How Vulnerable Are SMEs to Deepfake Cyberattacks? Are Insurance Policies Providing Coverage?
Cyberattacks powered by artificial intelligence (AI) are creating new challenges for small and medium-sized enterprises (SMEs), especially regarding insurance coverage. Brokers have a key role in helping SMEs defend against these evolving threats with practical risk management advice.
Many cyber insurance policies struggle to keep up with AI-driven attacks like deepfake CEO impersonations. According to Mitch Riley-Meijer, a cyber risk and incident response manager, while some comprehensive policies may offer coverage, many lack explicit terms addressing social engineering or deepfake threats. This leaves SMEs exposed as attackers use increasingly sophisticated AI-generated impersonations that are harder to detect.
Skye Theodorou, CEO of the insurtech company upcover, highlights that cybercrime was already a major issue for SME insurers. Now, AI has intensified the problem, enabling fraudsters to create deepfake videos, automate calls using bots, and refine spoofing techniques to gain unauthorized access or sensitive information.
Claims reflecting AI-related cyberattacks are on the rise. James Crowther, head of emerging risks at Agile Underwriting Australia, confirms that the trend of AI-driven cyber claims involving SMEs is expected to increase. Crowther and Riley-Meijer recently shared insights with brokers on the latest cyber threats targeting SMEs.
Case Study: Arup’s Deepfake Scam
The accessibility of AI tools allows even less experienced criminals to launch convincing and scalable attacks. These tools can enhance traditional cybercrime tactics like spear phishing by making them faster and more targeted. AI can generate personalized phishing emails or clone voices from short clips, enabling attackers to impersonate trusted individuals convincingly.
A high-profile example involves Arup, the British design and engineering firm linked to the Sydney Opera House. Last year, a Hong Kong employee was tricked into transferring US$25 million to fraudsters during a deepfake scam. Despite initial suspicion about the secretive transaction request, the victim was persuaded by a video call where other participants appeared and sounded like familiar colleagues.
Rob Greig, Arup’s chief information officer, emphasizes that such attacks are more frequent than many realize. He states that organizations like his face these attacks weekly and stresses the need for greater openness and transparency about these threats.
How Brokers Can Help SMEs Prevent Deepfake Cyberattacks
Brokers can play a critical role in managing emerging AI-driven cyber risks for their SME clients. Mitch Riley-Meijer suggests three key steps brokers should take:
- Policy Review: Verify that cyber insurance policies explicitly cover AI-driven threats, including deepfakes and social engineering attacks.
- Client Education: Keep clients updated on evolving threats and stress the importance of proactive cyber hygiene and adequate insurance.
- Risk Assessment: Encourage implementation of strong internal controls such as multi-factor authentication, voice verification protocols, and employee training to identify and respond to AI-enabled attacks.
Challenges for Insurers
Designing and pricing cyber insurance remains difficult due to the fast-changing cyber risk environment. Traditional actuarial methods relying on historical data are often insufficient. The unpredictability of new threats like AI-generated deepfakes and synthetic identity fraud complicates underwriting and premium calculations.
Some insurers have begun offering AI-specific endorsements, but significant coverage gaps still exist. The insurance industry must adapt quickly to keep policies relevant, comprehensive, and accessible as these threats evolve.
For professionals interested in expanding their knowledge on AI and its implications in various industries, exploring educational resources such as Complete AI Training can provide valuable insights and practical skills.
Your membership also unlocks:
