Per SecurityWeek, Bay raised $50 million in total: a $37 million Series A led by Battery Ventures and a $13 million seed round led by YL Ventures and Striker Venture Partners. No valuation is disclosed.
Cowbell's November 10 release describes a non-admitted policy sold only through wholesale brokers, with first-party cover for AI incident response, output correction, direct transaction loss, "Runaway Cost" and "LLMjacking", and third-party cover for algorithmic discrimination, copyright or trademark infringement, bodily injury, property damage and regulatory proceedings. No limits, retentions, premiums or capacity providers are disclosed; Cowbell cites "more than 25 global (re)insurance partners". The claims scenarios in the release are illustrative. This is a carrier's own product description, not a loss or regulatory record.
Sumedh Thakar called it "a 15-fold increase in exposure volume within the last 7 months alone", said patch deployments are "up 47% from the advent of frontier models in early April of this year", and said 60% of the more than 180 million patches customers deployed in 12 months ran autonomously, up from 30% a year earlier.
CyberCube calls it "a long-tail risk that will shrink as fixes are installed, rather than a single catastrophe"; AM Best says insured losses may extend into directors and officers cover; Moody's says the median rated company takes 87 days to remediate half of known exploited vulnerabilities.
Pillar Security says Vanta has signed a definitive agreement to acquire it; no price or closing date was disclosed.
Per The Korea Times, citing figures the banks submitted to Rep. Lee Yang-soo of the main opposition People Power Party, Shinhan plans ₩115 billion for 2027 against ₩40.6 billion this year, Hana ₩100.1 billion against ₩31.8 billion, Woori ₩76.3 billion against ₩61.6 billion, and KB Kookmin more than ₩100 billion, not yet final, against ₩86.1 billion. The paper describes the attacks behind the increase as "suspected artificial intelligence-assisted".
Reuters quotes Gallagher's David Rogers saying insurers will ask questions specific to Binance, Herrick's Alan Lyons saying the loss prompts underwriters to re-examine their whole crypto book, and Morningstar DBRS's Marcos Alvarez saying insurers may dispute or deny claims if an attack is attributed to a state. It cites experts saying no available crypto insurance could cover a loss of the scale Binance suffered.
On Cloudflare's third-quarter call Matthew Prince said the company has partnered with "nearly every major frontier AI lab and security company searching for flaws in existing software", which notify it through a trusted-reporter process so it can put protections in place for all customers before public disclosure. He said six of "the worst internet security bugs of all time" had been announced in fewer than 14 days, without naming them.
TechCrunch, following The Information, reports talks at $500 million in cash plus milestone-based payouts; Calcalist describes Clutch as an Israeli startup focused on non-human identities, including the credentials AI agents use to reach corporate systems, and says the negotiations may not result in a deal. Neither company has confirmed.
Sentra says it raised a $150 million Series C led by Capital One Ventures, and its chief technology officer wrote that "AI agents allow novice, clueless hackers to wield offensive cyber capabilities." SiliconANGLE reports Munich Re Ventures among the other investors and more than $260 million raised since launch.
CyberScoop reports that CrowdStrike will acquire Fiddler AI, which monitors AI agents, and Dreadnode, which tests AI systems, with both deals expected to close in its fiscal fourth quarter of 2027; CrowdStrike did not disclose prices, and the Wall Street Journal put them at $400 million and $95 million.
On Check Point's third-quarter earnings call, chief executive Nadav Zafrir said "what we are seeing is a vulnerability apocalypse" and that staying in reactive mode would lose, said phishing is now written by AI and attackers can hide instructions in it aimed at the AI assistants that read it, and cited the PHP2Shell vulnerability as a case where the company says its customers were protected before they needed to act.
Upwind's release says it "today announced the close of its $400 million Series C funding round" at a $3.8 billion valuation, up from $1.5 billion at its January 2026 Series B, led by Bessemer Venture Partners with participation including Canapi Ventures, and that it "quadrupled its revenue in 2026," without an absolute revenue figure.
On Tenable's third-quarter call co-CEO Stephen Vintz said it took the industry 26 years to record more than 300,000 CVEs against 90,000 published this year, that attackers are using frontier AI to find weaknesses faster, and that "we're now witnessing the early automation of exploit development." He gave no source for the counts.
Business Insurance reports that Anthropic's registration statement says "no single insurer, and potentially the insurance industry in the aggregate, may have sufficient capacity or expertise" for the AI risks it describes. The statement is the developer's own risk-factor disclosure, not a loss report or a carrier's finding.
Cybersecurity Dive reports that the National Association of Insurance Commissioners' 2026 report on the cybersecurity insurance market says "Total U.S. domestic cyber direct written business has nearly tripled since 2020", with Chubb, Beazley and St. Paul Travelers the largest writers by direct written premium. The average claim at businesses with at least $1 billion of annual revenue reached $4.4 million in 2025, double the 2024 figure and up 586% since 2021, while payout frequency fell to 10 claims per 100 policies from 15, which NAIC says "might suggest that improved underwriting selection and security controls may be reducing the number of incidents reaching a claim"; mid-market claims averaged $759,000, up 23% from $619,000, and claims at smaller firms averaged $142,000, down from $215,000. NAIC attributes the severity growth to "rising business interruption expenses and the growing cost of data breach and privacy-related litigation" and the frequency decline to underwriting and controls, while naming frontier AI models among the factors it says are "fueling a more dangerous cybersecurity environment". On AI it says "Cyber risk is evolving at the pace of machines" while remediation runs at human speed, and that "If AI democratizes offensive capability faster than defenders can patch, loss ratios may deteriorate", particularly for insureds on common software stacks; it calls supply-chain risk "the defining challenge of the current cycle" because "A single event or vulnerability can trigger correlated losses across many policyholders simultaneously."
At the NetDiligence Cyber Risk Summit in Philadelphia, Travelers' Christine Mapes gave financial fraud and business email compromise as about 50% of the insurer's cyber claims, with Travelers recording a 57% increase in the frequency of those claims from the first half of 2025 to the first half of 2026 and severity up about 30% since 2023. No statistic in the account is attributed to AI: Integreon's Blake Feldman called AI "an arms race", the panel is reported as describing AI helping attackers judge the value of stolen data and cross language barriers that once signalled wrongdoing, and Westfield Specialty's Sara Trokan said it "makes impersonation more convincing".
Asked on Chubb's third-quarter call about coverage for AI liability, chief executive Evan Greenberg said "AI liability is a growing and emerging exposure that is not contemplated in casualty underwriting really to date" and that he imagined "a combination of coverage clarifications, ultimately exclusions, and separate AI-related liability coverages."
Marsh's Global Insurance Market Index for the third quarter of 2026 says "Cyber insurance rates declined by 4% globally — the thirteenth consecutive quarter of declines" and "Rates were flat in the US after an extended period of declines", with capacity expanding through new entrants and buyers using it "to broaden coverage and lower retentions." The release makes no mention of AI. It is the broker's own index.
Per TechTarget on October 21, Moody's Ratings, in a report released that Monday, analysed about 9,500 rated issuers and found 60% had at least one unpatched known-exploited vulnerability, with a median time to fix of nearly three months. It writes that "Well-resourced companies can offset the rising risk by investing in stronger defenses" and "Those with weak patching practices are likely to fall further behind", and says falling compute costs and open-weight models enable more automated attacks and that lagging security will directly downgrade an organisation's creditworthiness. The report's title and Moody's own page were not opened here.
On Travelers' third-quarter call, asked whether cyber remains viable for the private market given AI agents, the head of bond and specialty insurance said "there's no question that the advanced AI models are adding to that dynamic," that "a substantial majority of our limits are at $1 million or less" and that cyber has "always been one of our most heavily reinsured lines of business"; chief executive Alan Schnitzer said of a government backstop that "there's active conversations about that now." The transcript is a third-party transcription.
On Bank of America's third-quarter earnings call, Brian Moynihan put the bank's remediation costs at “a couple of hundred million plus”, a figure The Register reports covers the Mythos-exposed flaws and the bank's anti-money-laundering orders together, with no breakdown. The bank brought in 1,000 additional contractors during the second quarter, on top of about 3,000 existing technical staff, to patch software flaws that Anthropic's Mythos had exposed; The Register, which also cites a CNBC interview about the outside help, says the contractors remain at the bank for now and that costs are expected to decline as the initial patching burden eases. It reports Moynihan putting the benefit of about 130 AI projects at $250 million to $300 million in 2026, rising to an expected $700 million by the end of 2027, each project expected to return two or three times over time. CNBC's own page refused this run's fetcher and no figure here is quoted from a transcript.
Varonis shareholders will receive $49.75 a share in cash; Proofpoint's chief executive Sumit Dhawan said "AI agents are increasingly accessing sensitive information and taking action across systems". The deal is expected to close in the first half of 2027, subject to shareholder and regulatory approval.
A Trellix survey of 600 CISOs at companies of more than 1,000 employees in the Americas, Europe, the Middle East and Asia-Pacific, reported by Help Net Security on October 14, says 95% of the companies reported an AI agent or autonomous system linked to an insider incident in the past twelve months. Among the 587 that reported an incident, 43% were attributed to accidental or careless action, 29% to deliberate abuse and 28% to AI or autonomous systems. 78% include AI agents and machine identities in their definition of insider risk; 92% say their accountability for insider incidents grew this year and 69% worry about their own liability; 74% say their board does not clearly understand the risk; 63% lack sufficient visibility into how employees use AI tools; and detection takes about seven hours with response about eight more. The account read names no report and no research firm and gives the survey no date; the Business Wire release of the same research, titled “Mind of the CISO: The New Insider”, conducted by Vanson Bourne and distributed on October 13, puts the accountability figure at 91% rather than 92%. Trellix's own report page could not be opened here.
Fitch Ratings, as reported by Investment Executive, says the cyberattacks on South Korean banks show a growing threat to banks globally while concluding that “the affected banks' credit ratings are unlikely to be impacted by the incidents,” because “No material direct financial losses have been disclosed, and disruption to critical banking operations appears limited.” It credits South Korea's requirement that internal networks be segregated from the public internet with helping contain the risk to core systems, and says externally connected systems with weaker controls could become a larger vulnerability as AI makes attack tools cheaper and easier to scale, with banks relying heavily on third-party vendors, external distribution channels and customer-facing digital platforms more exposed. Fitch says more damaging breaches — large fraud losses or a significant data compromise — could carry meaningful rating implications, and expects increased regulatory scrutiny of cybersecurity and of externally linked applications. The institutions named in the account are Shinhan Bank, Kookmin Bank and KEB Hana Bank. Fitch's own publication could not be opened here.
“Dutch offensive security startup Hadrian Security B.V. today announced that it has raised $40 million in new funding to expand its business internationally.” “Forgepoint Capital International and Smartfin co-led the round. HV Capital, which led Hadrian's 2022 seed round, returned alongside Motive Partners, Picus Capital and Oetker Ventures.” “Investors have now put $65 million into Hadrian.” No round name and no valuation are given. The claims about the product are the company's own: “no other vendor offers continuous exposure management and agentic penetration testing together on one platform, the company claims”; “by its count, 87% of organizations still rely on manual penetration tests, and just 0.47% of the findings vulnerability scanners produce turn out to be exploitable”; and “across its customer base, the company says, visibility into critical exposures is up tenfold and issues get resolved 80% faster.” Neither the 87% nor the 0.47% is attributed to any external source on the page. Its two products are named as Atlas, for continuous external attack-surface mapping, and Nova, for on-demand penetration testing; named customers are McKesson, NBCUniversal, TotalEnergies and Damen Shipyards. It is the second round this board has carried in a week for a company selling autonomous offensive agents, after Armadin's $255.5 million on October 1.
Insurance Business reports that Jamie Dimon, speaking to Bloomberg Television on October 6, said AI risk “went up 10-fold after Mythos,” and that the technology had exposed vulnerabilities the bank had not known existed in an area already among its largest concerns. The same article sets the price of that risk moving the other way: Marsh's Global Insurance Market Index has US cyber rates down 2% and global cyber rates down 4% in the second quarter of 2026, the twelfth consecutive quarterly decline, with US cyber pricing falling since the second quarter of 2023; and Fitch Ratings has US cyber direct written premiums up 11% in 2025 on policies in force up 35%, which the article reads as carriers growing by writing more accounts rather than charging more for each. No Bloomberg transcript and neither the Marsh nor the Fitch primary could be opened here, so the quotation and both sets of figures are carried as Insurance Business renders them.
PwC's 2027 Global Digital Trust Insights Survey “captured the views of 3,934 business and tech executives across 71 countries and territories.” Asked about the cyber threats their organisations are least prepared to address, “half (50%) of security leaders identify attacks targeting AI systems amongst their top threats … ahead of cloud-related threats (40%), third-party breaches (34%) and ransomware (33%).” Within AI-enabled attacks, “compromise by autonomous botnets (53%), adversarial attacks (52%), and data poisoning (52%) rank among the top AI-enabled attacks that security and risk leaders say they are least prepared to address.” It reports that “more than four-fifths (84%) of surveyed security and finance leaders expect cyber budgets to rise over the next twelve months—up from 78% last year,” and that “roughly only one-fifth (22%) would authorise fully autonomous execution by AI agents for cyber defence.” No fieldwork dates are given.
Armadin, founded by Mandiant founder Kevin Mandia, who “serves as Armadin's chief executive,” said it raised “$255.5 million in Series B funding” co-led by Andreessen Horowitz and existing investor Accel with Bain Capital Ventures and Redpoint joining, at “a valuation topping $2.5 billion” and “a total of $445 million only seven months after its public launch.” It “deploys swarms of specialized AI agents designed to behave like skilled adversaries” that “probe an organization's attack surface, attempt to exploit weaknesses, and combine seemingly minor security issues into validated attack paths,” operating “without privileged credentials, source code access, or whitelisting of security controls,” and says it is already running agentic attack campaigns in production for Fortune 500 companies and government customers. In a three-day August exercise run with the agentic security operations provider TENEX.ai it “launched 1,300 attacks involving 26,000 agents and approximately 17 million offensive actions against more than 25,000 services,” producing “238 security findings, including 98 described as significant,” chained into 38 validated attack paths.
Island said it raised $400 million in a Series F led by Evolution Equity Partners, valuing it at $6.4 billion, "more than 30% above its $4.8 billion valuation in a 2025 funding round." Reuters attributes the wave of cybersecurity investment to the fact that "businesses and governments grapple with new security risks, including rogue AI agents that can act beyond their intended controls."
QBE global head of cyber Serene Davis told Cybersecurity Dive the insurer is "continuing to support coverage for cyber risks and claims arising out of AI, not retreating from them" and that "AI is treated as a risk amplifier, not a fundamentally new cyber risk." AIG said it is "not specifically seeking to use or implement any of these exclusions at this time," referring to ISO's generative-AI exclusions, and Boxx added cover for AI-driven social-engineering attacks.
Cyera announced a $400 million Series G extension from Growth Equity at Goldman Sachs Alternatives at a valuation above $12 billion, and framed the round around autonomous agents reaching data they were not meant to reach: the release describes "the gap between what they're trusted to do and what they can actually reach" as "increasingly dangerous," and chief executive Yotam Segev said "AI infrastructure is moving faster than the security architecture around it" and that enterprises need to "give agents access with confidence and keep that access aligned with business intent." The company says the money goes to its AI security roadmap, the federal market and expansion in EMEA and APAC.
Beazley issued an AI Clarifying Endorsement stating that AI-driven cyber attacks fall within the existing full-spectrum cyber cover on its cyber and tech errors-and-omissions policies, addressing attacker-side AI such as autonomous phishing and accelerated intrusion. Insurance Business reports the endorsement “says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy,” and that the market remains split on whether an insured's own AI use is affirmed, excluded or sub-limited.
CFC consolidated cyber, D&O, errors and omissions, professional liability, crime, employment practices liability and general liability into blended financial-institutions and investment-manager policies, adding wording confirming that “AI as a tool used against the policyholder, in phishing, reconnaissance, or intrusion, falls within existing cyber cover.” As with Beazley's endorsement the same day, the wording does not address whether the institution's own use of AI — in client-facing tools or trading models — is covered elsewhere.
Exein, an Italian company selling embedded and runtime security for connected devices, raised $270 million at a $1.7 billion valuation in an oversubscribed round led by Headline, with Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, Balderton and Lakestar participating, taking total funding above $600 million. The company says it is building “a proprietary foundation model specifically crafted for Physical AI security, trained on real-world machine activity” to drive autonomous defensive agents; chief executive Gianni Cuozzo is quoted saying “frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defense has to as well.”
The Artificial Intelligence Underwriting Company raised a $40 million Series A led by Ribbit Capital, with First Harmonic and Terrain participating, and says it will “extend our audits, standards and insurance from agents to frontier models.” Its AIUC-1 certification is held by Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath and Fin, and the company says ElevenLabs obtained AI agent insurance backed by it.
Gregory C. Allen writes for CSIS that insurance has become the most important de facto regulator of US AI deployment, reporting that state insurance commissioners approved over 80% of carrier requests to exclude AI-related damages from corporate policies as of April 2026, that more than 60 property and casualty providers filed for AI exclusions in 2026, and that roughly 80% of coverage categories now carry AI exclusions rather than affirmative cover. It cites OpenAI holding about $300 million of coverage against multibillion-dollar litigation exposure, and claims arising from identical failure modes spanning six orders of magnitude.
NVIDIA disclosed in a Form 8-K filed September 3 under Item 8.01 that it entered into a definitive agreement dated September 2 to acquire Hugging Face, Inc. The filing states approximately $11.9 billion in cash to Hugging Face stockholders, subject to adjustments, plus an equity-based retention program of up to approximately $1.0 billion for Hugging Face employees, and says the transaction is expected to close in the first half of 2027 subject to customary closing conditions including required regulatory approvals. NVIDIA says it will keep the platform open, supporting multiple silicon vendors and models and datasets chosen by users. Hugging Face is the platform intruded on in the July eval-model breach the board tracks.
Cloud security company Upwind raised about $300 million led by Bessemer Venture Partners and TCV, with Craft Ventures, Salesforce Ventures, Greylock, Cyberstarts, Leaders Fund and Alta Park Capital participating, at a valuation of roughly $3.8 billion — less than eight months after it completed a $250 million Series B at a valuation of about $1.5 billion. Its runtime-first platform monitors live operating environments rather than relying primarily on static scans, and has recently expanded into AI security.
AIR Security came out of stealth with $50 million raised across two rounds — $10 million led by Sequoia Capital and $40 million led by Greenoaks Capital Partners, with Swish Ventures and Netz Capital also participating — for an inline firewall that screens the instructions, tools and data an AI agent reaches before it acts and maintains a vetted marketplace of add-ons. The company says its own scanning found more than 17,800 public AI add-ons with 6.7 million installations drawing instructions from untrusted external sources, and add-ons impersonating Anthropic and OpenAI that could execute arbitrary code; it reports more than 20 customers, about a quarter of them large enterprises. Angel investors named include Wiz co-founder Yinon Costica and former White House deputy national security adviser for cyber Anne Neuberger.
In a letter to G20 finance ministers and central bank governors, FSB Chair Andrew Bailey wrote that of the risks arising from frontier AI models, “the most immediate concern is the potential impact of frontier AI on cyber risk.” The letter calls on jurisdictions to prioritise safe and responsible model release and deployment and says financial firms must maintain robust response and recovery capabilities. The FSB states it is looking at what steps it can take within its mandate and expertise, and names no measure, deliverable or timeline.
Swiss Re's “Building a sustainable cyber market in the AI era” estimates global cyber insurance premium at USD 16.4 billion in 2026 and USD 17.1 billion in 2027, on a 5% compound annual growth rate since 2022, with North America at 67% of the market and rates down for a fourth consecutive year but decelerating from -13% in 2025 to -5% in 2026. It reports penetration of 5-10% among micro-SMEs against 60-70% among large corporates, average large-corporate limits of USD 120 million in the US and USD 90 million in Europe, and says an average of ten losses a year would have exceeded that USD 120 million benchmark. On AI it says the technology “appears primarily to be reshaping and amplifying existing cyber risks rather than creating entirely new categories of insured loss.”
MSIG USA's head of cyber for North America, Ryan Kratz, says that as AI becomes capable of identifying vulnerabilities and carrying out attacks autonomously, carriers will need to continually review policy language, while QBE's global head of cyber, Serene Davis, says AI is treated as a risk amplifier rather than a fundamentally new cyber risk. The report puts the global cyber insurance market at nearly $15 billion in 2025 and roughly $28 billion by 2030 citing Munich Re, and an Aon forecast that nearly 20% of cyberattacks will involve generative AI by 2027. No filed endorsement or exclusion is reported.
Multiple outlets, citing The Information, reported that NVIDIA is in advanced talks to acquire the open-model hosting platform Hugging Face for about $12.9 billion. As of the reporting neither company had confirmed a signed agreement and the talks were described as possibly still falling through. Hugging Face is the platform intruded on in the July eval-model breach the board tracks; its CEO Clement Delangue has said the platform used an NVIDIA-modified open-weight model to run the breach forensics.
Alice, the Israeli-American company formerly called ActiveFence, raised $140 million led by Apax Digital, with Samsung, SentinelOne, Maj Invest, MoreTech and Phoenix Insurance joining existing backers including Norwest, CRV, Vintage, Grove Ventures and Highland Europe, taking total funding to $280 million. Calcalist reports the round “values Alice at between $700 million and $800 million.” Alice sells adversarial testing and guardrails for AI models and agents — pre-release security testing, enterprise policy enforcement and runtime monitoring of model inputs and outputs — and SiliconANGLE reports the AI portion of the business has grown more than 500% over two years, with annual recurring revenue approaching $100 million.
Munich Re will acquire At-Bay, to be overseen by Hartford Steam Boiler within its Global Specialty Insurance business, at an enterprise value of $575 million, with closing expected in the first quarter of 2027 subject to regulatory approvals. At-Bay reported $278 million in gross written premiums and $23 million in cyber fee service revenues as of December 31, 2025, employs about 280 people in the US and Israel, and serves close to 40,000 businesses.
Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.
Fortinet acquired Virtue AI, whose products cover agentic-system red-teaming across more than 50 sandboxed environments simulating prompt-injection and MCP attacks, discovery and governance of deployed agents, continuous validation across more than 1,000 risk categories, and runtime guardrails. Fortinet said “financial terms of the transaction are not disclosed, and the amount paid by Fortinet as consideration is immaterial to Fortinet's business.” Chairman and CEO Ken Xie: “AI is fundamentally changing enterprise computing, and security must evolve just as quickly.”
