A chapter from my upcoming book examines cyber security and how AI impacts risks. AI does not substantive change the cyber security equation. It does require that we accept the reality of cyber security.
Every single American is owed one thing by every single publicly traded company: They must conduct themselves in a law abiding manner. No company has the right to engage in criminal activities. Any reasonable examination of ransomware insurance reveals the normalization of felonious activities.
Cyber security is a topic that has come up frequently in the discussion of artificial intelligence. Cyber security, like artificial intelligence, is a very poorly understood subject. It is something that, like AI, has created a great deal of banter from non-experts about doom scenarios. What makes cyber security different is that the lack of understanding is not related to any inherent complexity or unfamiliarity. Cyber security is one of the most straightforward pursuits. The confusion around it is completely artificial.
The primary way in which AI changes the cyber security threat landscape is that it enables malicious actors to automate attacks in new ways and it removes previous barriers to hacking. Many attackers are located in foreign countries, but AI removes the language barrier. Attackers may need to survey many systems to find a weakness, but AI can do that automatically. Finding bugs in software code is a task that requires expert human review, but AI can find bugs without needing an expert.
AI doesn’t only speed up and automate cyber-attacks. It makes new forms of cyber attack possible. With AI it’s possible to create more diverse code than could be generated with human programmers. AI allows for exploits to be discovered and taken advantage of in ways that can’t be easily remedied. It can perform the kind of deep analysis that would be impractical with only humans.
One of the most important aspects of modern AI is its ability to process conversational, written and human communications. It does not only interface with technical systems and commands. AI can parse huge amounts of copy, looking for useful information about targets. It can be used to aid in open-source intelligence. It can also be used in direct social engineering attacks, creating phishing messages and even engaging in two-way communications with end users, completely on its own. It also complicates identity due to deep fakes and voice cloning.
There is another side to this. AI can also be used to enhance cyber security, and there are many AI cyber products on the market. Of course, part of this is branding, but there is an enormous potential to improve cyber security defenses, responses and evaluation.
Some have said that AI is the end of cyber security, as we know it. That may very well be true. That’s not necessarily a bad thing either. Cyber security, as it now exists, is barely economically sustainable. The levels of economic loss from cyber security incidents are staggering. The problem is that, if cyber security losses increase substantially, they will begin to cross the threshold of being truly economically unsustainable.
Cybercrime already carries an enormous economic cost. Cybersecurity Ventures projected worldwide cybercrime costs of $10.5 trillion in 2025, including stolen money, lost productivity, business disruption, intellectual property theft and the expense of recovering from attacks. The FBI’s Internet Crime Complaint Center received more than one million complaints in 2025, reporting $20.9 billion in losses, an increase of 26 percent over the previous year.1 These reported losses do not capture the full economic damage, including many costs associated with interrupted operations and recovery.
The amount of money lost to cybercrime is staggering. It’s a huge invisible tax we all pay. Cyber-attacks have cost so much, at more than ten trillion a year, that they have become a driving force of inflation. The cost is redistributed in the form of insurance premiums, taxes, interest rates and other economic losses. That’s why it is not easily visible. Hospitals are under constant cyber-attack, something that would not have been tolerated at one time. The cost to healthcare has been enormous. It is one reason why healthcare inflation is so hard to keep in check.
Cyber-attacks are driven primarily by ransomware. Ransomware has hit thousands of small businesses. It has compromised the information of millions of Americans. It has taken out large companies, costing billions, as well as small towns and emergency services. Worst of all, ransomware is constantly being used to attack the American hospital system. In 2024, Change Healthcare, part of United Healthcare was hacked by a ransomware gang and taken offline for more than a month.2 Millions of Americans could not get their prescriptions. Clinics went unpaid, and financial losses measured in the hundreds of billions.
Cyber security does not just protect companies from losing money. It is also a vital part of national defence. Cyber-attacks can compromise secrets, shut down systems and be used in hybrid attacks against infrastructure. Concerns have been raised over water systems and other vital infrastructure.3
Current losses are almost unsustainable as is. If AI based cyber-attacks raise the losses much higher, then the system may begin to buckle under the losses.
Surprisingly, and contrary to popular belief, it’s not at all inevitable that cyber losses be high. The current situation, with all its trillions in losses, is entirely artificial and could be fixed with policy changes. AI may finally drive the change.
How Cyber Security Works and Why Bad Things Happen
Cyber security is a straightforward and results-based pursuit. The primary job, in cyber security, is to avoid being hacked. Of course, there is more to it than that. There is also systems reliability and certification of risk. There is compliance management, insider threat management, and business continuity planning. However, the primary and defining quality is that cyber security is the method of protecting IT systems from malicious use or intrusion, in the same way that physical security protects buildings and facilities.
It’s important to keep in mind that cyber security is security. This is something that many forget, because the field is portrayed as being tech-centered. In fact, cyber security is largely administrative. It is a risk management function. The fact that it is security is also important, because the security world has its own rules and conventions. Security professionals are frequently more personally invested in their work than others. They are the ones who will be there, after hours, during an emergency. They have to deal with emotional people, criminal intent, investigations, rules of evidence, incident response and other things that many would struggle with.
The biggest mistake in cyber security is to not understand it for what it is, a serious security obligation and a critical safety control. It’s not the kind of thing that anyone with an IT background should be dropped into. It does require engagement and respect from leadership. Security should never need to justify its own existence, and does not exist to generate a profit. The reason we have so many problems in cyber security is that companies do not understand what it is, the economy has not integrated it and it’s not standardized.
That’s primarily because of cyber insurance. It’s not just insurance. An insistence by finance and policy experts that it’s too complicated for their brains to comprehend is another problem. However, because insurance underwriting provides the financial foundation of risk management, this is where the problem is and where the system has stalled.
The primary reason that cyber security events happen is account takeover. This accounts for approximately 90% of cyber security intrusions. This is almost self-evident. Secure systems require a login. Privileged individuals have access to these accounts, so stealing their login info is how it works. Sometimes it’s not a person. It’s also possible to hijack machine and service accounts.
The reason this happens is that most accounts are protected by passwords. This makes it easy, because passwords are easy to steal. Because passwords are hard to remember, people use the same password for everything. This means that if a person has their password stolen once, it probably can be used for many accounts. There are billions of passwords that have already been compromised and are available on login lists that criminals exchange. Some passwords are common. If you try all the logins for a company and use common passwords, you’ll probably get in. Passwords can be cracked, stolen, guessed. They are absolutely not secure.
Complex password rules do not work. They result in people using easily guessed tricks like adding the year to their password. Frequent password rotation does not work.4 It results in people forgetting their password, reusing passwords or writing their password down. This brings up yet another problem with passwords: they are very easy to forget and people lose access to their accounts all the time. Because proper account recovery can be difficult, many sites and organizations resort to extremely insecure recovery options. They may use an external email. Some use the notorious questions like “Who was your favorite teacher?”
It’s simply not possible to achieve adequate system security with passwords. They create the illusion of security. They create bad behaviour. They cause friction. It’s just not possible to get to solid security in password-based systems. Passwords should not simply be augmented; they should be fully deprecated. This is the current mature thinking in cyber security. Doing so would end most hacking, but there’s no central way of enforcing or even encouraging this. Many standards require more than a password. The sharpness of the teeth on the enforcement of these standards depends on the circumstances.
Multi factor authentication is the primary way that passwords are augmented. It can work well, if it is implemented properly. It only sometimes is. A familiar form of MFA asks for a code from your phone. If all accounts have MFA fully required, from day one, and if that MFA is implemented on securely managed phones, with an approved app, it is reasonably secure. The problem is it’s frequently implemented in a corner-cutting manner. This is not always the case. Organizations that value security sometimes have a whole identity provider, with hardware management and account monitoring.
MFA is frequently very weak. There may be an opt out option. It may allow the use of non-secure personal phones. It may use text messaging, rather than an app. Text messages are not regarded as secure. There are a number of ways they can be intercepted. MFA often has account recovery options that are very weak or rely on other accounts, which may not be secure. Many accounts allow recovery with a master e-mail address. That e-mail may not itself be secure.
Another major problem is administrators turning off MFA for their own accounts. This is a notorious problem. People hate having to dig into their pocket and bother with their phone for every login. It’s not uncommon for people to have a sense of immunity or being too smart to be hacked. This is especially common in administrators. IT workers are not cyber professionals, but many think they are. The lack of oversight and enforcement is what causes this problem.
The other reason that cyber-attacks are so common is out of date, unmaintained, zombie systems and wrongly configured infrastructure. Most of the time, the problem is boneheadedly simple. It’s not uncommon at all for catastrophically insecure systems to sit for years without being noticed. There are numerous reports of secret information or customer lists being accessible online without any login and going unnoticed. There are millions of devices with the password left “admin.”
Ancient equipment can remain in service for years, even when it is well established that it is obsolete and no longer supported. As in any safety-critical industry, when a piece of technology is no longer certified as safe by its manufacturer, it must be either taken out of service or placed under special administrative controls to assure safety. This is not standardized or enforceable in cyber security. There’s no external regulator or stakeholder, most of the time. If a company wants to use Windows XP machines, nobody will tell them not to. There are untold non-secure systems still in service and nothing can be done about this.
Most cyber-attacks would be stopped if systems were kept up to date and properly configured. Updates are critical because new vulnerabilities are discovered and new forms of malware are developed. It’s also critical to have basic protections in place. All enterprise connections should be firewalled. All remote logins should be encrypted. All critical files should be backed up. Backup procedures need to be reviewed and tested.5 Some organizations do this. Many don’t. Most are inconsistent.
When it comes to standards and enforceability for cyber security products and IT services, there’s also a massive vacuum. There are standards and certifications, but they are usually optional and are often self-certified. The fact that a product says it complies with HIPAA regulations or is GDPR compliant does not mean that it has been extensively tested against rigorous standards by a third party. Code reviews, audits, stress tests and other best practices are generally done by the product developer on their own, without external enforcement. There are rarely any consequences for not meeting standards. Most of the standards are enforced by the due diligence of clients. For example, SOC (System and Organization Controls) reports are part of the security world and can help document security controls. They only work if clients actually read them and demand good controls. Few do.
The reason that there are so many flaws discovered in software is not something that is just inherent to code. The problem is a lack of any enforceable testing, validation or certification. There are no consequences to shipping code with software bugs. Many developers think of software bugs as something they can just patch later. The sector values speed and rarely does buggy software have business consequences. This is why there are sometimes catastrophic software flaws discovered months or years after release. They would not have been there to begin with, in most circumstances, had the code been carefully tested and reviewed.
When a critical vulnerability is discovered, a patch is usually released. How to apply the patch, the verification of update and any other mitigating activities are the responsibility of the end user or organization. Some organizations do a terrible job at patch management. There are systems that sit unpatched for years.
There is also a catastrophic lack of monitoring and oversight in cyber security. Most cyber controls and frameworks are based on reporting and accountability, because that’s the key to good security. The reason a system is not secure is usually reducible to lack of ownership of the security.
Most intrusions, most hacks, most ransomware do not happen instantly. First, an account is compromised, then an attacker scopes the infrastructure, then moves laterally. The dwell time can be several days. Some accounts are hacked and monitored for months. This is often the case with “business email compromise.” It’s ridiculous that this would happen to high profile accounts, but it does. The problem here comes down to lack of vigilance. If organizations actively monitored their systems for signs of trouble, nearly all ransomware would be stopped. Most don’t. It’s not uncommon for intrusion detection systems to be turned off, because nobody wants to deal with the alerts.
An example of how ridiculous the cyber security world has gotten is the fact that most ransomware attacks use a protocol called RDP to move laterally. Most corporate networks allow RDP. RDP is a flawed secure protocol that was identified as non-secure and in need of deprecation many years ago. There’s no way of enforcing or assuring this happens.
The biggest problem with lack of enforceability in cyber security is that organizations are connected and a hack does not need to start at one organization. Third party risk is a very real part of the landscape. The lack of any collective enforcement or foundational baseline for security makes this a huge problem. No matter how good the security is at an organization, there may be a partner contractor or third party who can access their systems or has their private information.
The real issue in cyber security comes down to a lack of any authority, stakeholdership or value seen in the field. Cyber security is enforced and achieved the same way any type of complex technical or business compliance is: with tests and certifications, inspections, audits, oversight and standard enforcement. The problem is that other fields have some level of authority or enforceability. There are fire protection standards and fire marshals. There are certified aviation inspectors, building inspectors and enforceable standards for electrical and industrial safety. Cyber security lacks any of these mandates. That’s why the losses are so high.
Cyber Security Does, in Fact, Work
You could be forgiven for thinking nobody understands cyber security, that attacks are inevitable and that cyber security professionals are basically children trying to figure things out. You might think every cyber professional is just starting out, that the field lacks any grounding in understanding of the subject. You might also believe that foreign criminals are simply too smart to take on. This is the result of a PR war that has been mounted against cyber professionals, primarily by insurance executives, who have attacked the legitimacy of the field, insulted its practitioners and installed themselves as experts in something they have no gumption over.
One of the important things in security is mindset. It’s important not to flinch in the face of attack and to always be committed to protecting organizations and people. Extortion thrives on fear and appeasement.
The fact that cyber security actually does work is self-evident when you know where to look. The one sector that took security seriously from day one is banking. As soon as mainframes were installed in the 1950s, they were fully automated and secure. Banking is the one sector that actually does have full mandates for security, auditing and oversight. This is why banks don’t get hacked. You may occasionally hear of a bank’s secondary systems or cloud infrastructure being hacked. The primary account systems, however, are extremely secure. The same is true of the Federal Reserve. It’s one of the only parts of the government that is truly cyber secure.
There are also extremely secure technologies, which can stop many attacks, if they are deployed. The account access login problem can be solved. The technology exists. There are multiple ways to secure an account without passwords. Passkeys are one of the best methods. A passkey uses public-key cryptography to authenticate an account without sending a shared password.6 Unlike a password, it’s not easily intercepted. Passkeys can be implemented several ways. One of the best is to use a hardware device, such as a USB dongle. Not only is it effective, but the implementation is simple and people prefer it to using phones and passwords.
Security keys like this one solve many of the login and account management problems.7 When implemented properly, it’s theoretically impossible to break into the account. The mathematics is believed to be airtight against any attack, with the exception of a future hypothetical quantum computer. Even that possibility is addressed in the next edition of the technology.
Keys of this type have a high user acceptance. People prefer them to easily lost passwords and their use is simple and familiar. The roadblock to adoption is standardization and incentivization. Many platforms now support this type of login, but the implementation is inconsistent. There has also been very little in the way of public outreach or advocacy.
Implementing passkeys universally would all but eliminate the account takeover problem. Google reported no confirmed employee account takeovers due to password phishing after it required security keys.9 Nobody is willing to take the lead on this, unfortunately. There are sites and organizations that support passkeys, but the rollout has been inconsistent. Some sites fully support passkeys. Some support it as a secondary login option. Sometimes the option is buried.
There are other measures which, if implemented, could result in enormous savings as well. Backing up data is one of the most fundamental. Data backups are the core of resilient IT. You do not need to be an expert to realize that it’s good to have a copy of important data kept in a secure place. The problem is that data backups are not enforced and most organizations do them poorly or not at all. Many assume their system is backing up the data somewhere, when it is not. When backups exist at all, they are rarely of the best quality and security.
There are examples of cyber security being implemented and things improving dramatically. One of the best examples is in the credit card processing sector. Prior to 2004, there were no universally enforceable standards for charge card processing. The major card brands introduced the Payment Card Industry Data Security Standard, or PCI DSS, in 2004. PCI DSS is the most successful standard for cyber loss control, and over two decades it has saved hundreds of billions.
Prior to the standard, the hardware and software used to process credit cards was non-standard and diverse. Merchants and processors used all kinds of terminals, some very old, to process credit and debit cards. Security was ad hoc. Some credit cards, like American Express, enforced security standards and others did not. The reason PCI DSS became necessary is that by the late 1990s, hacks resulting in credit card fraud were so bad that raising interest rates could no longer cover the losses.
Verizon’s 2017 report found that none of the organizations whose payment-card breaches it investigated over the preceding twelve years had been fully compliant when breached.10 Compliance is designed to be easy for small merchants. Enforcement and certification infrastructure exists. Banks and credit card processors frequently provide complimentary security advisory services. Hardware is independently tested.
PCI DSS is not perfect. Hacks still happen, but rarely. Most of the time, the reason a hack happens is because of a lapse in the PCI DSS compliance management. Perhaps most shockingly, PCI DSS is maintained without drama and bitching and moaning. You rarely hear about it. Executives don’t constantly try to cut it or complain about it. You won’t hear Warren Buffett denounce people who work in PCI DSS as being unworthy of respect. Nobody is putting on entire conferences of insurance underwriters to lie to people that it does not work and there is no data.
Like any security, it operates and does its thing. It works because it is allowed to. The people who oversee PCI DSS generally conduct themselves as adults. This is much different than other sectors.
There is yet another problem that cyber security has, which matters a lot. That is the lack of pragmatic lobbying and policy engagement. Laws and regulations play a huge role in cyber security. Another important part is public dialog. Most companies do not understand that having a data breach does not mean they will be in trouble in all circumstances. Most small organizations that experience a data breach, despite operating in good faith, do not face serious legal consequences. Nobody knows this because public officials don’t mention it.
This is not a minor thing. It’s enormous. It’s one of the major reasons we can’t improve things in terms of cyber security losses.
Cyber security laws are rarely effective because they are not designed by people who understand the system. The way ransomware is handled is a legal question that requires stronger answers. There are numerous legal problems.
Here again, insurance really is the problem. Typically insurance companies are pro-safety forces in political action. Insurers have fought for better fire codes, requirements of certifications, highway standards and other safety protocols. In this case, they are doing the opposite and are deep pocketed organizations. Insurers have testified to congress that ransomware is unstoppable, while begging for government help.
This is not normal. Most safety sectors don’t get this kind of public treatment. The reason is that insurance executives are about the most thin, spineless and stupid people you will ever encounter. At one time, insurance was based on the idea of risk expertise, risk transfer and financial solvency.
The problem occurred because the insurance sector was successful in accomplishing the hard problems of making cars, homes and workplaces safer. After that, most of their expert staff was laid off. Insurance, at one time, had a deeply held duty of care to policyholders and a sense of fortitude and confidence. It was unique in the private sector for its compassion. That’s all gone. Today insurance executives come from places like private equity. They are completely driven by the stupidest, shallowest greed. They don’t care one iota that a hurricane hit people, but gripe about how much it will cost them.
How AI Changes Things
It doesn’t. Not fundamentally. However, what AI does do is make attackers more potent and hacks easier and faster. In principle, there’s nothing AI can do that an expert hacker can’t. AI can do it much faster, however, and it’s far easier to find AI than to recruit an actual skilled person.
Much of the work of an attacker is labor intensive. The process of scanning the internet for vulnerable targets, researching their internals, probing their systems and deploying malicious payloads can be fully automated by AI, even when that task involves verbal information. That’s huge, because while attacks have been partially automated for years, the ability to deal with arbitrary text and navigate complex sites and systems is a capability AI brings that did not previously exist.
AI has already been used in this capacity, and it’s one reason why attacks have gone up. The impact has been measurable but not overwhelming. The main reason for this is that AI did not really change the fact that so many systems are easy to get into. Even before AI, automation was taking on much of the attack work. Because systems are so weak, powerful AI is rarely necessary. Most hacks are ransomware and gangs are opportunists. The system is a cash cow as is and well optimized.
AI can also audit the software itself. It can examine source code, follow how information moves through a program and look for mistakes in memory handling, input validation, permissions and application logic. Connected to testing tools, it can generate test cases, run them and use the results to investigate suspected weaknesses. The process of manually auditing and reviewing software is extremely time consuming, especially with large software packages. AI has made levels of code review and testing feasible that were previously not.
AI has already found previously unknown vulnerabilities in mature software that had been used and examined for decades. In 2026, Anthropic reported that Claude Mythos Preview uncovered a 27-year-old flaw in OpenBSD, a 17-year-old flaw in FreeBSD’s network file server, and a 16-year-old flaw in FFmpeg, a widely used multimedia processing library.11 These included weaknesses that could allow an attacker to remotely crash an OpenBSD system or take control of an affected FreeBSD server. Applying AI systematically has also produced substantial numbers of findings within individual projects.
This really isn’t surprising. New security vulnerabilities are found in old software all the time. Most code has never been extensively reviewed, audited and checked. Open-source software does not have the same ownership and accountability as proprietary software, so there may not be anyone to fix security problems. Secure coding standards have had poor adoption and enforcement. It has always been very shoddy. This is why even old and well-regarded software can have critical security issues.
The ability of AI models to find bugs and security vulnerabilities in software is one of its most powerful capabilities. Because AI does not complain about tedious work, it can test software more exhaustively than human subjects. There has been much concern over this capability. It’s a double-edged sword that exists with many security and evaluation tools.
The same tools that defenders use to test, evaluate and probe systems can be used by malicious actors to exploit them. Many cyber tool makers have been accused of creating weapons and some cyber software is restricted. In general, the prevailing feeling is that creating security tools for law abiding companies helps, because hackers will just exploit the systems with their own tools, regardless. With models, there is only so much restrictions can do, since some open-source models are highly capable.
Anthropic considered these capabilities significant enough to restrict access to Claude Mythos Preview. When it announced the model in April 2026, the company reported that it had identified thousands of previously unknown vulnerabilities across major operating systems, browsers and other software. It could also develop working exploits for some of those weaknesses. Citing the potential for misuse, Anthropic withheld the model from general release and provided access through Project Glasswing to selected companies and organizations.12
Mythos received enormous alarmist press over its capabilities. In fact, although highly capable, it does not change the fundamentals of cyber security. No tool, regardless of how sophisticated, can hack a system unless a vulnerability already exists. The fact that Mythos has found so many pre-existing flaws is not all that surprising, but it is unsettling.
Fraud, Deep Fakes and Identity
A capability of AI with obvious cyber security implications is the ability to create convincing content, including deep fakes of real people. The use of AI in fraud is sometimes classified as a cybercrime and sometimes not. Some types of fraud are fully non-technical: they may involve persuading someone to send money or reveal their credit card number. In cyber security social engineering remains a potent attack vector.13 Many of the worst cyber-attacks started by tricking a privileged person with a fake e-mail link.
AI has revolutionized phishing, which has always been one of the top problems in cyber security. Phishing is the process of sending fake e-mails to gain info or access.
In the past, users were warned to look out for poor spelling, bad grammar, strange phrasing or broken graphics in phishing e-mails. This could work, because many of the attackers were not native English speakers and some were not familiar with professional e-mail styles and phrasing. AI has changed this completely. Generative AI removes all cultural and language barriers. It can generate any type of e-mail or attachment.
Because of generative AI, the profile of phishing has changed significantly. Phishing messages are now extremely convincing. They often look perfect. They have also taken on a greater level of sophistication. Some impersonate professionals, IT alerts, friends and family and promotional offers. Almost any way of tricking a person into revealing information or enabling a login has been tried and some are very successful.
Variations on phishing include smishing (text messages) and vishing (voice) as well as messages that may be sent on Microsoft Teams and other communications systems. All of these have risen significantly with the advent of AI. This is also where the ability of AI to clone voices and appearances is especially useful. AI models can clone voices from a single sample. There have already been attacks that exploit this. The familiar voice of an IT assistant or even the CEO is powerful in getting people to comply. Attackers are bold. They don’t mind making phone calls.
Fraud existed long before cybercrime. When it happens online, it may be considered cybercrime, but the dynamics are not new. There are a huge number of ways one can defraud someone. Many take a great deal of time and skill. AI makes that all a great deal easier and faster. This is especially true for fraud that involves faking various types of paperwork and notices. Invoice fraud is one of the most common. It involves sending fake invoices or bills to a company, sometimes posing as a legitimate vendor. AI excels at generating this kind of content, so it’s increased the problem dramatically.
The direct use of deep fakes in fraud is especially unsettling. Using the voice of a loved one is one of the most deceptive ways this can happen. Most deep fake scams are purely audio, but occasionally video has been used too, which makes it extremely persuasive. Reports of attacks against the elderly have risen. Some involve calls or messages that involve their children or grandchildren urgently needing help.
There have been concerns of a “fraud apocalypse” due to AI. This hasn’t quite happened yet, although fraud is on the rise. There are ways of fighting fraud, of course, and many will need to be increased in usage. KYC (know your customer) is one important aspect, and it is even more important in the era of AI. There are also banking and financial protections that can catch fraud, reverse transactions or send suspicious transfers to escrow. All of these measures can be effective against different types of fraud. Behaviour and expectations will need to change too and that will take time.
The worst thing we can do is accept high levels of fraud and redistribute the cost.
The Problem with E-mail
Have you tried e-mailing someone you didn’t already know recently? Did they respond? Of course not. You have no idea if they even saw the e-mail. Did it go into the spam folder or a black hole? Maybe they forgot?
It was not always this way. It used to be possible to contact people. At one time, it was not necessary to try to figure out their e-mail, track them down on LinkedIn, search for their social media and possibly resort to snail mail in an attempt to get through. Now it’s impossible.
At one time, e-mail was a human-to-human communication medium. The number of messages was manageable. Most messages meant that a person had intentionally reached out for a reason and wanted to say something. That gradually changed over time, and now e-mail and most communications are useless in making contact.
Part of the reason for this is the endless machine e-mails that are sent to inboxes. Spam is one thing, and there still is a lot, but spam is defined as unsolicited marketing e-mail. Much of the junk that ends up in inboxes, cluttering the communication channel and making everything difficult, is not technically spam. It includes bills, license updates, IT notices, newsletters, promotions, terms of service. It’s a horrible deluge of paperwork nobody asked for.
Then there is actual phishing, which in addition to being a security problem is a problem for communications. The increase in phishing has necessitated aggressive defences. E-mail boxes, especially corporate e-mail accounts, are heavily filtered. It’s difficult to know what criteria may be for the filtering. Some systems block all e-mail containing a link or an attachment, or sent from a free provider. Some just block any e-mail from an unknown source.
You never know if your message was blocked completely, flagged or if the recipient ignored it. They may have been suspicious of it. Maybe they didn’t notice.
On the organizational side, things are not much better. Some organizations often receive external e-mails. For example, law firms often receive a great number of communications from courts, clients and opposing counsel. Many of these messages contain links and attachments.
It’s not uncommon at all for messages to be incorrectly marked as phishing or spam. Some are also marked as suspicious or sent to a secondary inbox. The process of reviewing these messages, to avoid blocking important communications, is an ongoing and labour-intensive process. AI may be able to help here, but it can only do so much.
This is a huge and undiscussed problem for society. The loss of the ability to contact people at organizations means we have lost one of the most important safety checks out there. If you know there is a danger, you can’t tell anyone. It’s vital that members of the public have a way of contacting corporate leadership, even if indirectly, but this no longer exists as it once did.
AI has not caused the problem, but it has made things worse.
There have been a number of proposals to solve this problem, but none have had the support needed to implement them. Proposed solutions include a closed ecosystem of verified human-owned accounts. Other proposals include building industry-specific communications networks. It’s also possible that AI itself may be able to help alleviate this problem by better managing messages and communications.
How Insurance Caused the Cyber Security Crisis
Cyber security is currently a bloodbath. Organizations are being hacked constantly. Billions are lost every year, with little done to reduce the problem. Cyber professionals have extremely poor job security and are not valued. Policies are poorly enforced, almost universally. Attacks are constant.
None of this was inevitable. It was caused by a series of bad decisions and coverups. The actions by American insurance companies may be some of the worst cases of corporate criminality in American history. That’s no exaggeration! These and other companies have managed to cause so much economic harm, and have engaged in such deceitful activities, it likely constitutes a crime much larger than Enron. It may very well be extremely entertaining, if authorities ever do fully investigate what they have been up to for several years.
Cyber insurance coverage has resulted in a massive increase in cybercrime and has decimated the cyber defenses of the US. The reason is that it broke economic incentives and transferred ownership of the risk to people who were afraid of it. Initially, insurers saw an easy specialty line. When things started going badly, many panicked. The underwriters who ran these lines never understood what they were doing.
State attorneys general’s offices have been slow to recognize this effect. The federal government has done almost nothing. Perhaps most shockingly, the National Association of Insurance Commissioners is fully aware of the losses that cyber insurance companies have endured and can’t be convinced that it’s not normal to lose massive amounts to cyber security. Because the world thinks cyber is complicated, insurance companies have gotten away with felonious activities.
To understand how we got into such a terrible situation, it’s important to understand where cyber security started out. Although high levels of security always existed in banks and government institutions, most early personal computers had almost no security at all. This was not a problem, because most were not networked and work was local, so locking the office was enough. As computers continued to be deployed, security remained extremely lax.
By the 1990s, most administrative offices were being computerized. This is when internet connections started to become common. At the time, nearly all accounts and systems were secured with only a password. Even then, security was extremely lax. It was relatively easy to hack most systems in the 1990s and nobody really cared to do anything about it. Few resources and important accounts were online. Computers were not connected constantly and required dialup access.
Many organizations could have been hacked, but there was no way of making money by doing so. Hacking a small clinic, law office or municipality offered almost no reward. Most hacking was focused on credit card terminals.
In the late 1990s, AIG began selling cyber security insurance. The insurance was offered as a special rider: a type of add-on insurance for special purposes. It was low cost and had no requirements at all. They were, at the time, warned about this, but chose not to listen. The policies were cheap and losses were extremely low, so the company got used to easy profit. At the time, the losses from a cyber-attack were not fully understood and standardized. The policy was structured as business interruption insurance. It anticipated that being hacked meant being offline.
The line was profitable through the early 2000s. Insurers became extremely complacent. They truly did not understand what cyber losses are, but they were low enough that they came out ahead. The directors of cyber insurance lines were all from an underwriting background. They had no qualifications at all to understand cyber security. However, over the course of several years they presented themselves as being capable of running the line. It seemed like they were competent. Money was coming in.
Nobody who worked in the cyber security insurance sector had any cyber background at all. Some of the underwriters began to present themselves as experts and still do. None had any clue at all what they were doing. This is extremely condemnable. It may even be criminal. What companies like AIG did is assume an underwriter must be smart enough to figure it out. They did not fulfill their duty to prevent their product from encouraging crime. Cybercrime is serious and professionals are required in high-risk situations. There is no excuse for the conduct of insurance carriers.
This idiotic bomb sat ticking until ransomware gave cyber criminals a reason to attack organizations en masse. This began to happen in the early 2010s. Crypto currency enabled it. It allowed criminals an easy channel for covert fund transfer. It’s really what made ransomware possible. The fact that more systems than ever were connected to the cloud also helped, but crypto currency is primarily what enabled the ransomware business model.
In the mid-2010s, criminal organizations began to deploy ransomware, at first against individual computers. Files were encrypted, making them unreadable and the criminal gangs, many located in Russia, would demand crypto payments, ranging from a few hundred dollars to a few thousand. This payment would purchase the key to decrypt and recover the files. Of course, computer systems that had their files backed up to an external system or media were immune. Early ransomware only encrypted files. The problem is that most people do not back up regularly. This is the kind of control that doesn’t happen without enforcement.
What the insurance companies did here is shocking. Absolutely shocking.
At insurers like AIG, claims staff began to quietly pay ransom while sweeping the records of this under the table. They would pay claims for a “data recovery fee.” Obviously, this is a very thinly veiled ransom payment. These were not reported to authorities and were done discreetly. They never made much attempt to avoid payment. In some cases, it may have been possible to recover files. They never tried.
As one would expect, the willingness to pay ransom made the crime wave explode. Insurers never cooperated with authorities. They never made any effort to understand the problem or control it. They actually used ransomware to sell more insurance. Losses increased. They raised premiums. Insurers would later claim there was nothing they could do. They sold policies, paid ransom, raised rates.
This application page from Hartford Steam Boiler illustrates the problems with cyber insurance. Notice that the requirements are only enforced through self-attestation. It’s obvious that the insurer wants you to check the boxes. It’s as obvious as “Do you do anything dangerous?” on a life insurance application.
These are too vague to be enforceable. What is training? What type of encryption? Do you have the receipts?
Real cyber security enforcement is done through a system of auditing and documentation.
When policy documents are this poorly written, it all but guarantees high losses. Why did this happen? Is it that they want to lose money? It’s not that simple. The tragedy here is that they understand it so poorly that they dug themselves into a hole they cannot get out of.
Those familiar with cyber security can immediately see all the problems here. The underwriters insist that this is an acceptable control for cyber, because they would look extremely bad if they had an actual expert review it. The fact that they exempt accounts under a certain size really shows how clueless they are.
Because they have no idea what they are doing, they are skewing into the idea of making sales easy to try to just underwrite their way out.
Of course, this will continue to fail badly. This application is from 2022. It’s not clear whether they have updated their policy requirements. This was inexcusable in 2022, however.
What’s most shocking here is that absolutely no effort whatsoever was made to end the crisis with loss control measures. Because early ransomware encrypted data, but normally did not exfiltrate it, if they had only required certified backups, the entire problem could have been ended. This is exactly the kind of measure insurers often require for technical insurance: compliance that policyholders often skimp on requires audits and automated enforcement. This is not new. Had insurers required that all systems have a virus checker, this would have also stopped a large portion of ransomware.
The reason they didn’t is that these lines were run by people who had no understanding at all of cyber security. It might seem like an obvious thing to institute backup requirements, but the underwriters who ran the lines were overwhelmed and extremely confused. One of the problems is they presented themselves to the carrier leadership as experts in cyber risk, which they absolutely were not. They made many excuses as the ransom losses rose and the lines became unprofitable. They truly had no idea what they were doing.
By the late 2010s, insurance executives complained that cyber was inevitably high loss. They said it was confusing, perplexing and that nobody understood it. A lie that is still told is “we don’t have data.” Cyber security has more data than any other form of loss and more ways of analyzing and understanding it. Insurance underwriters don’t understand this. They actively avoided ever letting a legitimate expert, who could have solved the whole problem, anywhere near it. They were desperate to save face. Everything about cyber losses being inevitable, unknown and difficult is completely untrue. It’s so untrue, shareholders could easily sue.
As the line began to lose money at insurers, they decided they had no idea what to do, so many ceded the line to a reinsurer. Ceding a line of insurance means paying a reinsurer to take on some or all the underwriting, typically paying a rate higher than estimated losses early in the year. Companies do this because it allows them to fully account and predict the losses. It effectively means throwing in the towel. Insurers, without even trying, decided they were going to lose money on this line. They wrote off the losses early on and just paid reinsurers to take on the line.
Executives at insurance companies would say cyber is hard. They would even say it might be uninsurable. Many called for a government bailout or a government backstop. They said it was necessary. They acted like the losses were inevitable.
This was all completely untrue. The problem was not a technical one at all. By normalizing ransom payments, assuring that many businesses could pay and making that the way business works, they created an extortion crisis. Had they made clients back up data or had they actually tried to recover, this could have been avoided. They just paid more, sold more and paid more.
This created a spiraling extortion crisis, because of course it did.
The only way to fight an extortion crisis is with fortitude. It’s critical that every effort is made to avoid paying ransom and fight back when you do. Insurers refused to do this.
This all might seem shocking, but it was part of a strange culture of denial and role separation in insurance companies. Insurers worked to keep cyber loss experts away from what they were doing, even as they lost so much money. They loudly stated they were doing their best. They continued to sell more of the insurance, trying to just underwrite the losses away. They continued to have no requirements at all. The insurance actually served to decrease incentives to back up data.
This table of cyber insurance loss ratios was published in Carrier Management in June, 2021. What is so amazing is that this was reported as if it was normal, unavoidable loss because the risk is difficult, lacks data and simply can’t be effectively controlled. To anyone who understands cyber security, losses like this are absolutely looney. This is a sign of having no idea what one is doing. Some of these lines paid out more than they took in! That kind of loss ratio on crime insurance is never excusable. Amazingly, the leadership of these companies seemed to think this was just fine. It has not resulted in the kind of loss control mandates you might expect. For some of these carriers, their losses may be as much as 99% greater than what they should be. That’s a huge problem if you are the one who decided this was an acceptable way to run things.
Carrier Management: https://www.carriermanagement.com/news/2021/06/07/221646.htm
One of the biggest questions that exists is to what extent the insurers worked directly with ransomware gangs. If they did, and there is very solid evidence that they did, then there could be some very serious jail time. There have been rumors and leaks. Evidence indicates that by the late 2010s, some insurance staff were in regular contact with ransomware gangs to discuss payment rates and restoration measures. Claims staff were not monitored and their finances not audited. It’s entirely possible claims staff were getting kickbacks. This has been suggested, but not proven. In fact, ransomware gangs have boasted about how many they have on their payroll. Ransomware negotiators also routinely get kickbacks.
Occasionally, claims staff and others have used phrases like “good criminals to work with” or “an easy gang to make deals with.” The intimacy of the relationships that grew here is strange and frightening. This is also where “professional negotiator” firms came in. The entire thing is a farce.
The way that ransom payments were normalized was simply to start making them, first under the table, and then just act like this was a normal mode of business operation all along. This was never normal and would not be permitted in any other circumstance. People seem to think cyber is just too exotic to understand.
This is a complete perversion of the protection insurance is supposed to provide. Cyber security insurance is the only type of insurance that pays ransom to criminals on a regular basis, as part of its normal mode of operations. The only other line of insurance that does pay ransom is kidnapping and ransom insurance. This form of insurance is for very specialized circumstances. It rarely pays ransom, because every effort is made not to. In a bad year, there may be a couple of payments. Cyber security insurance pays ransom constantly.
The payments are completely unmonitored. It’s very difficult to know exactly who the insurers are paying. There is no monitoring at all of communications. They are not required to publish or report to law enforcement. This has made it extremely difficult to understand and fight ransomware.
Insurers now tout their ransomware coverage. They promise they will pay fast and they act like reliable payment is a feature. Insurers do not offer resistance to payment as a feature. It’s understood and documented that ransomware gangs target insured organizations more. Ransomware gangs even provide an “insurance consulting” service to help victims get a claim processed fast. Ransomware gangs recommend certain insurers. It’s also been documented that ransomware gangs have offered to hack volunteering companies as a form of claims fraud. This entire world of negotiation and discussion is unmonitored. The process is not audited.
The major turning point was 2020–2021: ransomware losses surged, and insurers responded by sharply tightening underwriting.18 The disruption from COVID, increased work from home and more advanced ransomware caused the losses to explode by more than 50%. Some insurers posted loss ratios of 130% or more, meaning that they were paying out 130% of premiums. This is shockingly terrible. It indicates complete lack of any idea as to how to run the line. This was presented as normal. They acted like this wasn’t their fault.
It was not until 2022 that most insurers began to have any formal requirements at all for security on cyber lines of insurance. This is absolutely shocking, because it defies the most basic best practices. Had they only instituted verified backups early on, so much could have been avoided. At the time they were still bumbling, so they introduced only the most token requirements, which were barely visible in the policies and not proactively enforced. No country should tolerate its citizens and institutions being attacked.
THESE COLORS DO NOT RUN
Aon: 176 Marsh & McLennan: 295
That is how many died on September 11th 2001, at those two companies. Both are part of the ransomware financing ecosystem. These firms operate as brokerages and also in other capacities, such as data analytics and insurance services outsourcing and risk management. They have continued to favor risk transfer and ransom payments over preventative measures. They may very well be hiring off Craigslist.
Ransomware payments fund terrorism. Both the Iranian Islamic Jihad and Hezbollah are funded by ransomware. It also funds North Korea, though most attacks are against South Korea and Japan. It funds irregular pro-Russian forces fighting in Ukraine, and other Russian gangs. Putin has engaged in “Ransomware Diplomacy” where he provides the technology to regimes he supports.
Their risk modeling is also atrocious. Both companies are attempting to model cyber risks using traditional insurance methods of actuarial tables based on historic data. That will absolutely never work. Cyber risks are not fundamentally actuarial, meaning they are not well understood through historic trends and cannot be accurately modeled by extrapolating from established statistics.
Cyber risks do not operate in this manner, but thankfully there are much more accurate ways that risk can be assessed in cyber security. Quantified analysis can be conducted using system breakdowns, threat modeling, red teaming and analysis of the system. They seem to have no idea how to do this or even that this exists.
It has been often said of cyber insurance that “We do not have the data” because it is seen as new. This is completely false. In fact, fine grained data for attacks by type is available and there is a wealth of sources available.
It is possible to model risks with extreme precision in cyber security through auditing and inspecting of systems. The effectiveness of controls is extremely well established. The best practices have been well established and are known quantities. The MITRE ATT&CK framework allows for quantitative analysis of risks and controls with extreme precision.
Had cyber insurers brought in a legitimate cyber security expert to write the requirements, the losses could have ended right there. They didn’t. It seems that the “expert” underwriters assigned to this may not have wanted to allow anyone in who understood these things. The requirements were useless boilerplate.
Of course, this did not work because their clients did not have good compliance and were not familiar with what good compliance looked like. Had they provided a compliance help desk, easy to follow steps and additional guidance, the measures would have worked. Had they been extensive and properly written, they could have brought losses under control immediately.
Instead, the requirements did absolutely nothing, because nobody had their attention drawn to them and they were never enforced. At AIG, the leadership announced that they had attempted to institute requirements, and that they had been told these would be effective, but nothing happened. They said this was more proof that cyber was impossibly perplexing and nobody could figure it out.
Losses continued to spiral out of control throughout the 2020s, as they continue to today. The world of cyber insurance remains as absolutely insane as ever.
Over the years, carriers have instituted various policy requirements, but they tend to be extremely poor because they don’t understand what they are trying to do. Compliance management is difficult in cyber security. Most clients need a lot of guidance to begin with. They have no idea what they are doing.
There has also been a strange and toxic climate imposed by cyber security insurance. Cyber security tends to be extremely open, collaborative and supportive. Cyber insurance carriers have been extremely nasty to deal with, in a way most others in the ecosystem are not. They really do not know what they are doing and they still pretend that their standards are reasonable. Authorities think this is okay.
Cyber insurers openly and publicly act as if they have some kind of idea what they are doing. In the Insurance Journal and elsewhere, they write about the potential future outlook of the sector. They even give awards to cyber underwriters, as if they are doing a normal thing and an acceptable job.
They do not see the current status quo as a disaster. They think their conduct is normal and acceptable. It’s a strange thing to see.
Cyber security is security and needs properly certified professionals. Putting underwriters on a line dealing with cyber criminals was never acceptable. The cyber insurance world is so toxic, at this point, they are afraid of cyber professionals. There are two reasons: It would show how badly they are doing, and security professionals are generally not okay with letting criminals extort funds.
The Moral Crisis This Created
The proper term for the losses we are currently seeing in cyber security is moral crisis. Moral hazard occurs when protection from the consequences of a decision encourages someone to take greater risks or exercise less care, because another party bears some or all of the resulting cost. Insurance can create this problem by weakening the financial incentive to prevent losses.19 A moral crisis is when a moral hazard causes losses to grow out of control.
Cyber security insurance created a moral hazard. Failure to control it in any way created a moral crisis. Insurers complain about losing money on cyber. They created the entire problem. They attack the people who could easily help them.
This is not the first time something like this has happened. In the 1970s and 1980s, the insurance world ignored the losses on lines of workers compensation insurance. At the time, policing workplace safety seemed too expensive and complicated, so carriers didn’t bother. Workers’ compensation losses grew and grew, and insurers just took the hit.20 Eventually, it threatened the solvency of the industry.
The insurance sector had to spend tremendous money in the 1980s and 1990s to repair the system that they broke with bad incentives. The workers comp crisis wasn’t actually an insurance crisis: it was a workplace safety crisis. Eventually carriers had to spend billions on safety studies, subsidies, lobbying for better standards, training and other loss control measures. It worked and saved the industry from collapse.
One would think they’d have learned a lesson, because things will eventually get that bad if no effort is made to reduce losses. The moral hazard here is far worse than most losses, because it funds the crime directly. Extortion causes more extortion. That’s why it’s so important to do everything possible to fight it.
To a security professional, their conduct looks strange. When under attack, the typical move is to circle wagons and fight back. They don’t think that way.
The fact that insurance companies are resistant to working with cyber experts, unwilling to enforce loss control or invest in cyber risk analysis, has caused a severe stalemate in the adoption of cyber security measures.
One of the reasons that this has been so impossible to overcome is the sector’s near worship of Warren Buffett. In May 2024, at Berkshire Hathaway’s annual shareholder meeting, Ajit Jain, vice president of insurance said of cyber insurance “…no matter how much you charge, you should tell yourself that each time you write a cyber insurance policy, you’re losing money.”21 Absolutely ridiculous.
Buffett himself has said repeatedly that he believes nobody has figured out cyber, that he associates it with doomsday risks and so on. Buffett has said repeatedly that cyber has risks that can’t be predicted. He believes it’s an impossible risk to deal with. He could not be more wrong. He has never asked about this either, at least not to anyone who would know. He probably assumes he’d never understand.
It took many years and billions of dollars to fix. In the end, only an emergency surge of spending on workplace safety saved the sector from completely unsustainable losses.
These people are so frightened they can’t even think through the situation rationally. What kind of idiot talks that way when this is a form of crime insurance? Criminals don’t need to be told that you have decided it’s fine to lose money and have no intentions of resisting. That obviously emboldens them!
The reason this has caused such horrible problems for American cyber security is that, in a market economy, insurance often dictates how risk is assessed and managed in the private sector. Insurance is the economic force that makes risky behavior more expensive than safer behavior. That is supposed to encourage improved safety. It does when it actually works. It does not work unless insurers try to make it work.
If a risk is new or unregulated, then the private sector typically has not instituted standard baselines for safety and procedures to assure compliance. Somebody has to figure out what an acceptable universal standard is and how to enforce it. That’s typically the insurance sector. They are the only stakeholders with enough risk across sectors to be able to make sweeping decisions in terms of the enforcement of risk management baselines.
When first starting out, it’s usually the insurance company who specifies what types of controls they expect in a policyholder. Early on, it’s not unusual for the insurer to have to subsidize compliance. They often do this through premiums and by reaching out to contractors to help with group rates on loss control services. Insurers also conduct research on the best ways to reduce losses.22 They run training programs. They fund conferences and trade associations. This is often necessary to establish a culture of safety.
This is an extremely conventional role of insurers. Subsidizing the cost of loss control measures is the capital cost a carrier pays to enter a market. They need to build enforcement and control infrastructure. In this area, insurers have been extremely toxic about spending any money. They have repeatedly said they won’t because they don’t think they can make money on cyber insurance.
This has left cyber security in a very bad place. Without the institutional backing of insurance companies, it has been impossible to set enforceable universal standards. Because cyber insurance companies are unwilling to recognize the value of cyber defenses, companies are not encouraged to hire certified cyber security professionals. This has hurt the professionalization of the career enormously. Cyber security trade organizations receive no support or contact from insurers. This is unusual, because insurers typically are the biggest supporters of safety organizations.
There is no collective funding for research or better security measures in the wild. There is no enforcement of product specs for cyber security. Cyber standards exist, but there’s no universal third-party auditing. There are no efforts to improve certification or education. This all tends to come from insurance. In this case, there has been an enormous refusal.
IT product and cyber security vendors have a very hard time coordinating and standards are very fragmented, because no insurance companies are willing to work with them. Insurers typically work with product manufacturers to come up with standards they can accept. Testing is conducted by organizations like underwriters’ laboratories.23 Insurers often track life cycles and enforce phase-out of old technology. It’s also not unusual for an insurance carrier to subsidize the retirement of something that they want to get rid of rapidly.
None of this exists in the same way in cyber security. Good compliance at a company only ever comes from self-motivation. This is a huge problem, because in a market economy, companies have a very hard time maintaining risk management if there is not a financial stakeholder to audit and enforce rules. Insurers play a vital role here. They set standards organizations can follow, while knowing their competitor is doing the same.
It might not seem like it’s a deal breaker to not have the full backing of insurance, but it absolutely is.
At present, organization receive no incentive toward better cyber security. Cyber security professionals receive very little recognition. Certifications are not valued. Most companies will just as soon put a non-security person in a role as a security professional. This has been extremely hard on the profession, which has seen job opportunities dry up.
Companies, at present, are often given what appears to be strong discouragement to invest in cyber security. Criminals are given an assured payday. No effort at collective defense or information sharing exists. It’s killing the profession.
Rethinking Cyber Insurance
A moral crisis as bad as cyber insurance cannot go on forever. Eventually, the sector will need to consider making an effort to stop losing money on cyber insurance. When they do, they will have the world’s most reliable cash cow. It’s crazy that they continue to stubbornly insist you can’t make money on cyber security.
First and foremost, it’s necessary to rethink what cyber insurance actually is and what cyber security actually is. Currently it’s treated as a specialty product, an unusual line of insurance, a tech product and a potentially unwanted liability.
That could not possibly be more wrong. It’s one of the most smallminded perspectives that exists in business.
Cyber security is, in fact, the single most important area of financial risk for businesses in modern society, the biggest opportunity in insurance in the modern era, and the cornerstone of modern financial security.
Cyber security is the way data is protected. It is risk management for IT-centered enterprises. It protects the systems that businesses use to do almost everything, since modern companies have fully digital nervous systems. It’s the type of risk management that dominates the information economy.
In previous centuries, companies had primarily physical assets. Factories, offices and other facilities were the most important assets to an organization. This has changed enormously in recent years. Many modern companies want to keep their facilities to a minimum. Organizations often use leases, contractors and work from home to maintain flexibility and reduce the need for large fixed assets. IT assets are more important than ever, but they depreciate rapidly.
