Moody's has named cyber risk one of the most significant corporate exposures on its Insurance Emerging Risk Radar, framing it as a threat with two distinct dimensions for insurers: the risk embedded in underwriting cyber insurance itself, and the operational risk of protecting insurers' own systems. The radar's assessment is direct about where this is headed. Heightened geopolitical tensions are increasing the frequency and complexity of cyberattacks, and AI is enhancing capabilities on both sides of the fight, for attackers and defenders alike.
Moody's has built out this thesis across several reports this year. Its 2026 Cyber Risk Outlook found AI has so far amplified existing attack techniques - deepfakes, adaptive malware, phishing - rather than introducing entirely new categories of threat, but warned the consequences are still significant. Attackers can now scan networks for vulnerabilities at machine speed, often faster than defenders can patch them, compressing what used to be a weeks-long attack timeline into hours.
Moody's does not expect fully autonomous, self-adapting malware for another three to five years, but has flagged "early indications of autonomous attacks" as already emerging. On the defensive side, the firm was equally direct that AI security tools are not a solution on their own. "AI-powered defense solutions are not a silver bullet; they introduce new risks and require strong governance," Moody's said, pointing to unpredictable behaviour and error accumulation as risks in their own right.
That warning lands against a global cyber insurance market that remains small relative to the exposure it is meant to cover. Munich Re's Cyber Insurance Risks and Trends report put global premiums at $15.3 billion in 2024, with North America accounting for 69% of that total, and projects the market will more than double to over $30 billion by 2030.
Despite that growth, Munich Re noted cyber insurance still represents less than 1% of total global property and casualty premiums, a protection gap that puts Moody's warning about AI-accelerated attacks in sharper context: the market is expanding, but nowhere near fast enough to close the exposure gap AI is actively widening.
That gap is showing up in claims data too. Allianz Commercial's cyber risk research found ransomware still drives roughly 60% of large cyber claims by value, even as overall claim severity has eased somewhat in recent periods, and Beazley's Risk & Resilience 2025 report found 29% of executives now name cyber as their top overall business risk, the first increase in that ranking since 2021.
Beyond dedicated cyber policies, Moody's emerging risk framing also captures a secondary exposure worth flagging across the broader market: property, casualty, and business interruption policies that were not explicitly designed with cyber triggers in mind can still face silent cyber exposure when a covered peril originates from a digital attack rather than a physical cause.
As AI compresses attack timelines and increases the frequency of incidents targeting operational technology and critical infrastructure, that silent exposure becomes harder to model and price accurately across an insurer's broader book, not just its dedicated cyber portfolio.
WTW's own 2026 outlook flagged the same underlying tension driving this: an abundance of insurer competition chasing cyber premiums as one of the industry's biggest growth opportunities, even as losses continue to escalate and threat tactics keep evolving.
Several major reinsurers and brokers have separately raised the same concern Moody's implies: that intense competition for cyber premium growth could tempt insurers to loosen risk controls just as AI is making the underlying threat more dangerous, not less.
Lockton's own market data found average cyber premiums fell around 11% in 2025 even as incident frequency and severity climbed, a discrepancy industry commentary has attributed to intense competition and rapid capacity expansion among underwriters rather than any genuine improvement in the risk itself. That combination - falling prices against rising and more sophisticated threats - is precisely the setup that has preceded market corrections in other insurance cycles.
For insurers and brokers, Moody's radar points to a clear practical takeaway: policy wording needs to keep pace with how AI is actually being used in attacks, not just cyberattacks in the abstract, and underwriting discipline, not premium growth alone, will likely determine which carriers are still well-positioned once the current pricing cycle turns.
