada&rsquo;s borders. &nbsp; &ldquo;That&rsquo;s pushing cybersecurity into board-level conversations and changing how clients buy insurance,&rdquo; says Taylor. &ldquo;They want to know what their policies cover and whether they match their risk profiles, and they&rsquo;re pressing insurers on how incident response works when a claim comes in.&rdquo;&nbsp; Insurers are also placing more emphasis on cyber hygiene and security controls, and organizations with stronger governance are generally better positioned for favourable terms.&nbsp; This creates an opportunity for brokers to move beyond policy placement, toward helping clients examine identity controls, employee awareness, incident response planning, vendor dependencies, business interruption exposures, and potential policy gaps.&nbsp; &ldquo;Cyber insurance is no longer a stand-alone solution. It&rsquo;s one piece of the overall puzzle,&rdquo; says Taylor. &ldquo;The most effective brokers are helping clients bridge the gap between cybersecurity and insurance. They&rsquo;re translating technical risks into business impacts and helping organizations make informed decisions that strengthen resilience.&rdquo;&nbsp; Her advice for brokers is to lean into that education. Insurers are generally willing to share materials and expertise, and brokers who use them are better equipped to guide clients through a claim or toward the coverage that fits the risk. Doing that consistently is what will make a broker a trusted cyber risk advisor.

Curtis Thompson

AVP, Head of MGA Portfolio