A chapter from my upcoming book examines cyber security and how AI impacts risks. AI does not substantive change the cyber security equation. It does require that we accept the reality of cyber security.
Every single American is owed one thing by every single publicly traded company: They must conduct themselves in a law abiding manner. No company has the right to engage in criminal activities. Any reasonable examination of ransomware insurance reveals the normalization of felonious activities.
Cyber security is a topic that has come up frequently in the discussion of artificial intelligence. Cyber security, like artificial intelligence, is a very poorly understood subject. It is something that, like AI, has created a great deal of banter from non-experts about doom scenarios. What makes cyber security different is that the lack of understanding is not related to any inherent complexity or unfamiliarity. Cyber security is one of the most straightforward pursuits. The confusion around it is completely artificial.
The primary way in which AI changes the cyber security threat landscape is that it enables malicious actors to automate attacks in new ways and it removes previous barriers to hacking. Many attackers are located in foreign countries, but AI removes the language barrier. Attackers may need to survey many systems to find a weakness, but AI can do that automatically. Finding bugs in software code is a task that requires expert human review, but AI can find bugs without needing an expert.
AI doesn’t only speed up and automate cyber-attacks. It makes new forms of cyber attack possible. With AI it’s possible to create more diverse code than could be generated with human programmers. AI allows for exploits to be discovered and taken advantage of in ways that can’t be easily remedied. It can perform the kind of deep analysis that would be impractical with only humans.
One of the most important aspects of modern AI is its ability to process conversational, written and human communications. It does not only interface with technical systems and commands. AI can parse huge amounts of copy, looking for useful information about targets. It can be used to aid in open-source intelligence. It can also be used in direct social engineering attacks, creating phishing messages and even engaging in two-way communications with end users, completely on its own. It also complicates identity due to deep fakes and voice cloning.
There is another side to this. AI can also be used to enhance cyber security, and there are many AI cyber products on the market. Of course, part of this is branding, but there is an enormous potential to improve cyber security defenses, responses and evaluation.
Some have said that AI is the end of cyber security, as we know it. That may very well be true. That’s not necessarily a bad thing either. Cyber security, as it now exists, is barely economically sustainable. The levels of economic loss from cyber security incidents are staggering. The problem is that, if cyber security losses increase substantially, they will begin to cross the threshold of being truly economically unsustainable.
Cybercrime already carries an enormous economic cost. Cybersecurity Ventures projected worldwide cybercrime costs of $10.5 trillion in 2025, including stolen money, lost productivity, business disruption, intellectual property theft and the expense of recovering from attacks. The FBI’s Internet Crime Complaint Center received more than one million complaints in 2025, reporting $20.9 billion in losses, an increase of 26 percent over the previous year.1 These reported losses do not capture the full economic damage, including many costs associated with interrupted operations and recovery.
The amount of money lost to cybercrime is staggering. It’s a huge invisible tax we all pay. Cyber-attacks have cost so much, at more than ten trillion a year, that they have become a driving force of inflation. The cost is redistributed in the form of insurance premiums, taxes, interest rates and other economic losses. That’s why it is not easily visible. Hospitals are under constant cyber-attack, something that would not have been tolerated at one time. The cost to healthcare has been enormous. It is one reason why healthcare inflation is so hard to keep in check.
Cyber-attacks are driven primarily by ransomware. Ransomware has hit thousands of small businesses. It has compromised the information of millions of Americans. It has taken out large companies, costing billions, as well as small towns and emergency services. Worst of all, ransomware is constantly being used to attack the American hospital system. In 2024, Change Healthcare, part of United Healthcare was hacked by a ransomware gang and taken offline for more than a month.2 Millions of Americans could not get their prescriptions. Clinics went unpaid, and financial losses measured in the hundreds of billions.
Cyber security does not just protect companies from losing money. It is also a vital part of national defence. Cyber-attacks can compromise secrets, shut down systems and be used in hybrid attacks against infrastructure. Concerns have been raised over water systems and other vital infrastructure.3
Current losses are almost unsustainable as is. If AI based cyber-attacks raise the losses much higher, then the system may begin to buckle under the losses.
Surprisingly, and contrary to popular belief, it’s not at all inevitable that cyber losses be high. The current situation, with all its trillions in losses, is entirely artificial and could be fixed with policy changes. AI may finally drive the change.
Continue reading



