Brokers assessing how cyber policies respond to artificial intelligence face a practical problem: establishing whether an attacker used AI may be difficult, making attempts to separate those threats from cyber coverage hard to apply.
That is the argument from Dan Law (pictured), head of cyber practice at HSB, who believes AI-related cyber threats belong within cyber insurance even as the industry debates how explicitly policies should address the technology.
“We have AI coverage built into our primary policy form as it stands today, and we have since we launched that policy form. Be it silent or affirmative, I think it needs to be addressed within a cyber form. I don’t think you can separate out those two things,” Law told Insurance Business.
His position puts policy wording at the center of the placement discussion. A client facing a ransomware incident may know how its systems were compromised without knowing which tools the attacker used to develop or execute the attack.
“It’s not easy to say that AI was foundational to how this threat actor operated. So, in the absence of being able to separate those things out, the coverage needs to live in a cyber policy,” Law said.
When reviewing coverage, brokers therefore need to distinguish an attacker using AI to compromise a client from a claim involving the client’s AI-powered product or business decision. The relevant question is how the wording responds to the particular event, including any exclusions that could affect recovery.
Law sees AI increasing attackers’ ability to exploit weaknesses, including by combining less critical vulnerabilities to gain access to a business. Defenders are also deploying the technology to identify vulnerabilities and improve security. The prospect of more autonomous attacks raises a further concern about the volume of incidents businesses and insurers could face.
“It would increase the ability of the threat actor to go after businesses without their fingers on a keyboard,” Law noted. “Certainly, if you supercharge their capabilities from a threat actor perspective, the scale and volume of incidents that we see could change drastically.”
Read more: OpenAI's rogue AI agents expose a gap in cyber coverage
At HSB, control expectations have remained broadly consistent over the past 18 months. Multifactor authentication is a baseline requirement, while endpoint detection and response, including how those tools are managed, is particularly important in several industries.
Those requirements sit within a competitive cyber insurance market. Law described ample capacity and continued opportunities for buyers, alongside more selective adjustments to pricing and underwriting appetite.
Healthcare, professional services and manufacturing remain challenging classes from a profitability perspective, according to Law. Dependence on software platforms and third-party providers adds complexity to underwriting those businesses.
The pace of product development also creates work for brokers assessing which offering suits a small business or middle-market account.
Law said brokers need to invest time in understanding changing coverage terminology and the security services available through different carriers. Smaller businesses may particularly value those services because they lack internal cybersecurity expertise.
“It’s not as simple as just grabbing something off the shelf,” said Law. “You really have to understand the different markets and where they might fit better.”
Read more: Where cyber conversations go wrong with small businesses
Business interruption deserves particular attention, driving losses in some ransomware incidents, with smaller companies potentially lacking the balance sheet to withstand a prolonged shutdown. But a reduction in ransom payments does not remove the financial damage caused by interrupted operations.
Asked about structuring contingent business interruption coverage, Law added: “I think they need to put a keen focus on the limits, how the coverage works, how it actually functions to pay the claim back to the insured.”
