AI is reshaping cyber risk for Australian small and medium businesses faster than most owners appreciate. In partnership with CFC, Cowbell and Coalition, Insurance Business Australia brought together three cyber underwriters to examine what the technology means for attack volumes, pricing, coverage gaps and claims in 2026. The panel found that AI has stripped away the friction that once slowed cybercriminals, with Coalition's Trent Nihill reporting more vulnerabilities discovered in the preceding few months than in the previous couple of years combined. Yet even as threats accelerate, many Australian SMEs remain uninsured despite ranking cyber as their number one business risk. Premiums have fallen sharply since their peak, with many policies now costing less than a personal car insurance premium, making 2026 a competitive moment for businesses to act. The three underwriters also debated whether standardising policy wording would help brokers compare products, and they closed with a shared warning: resilience is not measured by whether an attack has been avoided so far, but by how effectively a business would respond if one happened tomorrow.
AI has removed the friction that once slowed cybercriminals, and the numbers reflect that shift. Trent Nihill, general manager for Australia at Coalition, said more vulnerabilities had been found in the preceding few months than in the previous couple of years combined. Anthony Wall, head of underwriting Australia at Cowbell, noted that automation has made phishing campaigns both more frequent and more sophisticated, increasing the volume of attempts Australian SMEs face alongside their complexity. The 2026 Thales Data Threat Report reinforces the point, finding that 70% of security professionals now cite the pace of change within AI ecosystems as their single greatest AI-related risk.
Cyber insurers are increasingly embedding automated scanning into their underwriting processes rather than relying on static proposal forms. Cowbell has built scanning tools, dark web monitoring and external attack surface tracking into its process, producing continuously updated risk ratings it calls Cowbell Factors. Anthony Wall said the days of relying on traditional proposal forms are over. CFC's Michael Lewis, Australian cyber development manager, takes a more measured view, arguing that well-built cyber policies were already positioned to absorb AI-enabled losses before the technology had a name, because insurers cover outcomes rather than the tools used to cause them.
Awareness of cyber risk has not translated into purchasing behaviour for many Australian small businesses. Michael Lewis said CFC's own surveys show Australian small businesses rank cyber as their number one business risk, yet many do not act because headline breaches distort what a typical claim looks like. Most losses are phishing emails, invoice manipulation and business email compromise rather than newsworthy incidents, so the real frequency of claims stays hidden. Trent Nihill added that embarrassment plays a role: small business owners often feel a cyber incident means they did something wrong, so quietly resolved, uninsured events never surface and the perceived odds of an attack remain artificially low.
Cyber insurance premiums for Australian SMEs have fallen substantially since the market peaked, and 2026 represents a competitive buying environment. Trent Nihill said many Coalition policies now cost less than a personal car insurance premium. Anthony Wall acknowledged that businesses recognise the exposure but found a real lack of urgency to purchase cover. He argued brokers should reframe the conversation around outcomes and value-added services, noting that those services often outweigh the premium cost, making the net value proposition for SMEs stronger than the sticker price suggests.
Human error remains the dominant driver of cyber losses in Australia. Michael Lewis said 75% of incidents CFC sees stem from actions such as clicking a malicious link, approving a fraudulent payment or sharing credentials. Trent Nihill reported that Coalition still sees clients skipping multi-factor authentication, failing to patch systems and clicking obvious phishing links, with more than half of Coalition's claims originating through business email compromise. That pattern prompted Coalition to launch a free identity threat detection and response tool called Login Security in the month before the panel. Anthony Wall noted that free security awareness training, once standard across the industry, has quietly disappeared and should return.
The panel split on this question. Trent Nihill argued that some standardisation of language would help brokers compare products, citing contingent business interruption as a cover type that carries three or four different names across the market while still meaning different things in the detail. Anthony Wall countered that full standardisation is neither realistic nor desirable, because insurers price and structure cover differently based on how they assess risk and uniformity would slow innovation. He advised brokers to focus scrutiny on computer crime wordings, ensuring cover extends to reverse social engineering, invoice manipulation and loss of third-party funds rather than social engineering fraud alone.
True cyber resilience is measured by response capability, not by the absence of incidents to date. Michael Lewis closed the panel by warning against measuring resilience by whether a business has avoided an attack so far, quoting the Mike Tyson adage that everyone has a plan until they get punched in the face. Trent Nihill noted that while baseline controls like multi-factor authentication are now far more common than they were 15 years ago, many businesses outsourcing IT to managed service providers develop a false sense of who holds responsibility. Anthony Wall added that MSPs often carry thin margins and are not cybersecurity specialists, so businesses cannot outsource their liability along with their IT support.