Cybercrime losses jumped 26% to $20.9 billion in 2025

Annual cybercrime losses reached $20.9 billion in 2025, a 26% increase year-over-year and nearly 400% higher than $4.2 billion in 2020, with cumulative five-year losses above $71.3 billion. The FBI’s IC3 logged over 1 million complaints (about 3,000/day); victims aged 60+ filed 201,000 complaints accounting for ~$7.75 billion (≈37% of losses). Investment-related fraud drove the largest losses at ~$8.65 billion, followed by business email compromise at ~$3.05 billion and tech support scams at >$2.1 billion; cryptocurrency was the primary conduit for investment/tech-support fraud while wire transfers dominated BEC losses.

Analysis

The incremental observation is not that cybercrime exists, but that rising consumer and enterprise losses are reshaping buyer behaviour and budget allocation across the IT stack. CIOs facing opaque, high-impact losses will prioritize identity, EDR/XDR and cloud-native telemetry — a structural shift from capex appliance refreshes toward SaaS subscription spend that accelerates recurring revenue capture for pure-play cloud security vendors over the next 6-24 months.

Second-order winners will include identity platforms, cloud-delivered detection, and companies enabling secure payments rails; losers are legacy on-prem network appliance vendors, underinsured SMEs, and crypto platforms that still rely on weak KYC/fiat off-ramps. Insurers and reinsurers will tighten terms and raise rates, creating a cyclical reinsurance opportunity: rising loss experience pushes pricing, which eventually restores insurer profitability and could compress claims frequency as remediation improves.

Regulatory and enforcement tailwinds are the key catalysts — stepped-up prosecutions and tighter AML/KYC rules could accelerate migration out of unregulated conduits within 3-12 months, creating near-term volatility for crypto-adjacent franchises but improving market structure long-term. The primary downside that could reverse the trend is widescale deployment of generative-AI phishing at scale; if adversaries automate credible social engineering, loss frequency could spike materially faster than vendor product cycles can respond, pressuring both customers and vendor valuations.

Key Decisions for Investors

• Long cloud security leaders (e.g., CRWD, PANW) via a 9–18 month call-spread: buy 12–18 month near-the-money calls and sell higher strikes to fund ~50–60% of cost. Target outsized upside if enterprise subscription mix shifts materially; stop-loss: 25% of capital allocated, catalyst: quarterly subscription ARR beats.
• Pair trade — long identity & zero-trust (OKTA, ZS) / short legacy on-prem networking (select legacy appliance vendors) over 6–12 months: size 1–2% notional of book, aim for asymmetric capture as customers migrate to SaaS identity stacks; unwind on clear signs of stalled migration or recession-driven subscription cuts.
• Short crypto-exchange and custody exposure (COIN) tactically into any relief rallies for 3–9 months: regulatory tightening and shifting payment rails increase friction and fee pressure. Use put-buy spreads to cap downside; target 2:1 reward:risk given binary regulatory outcomes.
• Opportunistic buy of cyber-insurer/reinsurer exposure on confirmed pricing shows (HIM: selective names like HIG/AIG — trade via 12-month covered call structures): objective is to capture re-rate as rates harden and underwriting tightens. Keep position small and pair with tail hedges (index puts) to guard against systemic credit shocks.
• Event-driven M&A play: accumulate leading mid-cap pure-play security software (traded via ETFs or single names) on pullbacks into 6–12 months — expect strategic acquirers (large cloud or SW incumbents) to accelerate tuck-ins. Position with long-dated calls funded by short-term OTM puts to monetize volatility compression if deal activity ramps.