AI-connected systems are creating a new cyber risk insurers can't ignore
AI is being wired straight into policyholders' systems through the Model Context Protocol (MCP). That's great for speed and automation, but it opens a fresh, correlated cyber exposure many carriers aren't pricing or wording for.
Cyber risk firm KYND flags this as an uncharted risk corridor. As MCP spreads through digital supply chains, a single weak connector can ripple across multiple insureds and entire portfolios.
What MCP does (in plain terms)
MCP lets AI models plug into an organization's tools, data, and apps to take actions in real time. Think of it as the connective layer between models and the rest of the stack.
That layer expands the attack surface. If it's misconfigured or over-permissive, one compromise can fan out across business units-and across clients using the same providers.
How attackers are exploiting it
- Over-broad permissions on MCP servers let malicious prompts pull confidential data or alter records under the guise of normal integration.
- Model manipulation (prompt/response interference) steers agents to run harmful actions that look legitimate to downstream systems.
- Weak infrastructure around MCP-keys, gateways, or agent runners-becomes a backdoor to connected applications and data.
Why this blindsides underwriting
MCP often sits inside vendor stacks, so usage can be invisible in standard questionnaires. Dependencies are shared across industries, which increases correlation risk.
Tooling changes fast. An insured's risk profile can drift within weeks as new MCP-enabled features roll out without fresh security review.
Actions for insurers now
- Continuous portfolio monitoring: Track MCP exposure, public endpoints, agent runners, and leaked keys. Watch for shared connectors across your book.
- Richer risk selection data: Require disclosure of MCP providers, agent capabilities, permission models, audit logs, and kill-switch controls.
- Accumulation control: Map common vendors/hosts. Set aggregate limits, event caps, and correlation assumptions for MCP-related incidents.
- Coverage calibration: Consider sublimits, coinsurance, waiting periods, and warranties for AI-initiated actions, data exfiltration, and integrity losses.
- Incident readiness: Pre-bind playbooks for AI misuse, prompt abuse, and MCP credential leakage. Validate vendor SLAs and notification timelines.
Underwriting questions to add (use this checklist)
- Do you use MCP or similar agent frameworks? Where (production/test), and for which business processes?
- Which MCP providers, gateways, or agent platforms are in scope? Are they self-hosted or managed?
- How are permissions scoped (least privilege, time-bound, per-tool)? Is there human-in-the-loop for high-risk actions?
- What auth is enforced (mTLS, SSO, key rotation, device trust)? Are secrets managed via a vault with automatic rotation?
- Is there full audit logging for model/tool calls, including prompts, outputs, and actions taken?
- How are MCP endpoints segmented from crown-jewel systems? Is there an egress filter and data-loss prevention on agent traffic?
- Is there a kill switch to instantly disable agents or revoke tool access?
- What red-teaming, prompt-safety testing, and change management happens before new tools are exposed to agents?
- Which third-party connectors are enabled by default? How are vendor updates validated before rollout?
Policy wording areas to tighten
- Definitions: Treat AI/agent-initiated actions as "use of a computer system" to avoid gray areas.
- Misuse by authorized tools: Clarify coverage when an authorized agent performs unauthorized or manipulated actions.
- Vendor failure: Address incidents originating in MCP providers or shared gateways, with clear carve-backs.
- Sublimits and triggers: Define sublimits for data integrity loss and "silent" model misuse; align BI triggers to AI-driven outages.
- Warranties/conditions: Key rotation cadence, least-privilege enforcement, logging, and change approvals for new tools.
- Discovery and retro: Spell out discovery for AI misuse detected by logs after the fact; consider waiting periods for agent-driven loss.
Claims guidance to prep now
- Playbooks for prompt-abuse investigations (timeline of prompts, tool invocations, and data touched).
- Forensics that correlate MCP logs, identity logs, and application changes to confirm causation.
- Clear vendor engagement steps when the root cause sits with a shared MCP provider.
Portfolio monitoring ideas
- Request an "AI connector bill of materials" from insureds, similar to an SBOM, listing MCP endpoints, tools, and providers.
- Track high-risk capabilities (write access to prod databases, payments, customer records). Price and limit accordingly.
- Run scenario stress tests: one MCP gateway flaw impacting 50+ insureds; mass credential leakage; model manipulation at scale.
- Use external signal feeds for exposed MCP endpoints, leaked keys, or agent runners left open to the internet.
What KYND is saying
Their view: MCP is spreading through supply chains quietly, and security frameworks are still catching up. Underwriters need to see the shared dependencies that amplify exposure-and act before the risk becomes systemic.
Useful references
Upskilling your teams
If your underwriting and claims teams need a fast primer on AI risk and tooling, consider structured training to close the gap.
Bottom line: MCP links AI to real systems. That creates real loss paths. Get better telemetry, ask sharper questions, and tune wording and limits before small incidents turn into portfolio events.
Your membership also unlocks:
