Cyber Insurance Market Overview: Emerging AI Risks and Coverage Considerations

Rates, Capacity, and Underwriting Trends 

The Cyber Insurance marketplace remains highly competitive, with abundant capacity and generally stable pricing despite increasingly costly cyberattacks. However, the market may be approaching an inflection point as rising claims costs put pressure on carrier profitability. While broad-based rate increases are not expected, carriers are becoming more selective in how they price and underwrite certain segments and individual risks. 

Healthcare, manufacturing, technology-focused businesses, larger middle-market accounts, and organizations with adverse claims histories are among the risks receiving greater scrutiny. Security controls also remain an important underwriting consideration. While competition continues to support favorable conditions for many insureds, brokers and agents should look beyond premium at renewal, as carriers may also seek changes to retentions, limits, sublimits, or other coverage terms. 

Looking ahead, pricing and underwriting adjustments are likely to remain targeted rather than market-wide, with industry, security controls, claims history, and other individual risk characteristics driving greater differentiation among accounts. 

AI-Driven Exposures

Cyber Crime

Business email compromise, social engineering, funds transfer fraud, and ransomware remain among the most common sources of Cyber Insurance claims. Rather than creating entirely new forms of cybercrime, artificial intelligence (AI) is amplifying many existing threats by making attacks faster, more scalable, and increasingly convincing.  

According to IBM, AI-driven attacks increased 56% in 2026, with deepfake impersonation attacks, AI-enabled malware, and AI-generated phishing campaigns among the most common attack methods. These attacks added an average of $1 million to breach costs, while the average cost of a data breach reached a record $4.99 million. 

As AI makes phishing, social engineering, and other attacks more sophisticated, human verification remains a critical line of defense. Organizations should reinforce employee awareness training and implement verification procedures such as callback protocols, dual approvals, and independent validation of financial transactions. Brokers and agents can support these efforts by helping clients understand evolving attack methods, strengthen verification practices, and maximize the risk management resources available through their Cyber Insurance policies. 

Business Liability

Beyond cyber threats, AI may create liability exposures when organizations rely on AI-generated content, recommendations, or decisions that result in financial harm, regulatory violations, or other unintended consequences. Risks may also arise when businesses give AI-enabled tools access or authority without fully understanding how those systems are being used. 

For example, businesses may face allegations that AI-generated content infringed intellectual property rights, that automated recommendations contributed to financial losses, or that AI-assisted decision-making led to discriminatory outcomes or regulatory violations. AI-generated inaccurate or fabricated information, sometimes referred to as “hallucinations,” may create additional exposure when businesses rely on it for professional services, business decisions, or client-facing communications. 

These exposures do not fit neatly within a single insurance coverage line. Depending on the nature of the allegation and resulting damages, AI-related claims could implicate Professional Liability, Technology E&O, Media Liability, Intellectual Property, Crime, General Liability, Cyber Insurance, or a combination of coverages. 

Carrier approaches to these emerging exposures vary. Some insurers are introducing affirmative AI coverage, while others are adding exclusions, endorsements, or sublimits to existing Cyber Insurance, Professional Liability, Technology E&O, and other liability policies. Specialized AI products are also beginning to emerge, although the market has not coalesced around a single approach. As a result, brokers and agents should carefully review policy language and understand how clients are using AI to identify potential coverage gaps or limitations. 

Privacy Risks

Privacy-related claims and class-action lawsuits are becoming a more significant source of exposure for businesses of all sizes. AI is making it easier to identify and pursue potential privacy violations involving website tracking pixels, cookies, analytics tools, and other data collection technologies. As a result, organizations may face litigation related to common website and marketing practices, even when no data breach or cyberattack has occurred. 

Insurers are also seeing privacy claims involving smaller groups of affected individuals than in the past. Allegations of wrongful or non-consensual data collection may arise under existing privacy statutes being applied to modern technologies, contributing to increased defense costs and potential settlement exposure. 

