Confronting Cyber Threats and the Imperative of Evolving Cyber Insurance in the Age of Artificial Intelligence
AI is accelerating both defense and attack. Threat actors now scale phishing, social engineering, and exploit development with machine assistance. As a result, demand for cyber insurance is up, and buyers expect more than an indemnity check.
Carriers are pairing financial coverage with hands-on cybersecurity services. Pricing and terms are tightening and becoming more differentiated as underwriters gain experience with AI-enabled claims and prolonged business interruption events.
What AI Changes for Risk Selection
- High-volume, high-quality social engineering: deepfake voice/video and more convincing email that bypasses basic training.
- Faster exploit cycles: automated recon and exploit kits reduce patch windows and widen exposure.
- Supply chain amplification: compromises of MSPs, auth providers, and widely used software propagate losses across many insureds.
- Data exfiltration at scale: stolen data is packaged, searched, and monetized more efficiently, extending claim tails.
How Policies Are Shifting
- Proactive services bundled in: external attack-surface scans, phishing tests, tabletop exercises, and incident response retainers.
- Testing at underwriting and post-incident: pre-bind control validation and post-breach assessments to reduce repeat events.
- Ransomware terms: higher retentions, coinsurance, and stricter conditions for payment support to curb severity.
- Business interruption clarity: broader "system failure" triggers in some forms, but tighter definitions and waiting periods elsewhere.
- Dependent BI/cloud outages: more attention to named providers, sublimits, and aggregation controls.
- Fraud modules: social engineering and fraudulent instruction often require verified call-backs and dual authorization to trigger coverage.
- Data restoration and "bricking": clearer treatment of data re-creation costs and device replacement after firmware corruption.
- Regulatory exposure: privacy, notifications, fines/penalties where insurable, and media liability remain key sublines.
Pricing, Capacity, and Accumulation
Rates are rising for profiles with weak controls, high dependency on a few vendors, or material OT exposure. Better-controlled risks see more stable pricing, but with tighter sublimits and wording scrutiny.
Carriers are modeling systemic risk more aggressively. War, infrastructure, and widespread vulnerability exclusions are under review to manage catastrophic aggregation.
Controls Underwriters Expect Before Quoting
- Multi-factor authentication for all remote access, admin accounts, and critical apps.
- EDR/XDR on endpoints and servers with 24/7 monitoring and response.
- Immutable, offline, or logically air-gapped backups with routine restore tests.
- Privileged access management, least privilege, and admin credential vaulting.
- Timely patching with defined SLAs for critical vulnerabilities.
- Email security with advanced phishing and attachment/link analysis.
- Network segmentation (especially for OT/ICS) and strict vendor access controls.
- Centralized logging, alerting, and retention sufficient for forensics.
- Documented, tested incident response and business continuity plans.
- Clear AI usage policy: data handling, model access, and third-party tool governance.
Underwriting and Broking: Questions That Move the Needle
- What pre-bind testing will the insurer perform, and will results affect pricing or conditions?
- Which cybersecurity services are bundled, their frequency, and who pays for them?
- How are business interruption losses measured (gross profit vs. gross earnings) and what are the waiting periods?
- What are the sublimits for forensics, data restoration, dependent BI, and cyber extortion?
- Are social engineering and funds transfer fraud covered, and what control warranties apply?
- How do systemic, war, and infrastructure exclusions apply to widespread cloud or software events?
- Is panel vendor usage mandatory, and is there pre-approved flexibility for existing MSSP/legal vendors?
- How are AI-specific scenarios treated (deepfakes, model corruption, automated credential stuffing)?
Claims Lessons We Keep Seeing
- Deepfake-enabled wire fraud: coverage hinges on dual approval and call-back procedures actually followed.
- Third-party compromise: a vendor breach triggers both privacy and business interruption across many insureds, stressing sublimits.
- Cloud outages: triggers and named provider language control payouts; dependency mapping is essential.
Practical Next Steps for Insurance Teams
- Run a 30-60-90 day plan to close control gaps tied to pricing: MFA, EDR/XDR, backups, and admin hardening.
- Map critical dependencies (cloud, auth, payments, MSPs) and align sublimits to actual exposure.
- Tabletop a deepfake and ransomware scenario with finance, legal, IT, and your carrier IR panel.
- Test restores quarterly and document outcomes for underwriting files.
- Review policy language side-by-side: triggers, exclusions, conditions precedent, and coinsurance.
- Quantify downtime costs so waiting periods, limits, and valuation methods reflect reality.
Helpful References
- NIST Cybersecurity Framework for control baselines and governance.
- CISA Stop Ransomware for current TTPs and mitigation guidance.
Upskilling on AI Risk
Your underwriting and claims teams will face more AI-driven scenarios. Building shared literacy shortens underwriting cycles and improves client outcomes.
Explore AI courses by job function to strengthen risk assessment, security control reviews, and claims handling.
Your membership also unlocks:
