Are Cyberattacks Outpacing Insurers?
AI Boosts the Scale and Sophistication of Cybercrime
Cyberattacks are evolving at a pace that many insurance providers find difficult to match. The integration of artificial intelligence (AI) into cybercrime is amplifying the frequency and complexity of attacks, especially targeting small and medium-sized enterprises (SMEs).
Skye Theodorou, CEO of insurtech firm upcover, highlights that while cybercrime has long posed challenges to the SMB insurance sector, AI has accelerated this trend significantly. Recent high-profile breaches, like the hacks on major superannuation funds, have intensified the spotlight on cyber insurance. However, these large-scale incidents can overshadow the fact that SMEs—who make up a large portion of many brokers’ clients—are equally attractive targets.
Why SMEs Are Vulnerable Targets
Smaller businesses often present easier opportunities for cybercriminals. Many lack sufficient cybersecurity measures or cyber insurance coverage. According to the Insurance Council of Australia (ICA), fewer than 20% of SMEs hold cyber insurance.
Theodorou points out that AI is making cyber threats more widespread, increasing the pool of at-risk businesses. For insurers, this means a growing number of claims and the need to adjust coverage strategies accordingly.
Rising Premiums Amid a Soft Market
Despite a softening insurance market, premiums for cyber coverage continue to climb for many clients. In 2023, some markets saw premium hikes around 50%, driven largely by the soaring costs of ransomware attacks.
A recent Sophos report found that average ransom payments rose sharply—from US$400,000 in 2023 to US$2 million in 2024. AI contributes to these attacks by generating deepfake videos, automating phone calls via bots, and refining spoofing techniques where attackers impersonate trusted individuals to gain access.
The Impact of Cyberattacks on SMEs
Many SMEs underestimate how devastating a cyberattack can be. Attackers may directly steal funds or deploy ransomware to lock businesses out of their systems, demanding payments they calculate the victim can afford.
Thanks to AI, these incidents are happening more frequently. Theodorou describes this as a “really challenging area of insurance for business,” underscoring the difficulties insurers face in managing this risk.
Industry Perspectives on the Changing Threat Landscape
Niek Dekker, VP of marketing at fintech firm Eftsure, echoes these concerns. He notes that access to generative AI tools is increasing the sophistication and personalization of cyber threats, complicating risk assessment and pricing for insurers.
Dekker expects nearly all businesses to face some form of cyber targeting, highlighting the growing uncertainty in the threat environment.
Tracking the Surge in AI-Driven Attacks
Industry reports show a clear rise in AI-powered cyberattacks. A January report from JumpCloud warns that traditional security measures are becoming ineffective against AI-enabled threats, which include hyper-realistic phishing scams and attacks that exploit software vulnerabilities before patches are available.
The 2025 CrowdStrike Global Threat Report describes adversaries adopting more efficient, focused, and business-like tactics, mirroring the organizations they target. The report highlights attacks from state actors like China, North Korea, and Russia, as well as unidentified groups.
For example, in February 2024, attackers used publicly available footage to create deepfake videos of a company’s CFO and employees, tricking the victim into transferring US$25.6 million.
Third-Party Risks and Supply Chain Vulnerabilities
Cybersecurity firm Sygnia points out an emerging trend: attackers increasingly target supply chains. Exploiting gaps in third-party vendor security and permissions, threat actors can bypass traditional controls and remain undetected longer.
This shift raises complex challenges for insurers, as it increases the potential for widespread disruptions beyond the primary insured entities.
Conclusion
The rapid advancement of AI-driven cyberattacks demands a new approach from insurers. Understanding the evolving tactics, adjusting coverage options, and educating SMEs on the risks are critical steps to keep pace with this growing threat.
For insurance professionals seeking to stay informed on AI’s impact in cyber risk and other insurance sectors, exploring specialized training can provide practical insights and strategies. More information on AI courses tailored for professionals is available at Complete AI Training.