The shift is happening in insurers’ own risk models. The KPMG UK Sentiment Survey, released on October 23, 2026, found that 30 percent of insurance leaders now worry more about AI-enabled cyber attacks than about climate-related catastrophes. These are people who price hurricanes, earthquakes and wildfires for a living.
What the claims data show
The money backs up the worry. The average cybersecurity insurance claim for large businesses reached $4.4 million in 2025, double the 2024 figure. Measured from 2021, the increase is 586 percent. Business interruption costs and data breach litigation are driving it: when systems go down, revenue stops, and lawsuits from affected customers and employees follow.
Insurers have a modeling problem too. Climate risks tend to follow patterns over time, so they can be modeled and partly mitigated. AI-enabled attacks are newer and change fast, with little history to price from. The survey’s commentary points to “black swan” breaches, the unforeseen kind, as the real fear. Some insurers are reported to be exploring pricing that adjusts to live threat intelligence, and policies are getting more restrictive and more expensive. Smaller firms without money for advanced defenses may find cover harder to buy.
Why AI changes the attacker’s math
A human attacker might spend weeks or months mapping a network and crafting tailored attacks. An AI system can work through petabytes of data in moments, cross-referencing public information with leaked credentials to find the weakest link. The same tools lower the skill needed to attack. An off-the-shelf toolkit can scan for vulnerabilities, write custom malware, produce convincing deepfake phishing messages and automate pulling data out, which widens the pool of attackers from nation-states and organized crime to disgruntled former employees and lone opportunists.
The commentary behind the survey lists specific techniques. Polymorphic malware keeps rewriting its own code, so signature-based antivirus struggles to catch it. Deepfake voice or video of an executive can push an employee into an urgent wire transfer. Adversarial attacks feed manipulated input to a legitimate AI system, for example to make a fraud detector ignore fraudulent transactions. Botnets coordinated by AI can run denial-of-service attacks or credential-stuffing campaigns while adapting to defenses as they go. The global cost of cybercrime is projected at $10.5 trillion a year by 2025, and AI-driven attacks are said to be a significant driver.
What defenders are being told to do
The advice is familiar but urgent. Use AI-powered detection, behavioral analytics and automated response. Train staff on phishing, social engineering and deepfakes. Adopt zero-trust architectures that treat every user and device as a possible threat. Run penetration tests and incident drills that simulate AI-driven attacks. The defender has to be right every time, while the attacker only needs to be right once, and skilled security staff are scarce.
Watch this space. If insurers who weigh catastrophe risk for a living now rank a digital threat above floods and fires, premiums and policy terms will be the first place the change shows up.
Sources
- The Chilling Truth: AI Cyber Attacks Are Here, And We’re Not Ready
- Claude (AI)
- The Chilling Truth: AI Cyber Attacks Are Here, And We’re Not Ready
Photo: DennisM (CC0)
