Survey shows only 16% feel confident in their insurance position heading into 2027
Senior leaders at mid-sized North American firms are worrying less about cybersecurity and artificial intelligence (AI) than a year ago, while their confidence in managing most risks has fallen, according to a HUB International survey.
The share ranking cybersecurity among their top threats to profitability fell from 60% to 45%, while AI dropped from 60% to 38%. Concern about regulatory and legal challenges fell from 50% to 31%, and natural disasters and climate risk from 47% to 29%.
Confidence in mitigating risks declined in eight of the nine categories measured. Confidence in managing cybersecurity held steady at just over 57%, while confidence in managing AI slipped 2 percentage points.
The 2026 Middle Market Profitability & Resiliency Report from Hub International Holdings, Inc. describes the pattern as risk fatigue, in which repeated exposure to warnings and high-stress moments leaves organizations less confident and responsive over time.
“Business leaders are doing more than ever to manage risk, but our research shows that those efforts haven’t translated into clarity for which threat matters most or what their insurance coverage actually protects,” said Marc Cohen, president and CEO of HUB.
A ranking with no runaway leader
Cybersecurity still placed first at 45%, followed by operational costs at 43%, AI adoption at 38%, macroeconomic pressures at 37%, and regulatory and geopolitical challenges at 31% each. Concern rose in only two categories, macroeconomic pressures, from 34% to 37%, and rising insurance costs, from 20% to 21%.
Confidence in mitigating macroeconomic pressures fell from 55% to 49%, the largest drop of any category.
Other industry research points to a comparable shift in Canada. The 2026 Allianz Risk Barometer found cyber incidents fell to seventh place among Canadian business risks at 20%, down from 35%, even while cyber held the top spot globally for a fifth year.
Benefits data under pressure
The lower ranking contrasts with recent benefits-sector incidents. In April 2026, Canada Life disclosed unauthorized access through an employee account that exposed personal information of up to 70,000 people, most of them employees covered under one large corporate group benefits and retirement plan.
Canadian pension regulators expect cyber risk to sit inside plan governance. CAPSA Guideline No. 10, published in September 2024, sets out a framework for identifying, evaluating, managing and monitoring material plan risks, including cybersecurity and third-party risk, and OSFI expects federally regulated plan administrators to follow it.
In Ontario, FSRA’s IT risk management guidance, effective April 1, 2024, includes a process for regulated entities, including pension plan administrators, to notify the regulator of an IT risk incident.
Coverage trailing the exposure
Only 16% of organizations report being confident in their current insurance position, yet fewer are exploring new ways to use insurance than a year ago. Some 75% of leaders do not fully understand what their current policies cover, and 25% report full understanding.
Interest in increasing coverage for AI adoption and risk readiness fell 11 percentage points, from 46% to 35%. Cyber remains the top coverage priority at 43%, down from 46%.
In the US, a Plan Sponsor Council of America poll published in July 2026 found 40% of responding retirement plan sponsors have a cybersecurity rider on their fiduciary liability policy, 37% hold a separate cyber policy and 15% have no policy covering cyber breaches.
About 30% of HUB respondents are not considering insurance for rising costs, macroeconomic pressures and geopolitical challenges because they cannot find suitable options.
Frameworks in place, accountability concentrated
Formal enterprise risk management (ERM) programs are in place at 75% of organizations, up 14 percentage points, yet just 30% of leaders say past, current and future risks influence decision-making. While 72% align risk mitigation with compliance requirements, 37% describe a mature, holistic approach with open information sharing and cross-team collaboration.
Only 17% say every employee shares accountability for managing risk. In HUB’s previous report, covered in December 2025, 15% agreed that risk management was a shared responsibility across employees.
HUB’s maturity scoring shows the basic tier falling from 30% to 24% and the advanced tier rising from 5% to 9%, with 67% at the intermediate stage, up from 65%.
HUB, an insurance broker and financial services firm, found 65% of organizations trust their insurance partner with day-to-day service, 56% for strategic advice and 50% for proactive identification of coverage gaps or emerging risks. Some 48% engage advisors quarterly or more often.
The online, 18-question survey captured senior business leaders in North America across agribusiness, construction, education, financial institutions, hospitality, nonprofit and real estate. More than half represented organizations with 500 to fewer than 2,000 employees, and most had annual revenue between $150 million and less than $1 billion.
