Ninety-four per cent (94%) of Australian organisations surveyed hold cyber insurance, according to MinterEllison's 11th annual Perspectives on Cyber Risk report published in August 2026. Two figures reframe that for brokers. First, cyber gross written premium has never exceeded $73 million in a single quarter in the APRA dataset - meaning that despite high uptake among larger organisations, the market remains thin relative to the scale of the risk. Second, Gallagher's 2026 AI Adoption and Risk Benchmarking Survey found that one in five insurance professionals surveyed said a client experienced loss or claims due to AI-related risks in the past year, with just over half of those fully covered by insurance. Most clients are insured. A material portion are not fully covered. The gap between the two is widening as AI reshapes the threat environment faster than policy language is following.
The case for reviewing client programmes is now grounded in court outcomes. On February 9, 2026, the Federal Court ordered FIIG Securities to pay $2.5 million in civil penalties following ASIC's action for cybersecurity failures - Australian Securities and Investments Commission v FIIG Securities Limited [2026] FCA 92. ASIC identified cyberattacks, data breaches, and inadequate operational resilience within its 2026 key issues outlook, and expects AFS licensees to prioritise and invest in systems that protect customers and maintain integrity in the financial system. ASIC also commenced proceedings against Fortnum Private Wealth in July 2025 over alleged failures to adequately manage cybersecurity risks, following its earlier action against RI Advice.
The insurance implications are direct. Cyber incidents increasingly generate complex considerations across cyber, directors and officers, statutory liability, and commercial crime policies. Policy wording varies significantly between insurers. The way key terms such as "computer system" are defined may determine whether incidents involving cloud platforms or third-party vendors are covered. Some policies expressly include third-party networks within the definition of the insured's computer system; others do not, and coverage gaps arise where policies do not clearly extend to outsourced or off-premises infrastructure. ASIC has stated that cyber risk management must be "demonstrably effective and proportionate to the size, nature and complexity of a business." Where it is not, the insurance programme becomes the next line of scrutiny - both from the regulator and from affected clients seeking recovery.
The coverage gap the ASIC enforcement sequence exposes has deepened with AI adoption. Until recently it was rare for insurance policies to contain any reference to AI. Where AI tools or systems caused loss, cover often arose because the loss fell within traditional insuring clauses and was not expressly excluded - mirroring the early days of cyber risk, where losses were unintentionally picked up under legacy wording. That position is now changing. AI exclusions are starting to appear in certain policy wordings, and the breadth of those exclusions varies widely. Lander & Rogers warned in April 2026 that insurers are moving quickly to control exposure, and insureds who do not proactively review their liability programmes may discover the gap only after a claim arises.
The market response is uneven but directional. CFC announced in June 2026 that it was embedding affirmative AI coverage across seven key policies - including technology errors and omissions, professional liability, intellectual property, management liability, media, and cyber proactive response. The intent was to provide clarity about how AI-related exposures are treated rather than relying on implied or silent coverage. CFC chief underwriting officer Nick Line said: "Rather than relying on implied or silent coverage, we see value in being explicit about how AI is treated." Other insurers are taking different approaches, with affirmative solutions, endorsements, and bespoke add-ons emerging alongside AI exclusions in some cases. For brokers, the divergence makes wording comparison at renewal more consequential than at any previous point in the development of the cyber class.
The OAIC received 1,205 data breach notifications in 2025 - the highest annual total since mandatory reporting commenced in 2018, an 8% increase over 2024, with 716 attributable to malicious or criminal activity. The ASD's Annual Cyber Threat Report 2024-25 found the average cybercrime cost for large Australian businesses rose to $202,700 per incident - a 219% year-on-year increase.
Despite this, the Australian cyber class has recorded positive insurance service results for three consecutive quarters: $17 million in the September 2025 quarter, $10 million in December 2025, and $10 million in March 2026, according to APRA data. A consistently profitable class in a demonstrably growing risk environment is unusual - and it is precisely the kind of distribution opportunity brokers who understand the policy nuances are positioned to capture before AI-related claims begin testing the profitability. APRA observed in its April 30, 2026, letter to all regulated entities that AI adoption is materially changing the cyber threat landscape and that governance, risk management, and operational practices are failing to keep pace with the scale, speed, and complexity of that change.
The MinterEllison report puts three questions directly to brokers placing cyber cover for Australian clients. Does the policy respond when an autonomous AI agent - rather than a human - executes the intrusion? Do war or state-actor exclusions apply differently to frontier-model-enabled attacks? Does cover extend to incidents originating in a third-party AI platform the insured uses but does not control?
Those questions are not hypothetical. The February 2026 youX incident - where one vendor compromise generated notification obligations across approximately 800 broker firms and more than 90 lenders - illustrates the cascading supply chain exposure that most policy structures have not yet been tested against at scale. Clients should review policy terms, coverage scope, exclusions, and alignment with regulatory obligations ahead of renewal. The renewal conversation starts before a loss, not after one - and for cyber, the gap between buying a policy and having one that responds to the actual threat is currently wider than most clients realise.