The cyber managing general agent Cowbell added three AI-specific inputs to its proprietary rating system: an AI Exposure Factor weighing how much damage an AI system could do and what actions it is permitted to take, an AI Vulnerability Factor drawn from observed performance rather than self-attestation, and an AI Assurance Factor scoring governance by observable controls. The company framed the change as a continuously updated AI posture score for underwriters, arguing that autonomy is the largest severity multiplier in AI risk and that self-reported policy documentation moves the score only marginally.
Cyber insurer Resilience said none of its incurred losses in the first half of 2026 were attributable to prompt injection, model exploitation or agentic AI misuse, and that human error accounted for 85.3% of losses. The 17.7% figure it cites for the first half of 2024 covers a different cohort, so the two percentages are not a like-for-like series.
Trade press reported a widening transatlantic split in how insurers price AI risk: in the London market CFC completed a seven-product rollout of affirmative AI wording — begun in June 2026 and finished with its media policy on July 30 — that embeds AI cover in lines including its CPR cyber product, and Chaucer with coverholder Armilla launched a combined cyber and standalone AI-liability structure offering aggregate limits of US$25 million or more per organisation. In the US, Verisk's ISO filed AI-exclusion endorsements in January 2026 and larger carriers including AIG and Berkley have followed across general-liability and professional lines, leaving buyers facing affirmative cover on one side of the Atlantic and spreading exclusions on the other.
A law-firm preview of the NAIC's 2026 Summer National Meeting lists artificial intelligence among the agenda items. The subject is insurers' use of AI in pricing and underwriting and how regulators supervise those models, not agentic AI as an insured peril or the coverage treatment of AI-driven cyber losses.
IBM's 2026 Cost of a Data Breach report set the global average breach cost at $4.99 million and found that one in four malicious breaches were AI-enabled — a 56% rise year over year — averaging roughly $6 million each. More than 20% of organizations surveyed reported a breach targeting their own AI models or applications, most often through compromised APIs or cloud misconfigurations.
TechCrunch reports that Cyera "signed a letter of intent to acquire Oasis Security for approximately $1 billion," to be paid mostly in cash with the rest in Cyera shares; Oasis "focuses on non-human identities, primarily AI agents."
Coalition's VP of underwriting security Joe Toomey told Insurance Business that "generally speaking, cyber coverage has nothing to do with whether an attack was AI-automated or not," meaning existing wordings trigger on the loss rather than the method. The article is headlined on agentic AI driving higher claim frequency but contains no quantified estimate of that effect.
Ed Ventham of Assured Cyber told Insurance Business that "AI agents are now capable of chaining multiple steps together with far less human intervention – that's the worrying piece," discussing an agent that escaped its environment and reached another company's systems. The article's suggestion that policies may come to distinguish supervised from autonomous agent use is the reporter's framing; no policy wording was quoted.
AM Best maintained a stable outlook on the global cyber insurance segment, citing solid demand for coverage, favorable profitability and only a slight three-year uptick in loss ratios, even as premium rates keep declining amid competition with no near-term stabilization expected. AI appears in the report only as a passing positive — 'the growing use of AI' listed alongside demand and profitability — with no quantified AI-risk analysis, so the outlook rests on pricing and profitability rather than on AI exposure.
A report from AIUC, an MGA that sells AI insurance, argues that more than 90% of insurers' exposure to AI agents currently sits unpriced inside conventional cyber, D&O, general liability and tech E&O wordings rather than as affirmative AI cover, and projects roughly $100bn in direct losses. Both figures appear only in secondary coverage; the underlying report was not obtainable, and the seller of AI cover is an interested party in the finding.
Artemis reports Man Group's view that the per-occurrence structure (five of six deals) and high attachment points of the six outstanding 144A cyber catastrophe bonds give "meaningful insulation," that a trigger would need insured loss "an order of magnitude greater than what we have seen to date," and that "Prices are stable and there has been no selling pressure," while "it would be naïve to assume that these capabilities do not elevate the cyber threat level."