Agentic AI creates new underwriting challenges for cyber insurers

Agentic AI creates new underwriting challenges for cyber insurers

Autonomous AI systems that execute multi-step tasks across enterprise environments with minimal human oversight are introducing exposure pathways that traditional cyber insurance models were not designed to handle.

For years, cyber insurers treated AI as a "force multiplier" that enhanced attackers' existing capabilities. That framing no longer holds. Today's agentic AI systems interact directly with applications and datasets, executing workflows that span entire business processes. This shift changes how threats materialize and how losses unfold.

AI adoption is moving fast. Darktrace found that 78% of organizations already use generative AI in at least one business function, with more than 80% expected to deploy AI models in production by the end of 2026.

A new layer of enterprise risk

CyberCube's H1 2026 threat briefing describes AI agents as a new "privileged execution layer" capable of interacting directly with critical systems. Unlike traditional software, these agents can execute harmful actions while appearing to follow instructions or propagate errors across interconnected systems.

Autonomous failures alone-without external attackers-can trigger outages or data loss. On the offensive side, AI is accelerating attack timelines. Criminals can exploit common vulnerabilities like identity misconfigurations and unpatched systems more quickly, compressing the window between attack and detection.

"AI is compressing the cyberattack lifecycle, enabling impact to occur before detection and containment are effective," according to CyberCube threat intelligence analysis.

Traditional controls fall short

Prevention-focused cybersecurity controls are becoming insufficient. Recovery capability-the ability to restore systems and data quickly-is emerging as a critical factor in determining loss severity.

Underwriters are now examining three specific areas when assessing agentic AI risk:

• Permissions: Are AI agents operating under least-privilege access, or do they have broad, dangerous levels of access?
• Controls: Are there safeguards before agents execute high-impact actions like data deletion or system changes?
• Monitoring: Do organizations have visibility into how agents interact with systems and can they detect abnormal behavior?

Coverage questions are also shifting. Incidents triggered by AI behavior-such as prompt manipulation or unintended data exposure-may blur the line between cyber events and operational failures, creating ambiguity in claims assessment.

Fundamentals still matter

Strong identity security and regular patching remain critical. AI does not introduce entirely new weaknesses; it amplifies existing ones. Organizations that neglect these basics face compounded risk when autonomous systems are involved.

Agentic AI adoption remains uneven and experimental across most enterprises. Widespread catastrophic losses directly tied to AI are unlikely in the near term. But as the technology embeds deeper in critical business operations, insurers face growing concentration risk across their portfolios.

For AI in insurance professionals, understanding how autonomous AI systems function is becoming essential to underwriting decisions and risk assessment.