Viewpoint: The Cyber Insurance Industry’s AI Blind Spot

Highly sophisticated AI tools have become integral to modern business operations. According to McKinsey & Company, 88% of organizations report regular AI use in at least one business function. But as businesses adopt AI, the insurance market is still playing catch-up when it contributes to a loss. The broader the adoption of AI, the greater the concern about how malicious actors can weaponize AI against businesses.

In response, many carriers are choosing paths that prioritize their own risk avoidance over the survival of their policyholders. This primarily takes two forms in the market: blanket AI exclusions or complete silence in policy language. Both approaches can undermine the value of cyber insurance for policyholders and create uncertainty across the wider industry.

Retreat leaves policyholders scrambling

In the last few years, nearly 83% of the S&P 500 flagged AI as a material risk and 87% of executives identified AI-related vulnerabilities as the fastest-growing cyber risk. Yet, more than 60 P/C insurance groups filed to adopt AI exclusions. While not all those organizations have implemented them, their filings are a clear signal of the industry’s nervousness toward AI-related risks — even though AI has become a critical business tool and an increasingly important part of the cyber risk landscape.

Depending on the wording, a broad AI exclusion will enable a carrier to challenge or deny a claim simply because an AI tool was involved, even if human error — which a typical cyber insurance policy covers — primarily drove the loss. Even if an insurer clarifies the difference between AI-related security incidents and others, it can still diminish the value of coverage by weakening policyholders’ confidence that their coverage will respond when needed.

In a world where most modern software stacks now integrate AI, an absolute exclusion signals an inability to adapt underwriting and risk models to emerging risks. This incongruence can create coverage gaps, leaving policyholders even more exposed.

Silence begets policyholder confusion

Another tactic employed by insurers is the wait-and-see approach: they remain silent on AI and avoid any mention in their policy wording altogether. This omission doesn’t mean no response to an AI-related exposure, but vague language leaves coverage open to interpretation, which creates headaches for both the insurer and the insured. In the event of a coverage dispute, businesses may face the cost and uncertainty of a legal battle simply to determine whether their insurance safety net exists.

Carriers also take on unintended risk when policy language does not clearly address how AI-related events will be treated. Without clear, affirmative wording, traditional cyber coverage may create uncertainty when an AI model is involved in a security failure or privacy breach, leaving organizations with silent AI exposures.

What the market needs

Much of the insurance market is treating AI as a terrifying, unquantifiable specter when it is really an accelerated evolution of the digital threats the industry has managed for decades. Most AI-driven incidents do not represent entirely new cyber risks; they’re familiar threats powered or enhanced by new technology.

Take business email compromise, for example, where bad actors trick victims into sending money or private data by pretending to be trusted associates. The FBI has been tracking this exposure since the early 2010s. It remains the most common event type, representing 31% of all claims in 2025.

With AI, bad actors can now amass even more information about their targets during the reconnaissance stage to spoof email addresses, hyper-personalize messages, translate their messages into different languages, and boost their success rate. The underlying exposure remains the same, but AI has made these attack methods more effective.

The same logic applies to deepfake-enabled fraud. An employee who sends funds after receiving an AI-generated voice message impersonating a CFO has suffered a familiar funds transfer fraud loss. The delivery mechanism has changed, but the underlying business impact has not.

Leveraging AI for better cyber defense

Conversely, defenders can use AI to defend against attacks and potentially reduce losses. Many managed detection and response (MDR) platforms use automation and AI-assisted triage to evaluate alerts rapidly, helping security teams identify and respond to fast-moving threats.

MDR is a key part of protecting an organization against fast-moving cyber threats. Many leading MDR tools use AI to automatically triage threat detections in milliseconds. MDR is a scalable, cost-effective service that can shield businesses from advanced cyber risks more effectively than traditional risk management tools and offerings.

That reinforces the broader point: AI should be evaluated as part of the overall risk environment, not treated as an automatic reason to exclude coverage. The industry has the data, security tools, and underwriting capabilities needed to accurately price and evaluate cyber risk in the age of AI, so it has no excuse for defaulting to broad exclusions or, worse, silence. Instead, carriers should pursue affirmative policy language that explicitly states how coverage responds to AI-driven threats.

The industry needs cyber policies designed to evolve with the risk landscape and respond to the outcome of the incident, not the technology behind it. Whether an exposure originates with a human or an AI model, the consequences are real, and the cyber insurance market should be able to absorb them.

As new risks arise, it’s crucial for businesses to feel confident that they have a partner who can help them recover from a damaging incident. Anything short of that is a market failure.

Topics InsurTech Data Driven Artificial Intelligence Cyber Market