Brokers and agents can help clients better understand these exposures by encouraging reviews of website tracking technologies, data collection practices, consent mechanisms, and applicable Cyber Insurance coverage. Collaboration among legal, compliance, and IT teams may help identify potential privacy risks and coverage gaps before a claim occurs. 

The SME Opportunity 

While Cyber Insurance adoption is growing, significant coverage gaps remain among small and medium-sized enterprises (SMEs). According to TransUnion, 93% of companies with more than $1 billion in annual revenue carry some form of Cyber coverage, while a 2025 GlobalData survey found that only 16.8% of SMEs have a standalone Cyber Insurance policy. 

Many SMEs continue to underestimate their cyber exposures, believe they are too small to be targeted, or assume other insurance policies will respond to a cyber loss. As one of the most underpenetrated segments of the Cyber Insurance market, SMEs present a significant opportunity for brokers and agents to help clients better understand their exposures and the protection available through standalone Cyber Insurance. 

Beyond placing coverage, brokers and agents can help clients maximize the value of Cyber Insurance by highlighting the risk management services and security resources that often accompany a policy. These resources can be especially valuable for SMEs that may lack dedicated cybersecurity personnel and the resources available to larger organizations. Depending on the carrier, services may include: 

• Threat monitoring and vulnerability notifications 
• Incident response and breach response support 
• Endpoint detection and response (EDR) tools 
• Employee cybersecurity awareness and phishing training 
• Access to cybersecurity and incident response experts 

For SMEs, these services can extend the value of Cyber Insurance beyond financial protection after a loss by providing access to cybersecurity capabilities that may otherwise be difficult or costly to obtain. For brokers and agents, helping clients understand and utilize these resources creates an opportunity to provide value throughout the policy period, not just at placement or renewal. 

Tips for Brokers and Agents 

1. Address the SME coverage gap. Many SMEs continue to underestimate their cyber exposures, believe they are too small to be targeted, or assume other insurance policies will respond to a cyber loss. Help clients understand their exposures and the value of Cyber Insurance.  
2. Understand clients’ AI use and review coverage carefully. Ask how clients are using AI, including its role in professional services, business operations, and decision-making. Review policy language across applicable lines of coverage for AI-related endorsements, exclusions, sublimits, and other limitations that could create coverage gaps.  
3. Promote risk management services. Help clients understand and utilize the risk management resources available through their Cyber Insurance policies, which may include threat monitoring, cybersecurity training, vulnerability management, and incident response support. Encourage clients to engage with these services before a loss occurs.  
4. Discuss privacy exposures early. Encourage clients to review website tracking technologies, data collection practices, consent mechanisms, and applicable insurance coverage. These common business practices may create privacy litigation exposures even without a data breach or cyberattack.  
5. Strengthen human verification practices. As AI makes phishing, deepfakes, and social engineering attacks more convincing, encourage clients to use layered verification procedures such as callback protocols, dual approvals, and independent validation of financial transactions.  

While the Cyber Insurance market remains favorable from a pricing and capacity standpoint, greater underwriting selectivity, evolving AI-related exposures, and increasing privacy risks reinforce the importance of careful coverage review and proactive risk management. Working with the Cyber Insurance experts at Burns & Wilcox can help brokers and agents navigate emerging exposures, identify appropriate coverage solutions, and connect clients with valuable risk management resources. 

Contributors: Andy Wood, Senior Vice President, Practice Group Leader, Professional Liability, Burns & Wilcox, Chicago, IL; Erica Rangel, Associate Managing Director, Broker, Professional Liability, Burns & Wilcox, Chicago, IL; Joey Franiak, Broker, Professional Liability, Burns & Wilcox, San Diego, CA; Michael Spinks, Head of SME Cyber, US, CFC  

This commentary is intended to provide a general overview of the issues contained herein and is not intended, nor should it be construed, to provide legal or regulatory advice or guidance. If you have questions or issues of a specific nature, you should consult with your own risk, legal, and compliance teams.