Cyber Insurers Pull Back on AI Risk as Claims Landscape Shifts

More than 60 property and casualty insurance groups have filed to adopt AI exclusions, even as 88% of organizations now report regular AI use in at least one business function, according to McKinsey & Company. The gap between how businesses operate and how insurers write policies is widening, and policyholders are caught in the middle.

By Daniel Okafor

The retreat shows up in two forms: blanket AI exclusions in policy language, or complete silence on the subject. Both approaches undermine the value of cyber insurance and create uncertainty across the wider industry, the analysis argues. Carriers are choosing paths that prioritize their own risk avoidance over the survival of their policyholders.

What do the exclusions change?

The numbers behind the retreat are stark. Nearly 83% of the S&P 500 have flagged AI as a material risk in recent years. 87% of executives identified AI-related vulnerabilities as the fastest-growing cyber risk. Not every insurer that filed an exclusion has implemented one, but the filings themselves signal deep industry nervousness.

The mechanics of the problem are simple. A broad AI exclusion lets a carrier challenge or deny a claim simply because an AI tool was involved — even if human error, which a typical cyber policy covers, primarily drove the loss. Even when an insurer clarifies the line between AI-related incidents and others, the exclusion still weakens policyholders' confidence that coverage will respond when needed.

Most modern software stacks now integrate AI somewhere. An absolute exclusion therefore signals an inability to adapt underwriting and risk models to emerging risks, leaving policyholders with coverage gaps they may not discover until a claim lands.

Why does silence also create risk?

Some insurers take a wait-and-see approach. They avoid any mention of AI in their policy wording altogether. The omission does not mean no response to an AI-related exposure — it means vague language leaves coverage open to interpretation, which creates headaches for both the insurer and the insured.

In a coverage dispute, a business may face the cost and uncertainty of a legal battle simply to determine whether its insurance safety net exists. Carriers take on unintended risk too. Without clear, affirmative wording, traditional cyber coverage becomes ambiguous when an AI model is involved in a security failure or privacy breach, the analysis notes.

Is AI actually a new kind of threat?

Mostly no, the argument runs. Much of the market treats AI as a terrifying, unquantifiable specter when it is really an accelerated evolution of digital threats the industry has managed for decades. Most AI-driven incidents are familiar threats powered or enhanced by new technology.

Business email compromise is the clearest case. Bad actors trick victims into sending money or private data by pretending to be trusted associates. The FBI has tracked this exposure since the early 2010s. It remains the most common event type, representing 31% of all claims in 2025.

AI raises the success rate rather than changing the crime. Attackers can amass more information about targets during reconnaissance, spoof email addresses, hyper-personalize messages and translate them into different languages. The same logic applies to deepfake-enabled fraud: an employee who wires funds after an AI-generated voice message impersonating a CFO has suffered a familiar funds transfer fraud loss. The delivery mechanism changed. The business impact did not.

How can AI work for defenders?

The technology cuts both ways. Many managed detection and response platforms use automation and AI-assisted triage to evaluate alerts rapidly, helping security teams identify and respond to fast-moving threats. Many leading MDR tools triage threat detections in milliseconds. MDR is a scalable, cost-effective service that can shield businesses from advanced cyber risks more effectively than traditional risk management tools, the analysis states.

That reinforces the core argument: AI should be evaluated as part of the overall risk environment, not treated as an automatic reason to exclude coverage. The industry has the data, security tools and underwriting capabilities needed to accurately price cyber risk in the age of AI, so it has no excuse for defaulting to broad exclusions or silence. Instead, carriers should pursue affirmative policy language that explicitly states how coverage responds to AI-driven threats.

The prescription is outcome-based. Policies should respond to the result of the incident, not the technology behind it. Whether an exposure originates with a human or an AI model, the consequences are real, and the cyber market should be able to absorb them. As the analysis puts it: anything short of a partner that helps businesses recover from a damaging incident is a market failure.