In Focus: Can cyber insurance keep up with AI?

WE ASKED: “Can cyber insurance keep up with AI – or are insurers still pricing tomorrow’s risks using yesterday’s data?”

Stefan Daines, broking director, Daines Kapp

Most cyber insurers are not keeping pace with artificial intelligence (AI) and I don’t think they fully can yet. AI and agentic capability is moving so fast that what a business does with it can look materially different from one renewal to the next, let alone across the multi-year view underwriters are used to working with. Pricing built on last year’s claims data is ultimately pricing an outdated risk.

Cyber went through a similar phase itself, over a decade ago. It was a fast-moving risk that insurers had barely any data on, while cover sat largely silent within other policies rather than being affirmatively underwritten.

It took years of accumulated loss data and continuous monitoring before the market built the tools to price it properly. AI liability looks to be at that same early stage now.

Most underwriters still don’t meaningfully ask how a business is using AI. It’s already embedded, to varying degrees, across law firms, professional services and manufacturers alike, yet few insurers are asking the right questions, or even any questions, to understand that exposure.

That gap is where brokers can provide meaningful value. Our job is making sure clients understand their own AI exposure, that policy wording is affirmative rather than silent on it and that cover keeps pace with how a client actually operates today.

Chris Burgess, director of technology, PI and cyber, Markel International

AI is already feeding into underwriting and pricing decisions, but the cyber insurance market has not yet experienced enough material AI-related losses to establish a clear claims trend.

AI is already being used to make cyber attacks more sophisticated, particularly through social engineering. Criminals are using it to make deceptive interactions more convincing, duping employees into handing over credentials.

However, this has largely amplified an existing attack vector, rather than created an entirely new category of cyber risk, and we have not yet seen losses severe enough to drive changes in cyber insurance rates.

This needs to be considered against a backdrop of abundant market capacity and a recent period of relatively benign cyber claims, although the broader claims picture is beginning to deteriorate as cyber criminal activity increases.

The challenge is understanding how emerging AI threats could affect future claims frequency and severity before a meaningful loss history develops. We’re working with catastrophe modelling firms to assess emerging AI exposures and incorporate those findings into our underwriting and pricing decisions.

AI exposure is also feeding into pricing where insurers develop dedicated products or explicitly affirm coverage. Simply inserting broad references to AI into existing policies risks taking on exposures that have not been fully understood. Insurers need to establish where AI changes the underlying risk and price and structure coverage accordingly. 

Jonathan Fong, head of general insurance policy, ABI

AI is transforming nearly all aspects of our daily lives and the businesses around us. This includes insurance, where companies across the industry are considering how AI can be implemented in their organisations while managing insurance risks across the products they provide. 

There are concerns around AI when it comes to cyber insurance specifically. While AI isn’t necessarily changing the types of cyber attack we see, it does have the potential to drastically change the speed and effectiveness of these attacks and lower the bar to entry for cybercriminals.

Cyber insurance, however, has a strong track record of adapting to emerging risks and is well placed to respond to this new phase in the cyber security landscape.

While cyber insurers are exploring the potential impacts of AI, their core approach to underwriting remains the same. Insurers will carefully consider what cyber defences and response capabilities policyholders have in place, the type of data they hold and what industries they operate in.

Good cyber hygiene is essential for businesses to help prevent attacks and recover quickly. Over time, this could evolve to include embedding defensive AI into their operations, enabling them to identify and patch vulnerabilities faster and more often.

Gülsah Dagdelen, head of cyber, international, Tokio Marine HCC

AI is not creating a new category of cyber risk. It is changing the speed, scale and interconnectedness of risks we already understand.

The suggestion that cyber insurers are pricing tomorrow’s risks using yesterday’s data raises a valid challenge for the market. While insurers have become increasingly sophisticated in their assessment of emerging risks, pricing remains influenced by historical loss experience.

The difficulty is that historical performance may not be a reliable indicator of future loss activity in an AI-enabled environment.

AI is helping attackers increase the scale and sophistication of phishing, social engineering and reconnaissance, while lowering the barriers to entry for certain types of cyber crime. At the same time, organisations are embedding AI into critical business processes, creating new operational dependencies and increasing reliance on shared platforms and providers.

These developments have the potential to influence both attritional losses and, over time, the severity and accumulation characteristics of cyber events.

The real underwriting challenge is not predicting the next AI-enabled attack. It is understanding how AI could reshape loss patterns before the claims data fully shows it.

Effective cyber underwriting cannot rely on historical losses alone. It requires a combination of claims experience, threat intelligence, incident response insight and an understanding of how businesses are adopting and governing AI in practice.

While market rates continue to face downward pressure, cyber exposure is evolving rapidly. Sustainable pricing is essential, not only to reflect changing exposures, but to ensure insurers remain resilient and able to support clients through future loss events.

The insurers best positioned for the AI era will be those that continually evolve their view of risk while maintaining disciplined underwriting. The key question is no longer simply how AI might be used in an attack, but how increasingly connected AI ecosystems could reshape loss scenarios across entire portfolios.