The state insurance regulators' annual cyber report says loss ratios may deteriorate if AI outpaces patching
Cybersecurity Dive reports that the National Association of Insurance Commissioners' 2026 report on the cybersecurity insurance market says "Total U.S. domestic cyber direct written business has nearly tripled since 2020", with Chubb, Beazley and St. Paul Travelers the largest writers by direct written premium. The average claim at businesses with at least $1 billion of annual revenue reached $4.4 million in 2025, double the 2024 figure and up 586% since 2021, while payout frequency fell to 10 claims per 100 policies from 15, which NAIC says "might suggest that improved underwriting selection and security controls may be reducing the number of incidents reaching a claim"; mid-market claims averaged $759,000, up 23% from $619,000, and claims at smaller firms averaged $142,000, down from $215,000. NAIC attributes the severity growth to "rising business interruption expenses and the growing cost of data breach and privacy-related litigation" and the frequency decline to underwriting and controls, while naming frontier AI models among the factors it says are "fueling a more dangerous cybersecurity environment". On AI it says "Cyber risk is evolving at the pace of machines" while remediation runs at human speed, and that "If AI democratizes offensive capability faster than defenders can patch, loss ratios may deteriorate", particularly for insureds on common software stacks; it calls supply-chain risk "the defining challenge of the current cycle" because "A single event or vulnerability can trigger correlated losses across many policyholders simultaneously."
CFC folds affirmative AI cyber wording into its financial-institutions suite
CFC consolidated cyber, D&O, errors and omissions, professional liability, crime, employment practices liability and general liability into blended financial-institutions and investment-manager policies, adding wording confirming that “AI as a tool used against the policyholder, in phishing, reconnaissance, or intrusion, falls within existing cyber cover.” As with Beazley's endorsement the same day, the wording does not address whether the institution's own use of AI — in client-facing tools or trading models — is covered elsewhere.
Beazley adds an endorsement affirming that AI-driven cyber attacks are covered — and is silent on the insured's own AI
Beazley issued an AI Clarifying Endorsement stating that AI-driven cyber attacks fall within the existing full-spectrum cyber cover on its cyber and tech errors-and-omissions policies, addressing attacker-side AI such as autonomous phishing and accelerated intrusion. Insurance Business reports the endorsement “says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy,” and that the market remains split on whether an insured's own AI use is affirmed, excluded or sub-limited.
A carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI
Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.