Same Attacks, Bigger Consequences: How AI Is Reshaping Cyber Risk for Insurers

00 — Executive Summary

Four things that demand immediate attention

Cyber attacks have not changed in nature. Stolen credentials, unpatched vulnerabilities, and human error have dominated loss data for a decade and continue to do so. What has changed is the economics of attack: AI and automation have reduced the cost and skill required to launch attacks at scale, increased their frequency, and amplified the systemic reach of individual events. For insurers, frequency assumptions built on historical baselines are deteriorating. Severity is harder to model as large losses concentrate across shared infrastructure. And aggregation risk is growing in ways that traditional catastrophe frameworks were not designed to handle.

01 — Introduction

The question the market has been circling

That question has been building for several years, but it arrived on the boardroom agenda with unusual force in April 2026. The release of a frontier AI model with independently verified autonomous attack capability — and the emergency discussions it triggered among central bankers, treasury officials and bank CEOs on both sides of the Atlantic — moved a debate that many insurers had treated as medium-term planning into the present tense. Detail on those specific events is covered in the case study callout within this note. What they illustrate, rather than constitute, is the subject of this analysis.

The more durable question is structural. Frontier AI capabilities will keep advancing and the specific systems in any given news cycle will be superseded. But the underlying dynamic — the industrialisation of cyber attack economics through AI and automation — is already producing measurable effects on loss frequency, severity and correlation. Those effects are interacting with underwriting assumptions, pricing models and accumulation controls calibrated for a materially different threat environment. The evidence suggests that interaction is already producing losses that exceed the models.

This note is grounded in the most recent available data from Verizon, IBM, Munich Re and Lloyd's, and draws on regulatory assessments from the UK, EU and US.

02 — Reality Check

No new playbook: attacks remain stubbornly familiar

The fundamental mechanics of a cyber breach have not changed meaningfully in over a decade. Attackers still rely on three primary entry points: stolen credentials, unpatched vulnerabilities, and mistakes made by people inside organisations. The 2025 Verizon DBIR — covering over 20,000 incidents — found that credential abuse initiated 22% of breaches, vulnerability exploitation approximately 20%, and the human element remained a factor in 60% of all breaches. Over a ten-year horizon, stolen credentials have appeared in nearly a third of all data breaches.

Only 15% of perimeter-device vulnerabilities were fully remediated within the reporting period; nearly half remained unresolved. Exploitation of vulnerabilities nearly tripled year-on-year in 2024, driven by zero-day attacks on unpatched systems. The risk being priced today is fundamentally the same risk that existed in 2016. What has changed is not the attack type but its velocity, scale, and the degree to which automation is removing the skill requirement for execution.

03 — The Acceleration Effect

AI changes the economics, not the anatomy

The significant shift underway is economic. AI and automation have materially reduced the cost and skill required to launch cyber attacks at scale. Ransomware-as-a-Service platforms offer subscription-based toolkits — including AI-enabled hacking tools — that have lowered the barrier to entry for less sophisticated actors. Munich Re identifies this as a primary driver of attack frequency, speed and precision across its 2025 and 2026 cyber trend analyses.

The scale of this industrialisation is visible in the data. The number of victims publicly named on ransomware leak sites has grown from 1,412 in 2020 to over 6,000 in 2025 — a fivefold increase in five years. In 2024 alone, ransomware attacks rose approximately 25% year-on-year, and the volume of data exfiltrated in ransomware incidents nearly doubled. There are now more than 75 active groups posting across public leak infrastructure — a market with the characteristics of a mature criminal industry.

Shorter exploit cycles compound this further. The time between vulnerability disclosure and first active exploitation in the wild has collapsed — in many cases to under 24 hours. Attackers are consistently moving faster than defenders can patch, and the automation of vulnerability discovery itself is an emerging pressure that current underwriting assumptions do not yet reflect.

04 — Systemic Risk

From operational risk to correlated catastrophe

The most consequential structural shift is not frequency — it is correlation. Individual breach events are becoming less important than systemic events that propagate across shared infrastructure. Third-party involvement in breaches doubled from 15% to 30% in a single year (Verizon DBIR 2025). The 2024 CrowdStrike software update failure — a faulty update, not a malicious attack — produced simultaneous outages across airlines, banks, hospitals and stock exchanges globally, illustrating how a single shared dependency can function as a de facto catastrophe trigger.

A joint CyberCube/Munich Re study (July 2025) found that a severe malware event could infect up to a quarter of all systems worldwide. The expected global cost of software supply chain attacks is estimated to grow from $46 billion in 2023 to $60 billion in 2025 (Juniper Research). The analogy to catastrophe risk holds precisely: just as a single hurricane produces simultaneous property claims across one geography, a single compromised software dependency can produce simultaneous business interruption claims across thousands of policyholders with no other common characteristic.

05 — Where Models Break

Four structural failures in current underwriting practice

The combination of rising frequency, amplified severity and growing correlation creates specific structural failures in how cyber risk is priced and managed. These are evidenced in claims experience and in the supervisory priorities of the FCA, EBA and SEC — all of which have flagged AI-enabled cyber as a priority issue for 2026.

Attribution risk is the most legally complex failure. Nation-states are deploying criminal-style ransomware tooling, and criminal actors are being used as proxies, blurring the line between geopolitical acts and commercial cybercrime. Standard war exclusion clauses were not drafted for this hybrid environment. The legal and claims exposure for insurers writing affected policyholders remains genuinely uncertain.

06 — Strategic Implications

Four decisions for insurance leadership

07 — Conclusion

The new cyber equation

Cyber risk has not fundamentally changed in nature. The attacks dominating loss data today use the same methods that dominated it a decade ago: stolen credentials, unpatched systems, human error. That is, in one sense, reassuring — sound cyber hygiene remains the most effective risk management tool available to policyholders, and underwriters can still assess risk quality through controls-based frameworks.

What has changed, materially and with increasing speed, is scale, economics and correlation. AI has industrialised attack operations, removed skill barriers, and multiplied the number of active actors. Shared digital infrastructure means that single failure points now produce correlated losses across thousands of policyholders simultaneously. And the capability trajectory of frontier AI points to continued compression of the window in which current assumptions remain valid.

The question posed at the outset — whether frontier AI capability represents a step change in the risk landscape — has a clear answer in the data: yes, in economics and correlation, if not yet in the fundamental nature of the attacks themselves. What that requires of underwriting, pricing and accumulation management is equally clear. The question is pace.