AI is increasing the speed of cyberattacks, insurance panel says

HARRISBURG: AI has increased the speed of cyberattacks if not tactics, while humans remain the weakest link at many organisations, according to a panel of insurance industry professionals.

NetDiligence convened the panel following the release of its annual Cyber Claims Study, which found that ransomware demands and payments have reached unprecedented levels.

Initial demands have reached as high as US$500 million, with confirmed payments as high as US$90 million.

Large companies were the hardest hit, accounting for over half of total incident costs but just three per cent of the data set.

New threats, including social engineering fraud, have emerged in recent years, forcing cyber insurers to adapt.

"Social engineering fraud and fund transfer fraud, it's a huge thing that's happening in every single industry, and particularly to SMEs, but really to everybody.

"And the challenge is it's actually very easy to underwrite, too, because there's not a lot we can underwrite to.

"All we can do is really look at any type of dual authentication or dual control that you're using when making a payment," Jeff Kulikowski, executive vice president of cyber/professional liability at Westfield Specialty, said.

Humans are often the way in for threat actors, Kulikowski said.

"It's always generated from somebody who may not be responsible for making a payment, gets a call from a vendor.

"They're super excited, they're angry, they're put under pressure, and they skip the dual authentication process to make sure that there's proper fraud protection done or fraud prevention done.

"So the industry typically sublimits this because the exposure has become so big and so difficult to contend with," Kulikowski said.

"Very rarely does an angry vendor make it through two or three levels of a corporation. I dare them to get to the accounts payable person because they know what they're doing. It's always when it goes out of network, and it's just a very difficult coverage to provide," Kulikowski added.

Karla Reffold, chief insights officer at Surefire Cyber, said that SMEs in particular could be more vigilant, since threat actors don't attack businesses by industry or size but, instead, by technological vulnerability.

"I can't believe I still hear it in 2026, organisations saying, 'We're too small to be a target. No one cares about us.' (That understanding) of how much your dollar is worth in other countries that are targeting us is just not there," Reffold said.

AI has also made threat actors more dangerous, primarily in terms of speed.

"The good news is that we are not seeing a huge shift in the tactics. We're not seeing a huge shift in how they gain access to organisations," Reffold said.

Juliet White, head of cyber at Howden US, said that insureds often have less coverage than they expect because they bought their policy years ago and inflation has driven costs up.

For SMEs, cyber insurance is also often less about the coverage than about the protection that comes with it, Westfield Specialty's Kulikowski said.

"This product has become less of an insurance policy and more of a service platform, especially for SMEs, where they don't have the same IT platform, protection platform, scale as a US$30 billion company that has an almost unlimited budget to address these things," Kulikowski said.

Mark Greisiger, president of NetDiligence, which published the report, said that, even in larger organisations, leadership can be the ones most vulnerable.

"We increasingly hear they're targeting the most senior people in organisations, be it a law firm, be it an accounting firm, because those guys at the very top have a lot of credentials to move east and west throughout their network, and they can get things done," Greisiger said.

"And they do skip, I think, some of the baseline security processes."