It’s no longer an unconventional idea to say that a company’s most valuable asset is its data and intellectual property, not brick and mortar facilities. Today the world’s largest, fastest growing and most influential companies are all companies that are fundamentally digital. That’s not surprising. AI is likely to increase that further.
Today’s fast paced business world is driven by data. If you want to do business with the biggest most important organizations, and you are an insurer, you will need to provide insurance for digital assets. That’s what those companies care about. That is cyber insurance. It’s not underwriting cyber. It’s underwriting the economy.
The market for cyber insurance is badly underserved. There are carriers who literally don’t want to sell it, because they think it’s a loser, because they don’t know how it works. They are very unwilling to consider any alternative. The market is so ripe for the taking. A license to print money. The easiest fortune ever. Nobody seems to want it. Once you understand where they are, it becomes apparent why this is the case.
Insurance companies absolutely want to sell building and facilities insurance, that nobody wants. They hate cyber. They really want to be Blockbuster, apparently.
There is a Huge Problem
The underwriters of cyber insurance have, unfortunately, walked themselves into a ridiculous paradox of a place. That is because there are many insurance carriers who, if they implemented the standardized best practices for cyber security compliance, would see their loss ratios drop by far too much to easily explain. For example, some of the larger carriers, by implementing standard (nothing exotic) controls for cyber security could see their annualized losses reduced by well over 90%, possibly in less than a year. This would not be expensive, either.
That’s a huge problem. In fact, it would cause a slew of regulatory and legal problems. The bigger problem is that not instituting reasonable loss reductions does not make the problem go away – it makes it worse.
The problem, of course, is that if you implement something this year, and it saves you 90% of losses, then you would have lost a lot less if you implemented it last year. You would have lost even less if you had earlier. So… Why didn’t you?
This is not a minor problem. It implies a severe fiduciary failure. For years, insurance underwriters had assured management and investors that every reasonable action to reduce loss was being taken. Clearly it wasn’t.
The fiduciary failure is obvious. They should have brought in an expert. Revealing that the company had lost billions of dollars unnecessarily, while assuring investors there was nothing they could do, would reveal a massive governance failure.
The fact that the insurance was crime insurance and paid extortion could make things far worse. The way insurers have paid ransom has always been extremely legally questionable. Some insurers insist on paying ransom, even when they have not proven it’s necessary. This one policy, if put under the legal microscope, could be extremely explosive.
Over the years, while paying ransom, cyber insurance companies had repeatedly assured regulators that they were taking every reasonable step to reduce paying ransom to international terrorists. In many states, laws require that insurance has adequate loss control to prevent crime insurance from becoming a moral hazard.
Considering the huge number of incidents that happened, the number of questionable negotiations with criminals, the refusal to speak to experts, the spreading of false information, the evidence of kickbacks and the hundreds of billions in damages, these companies could be in an extreme amount of trouble if anyone ever goes looking closely at their records and their behavior over the past few years. It would be impossible to excuse.
This is exactly what happens when you start making deals with extortionists. The insane situation we are currently seeing in cyber insurance can’t go on forever. The uncomfortable question is how this ends for the traditional established carriers.
Given the implications, it may very well be that the future of insurance will have to be dominated by new carriers, who do not have the inexcusable legacy of the ones who created the cyber bloodbath we have now. Replacing the sector won’t be easy.
The most straightforward way this can happen is through the establishment and growth of mutuals. The process can begin with businesses forming a pool to share risk, which can eventually develop into a mutual insurance company owned by its policyholders. While the process may begin in order to protect a specific company, adding more organizations helps to better distribute risk, so there’s reason to grow.
Eventually, the mutual company can evolve from being purpose-built into a full-service carrier. It can then enter the broader insurance market. Some mutuals eventually demutualize, converting into conventional shareholder-owned companies. The cycle can then repeat, as new groups form their own pools and mutuals to address needs that established insurers have failed to meet.
The other possibility is far worse for carriers. If the criminality of kickbacks and direct ransomware gang relationships is as bad as it may be, then many large carriers may be subject to judicial actions. In the most severe cases, the organization could be put under the control of a court appointed administrator and wound down, while viable units could be sold off as LLCs and assets liquidated. This may be the fate of many of the established cyber insurance carriers.
The Future of Cyber Risk and Insurance
A future insurance carrier, built for a modern digital-first world, would primarily act as a compliance management and verification service. Such a carrier would concern themselves with data and data protection, since that’s the important part of the business. This kind of insurer would also be able to insure property like buildings, equipment or vehicles, but it would insure physical assets as a secondary role. Digital loss control measures can cross into the physical world and will be increasingly useful in a connected world. The same expertise used to protect data can be used to connect to vehicles and security systems.
It’s not entirely certain that this is how the future will play out. One thing that can be certain is that the current model of high loss and ransom paying insurance cannot last and must be replaced with something. Just as with workers compensation, they can fight tooth and nail not to invest in it, but eventually they can’t deny the losses compounding after years of neglect.
A Post Cyber World
It’s not clear what it will look like when insurance eventually cleans up its act. It’s not clear when it will happen. It’s entirely possible that there will be more years of loss before it happens. It’s also entirely possible that a large number of cyber insurance underwriters could end up in jail. It has been that bad, and the evidence of conspiracy with ransomware gangs is overwhelming.
What is abundantly clear is that this can’t continue forever. Like workers compensation, losses can only grow so large before things begin to buckle.
When this happens, it will change the entire framing of cyber security. Effectively, the problem of hacking will be eradicated. It may not disappear completely, but attacks will be few and far between. They will usually be due to unusual circumstances and opportunities.
Once insurance fully owns cyber security, major corporate attacks and ransomware against hospitals and municipalities will finally end. Ransomware and extortion will no longer be the most profitable crime in the world. This might sound radical, but it’s a perfectly natural and expected effect of the economic shift this brings. It has happened before.
This will happen very quickly because it is driven by economics and because cyber security is off the shelf, proven, and extremely effective. Once it becomes clear that this is how money is made—a realization that extraordinary effort has been put into avoiding—there is a natural market incentive to improve security. At that point, capitalism takes over, and love it or hate it, American Capitalism gets it done.
A good example is automotive safety. In the early days of automobiles, there was very little standardized safety and cars had few safety features. When cars first took to the road, in the early 20th century, the world had not yet even realized that it was a bad idea to combine alcohol and driving. There was little in the way of safety regulation, and it took many years for well-designed traffic laws to be enacted.
Automobile companies did, at times, try to improve safety and made some progress. They also tried to work together, on occasion, to enact standard industry-wide baselines for automotive safety. This was never consistent. Competitors are not used to working in collaboration, even for safety. Industry politics fought many regulatory proposals. Car companies and the engineers who design cars are primarily focused on sales and features that attract car buyers, and safety was often seen as a reminder of dangers, which might turn off a buyer.
By the 1950s, automobile accidents were causing significant economic loss, not to mention injuries and deaths. In 1959 this finally got the attention of insurers, and major American insurance companies joined forces to establish the Insurance Institute for Highway Safety (IIHS).25 Insurers began pooling resources, collecting accident data, funding research, and advocating for safer vehicles. They conducted crash tests, evaluated safety technologies, and pushed manufacturers and lawmakers to adopt improvements such as stronger bumpers, seat belts, safer fuel systems, and airbags. The insurance industry became one of the most influential advocates for automobile safety.
In 1966, Congress passed landmark legislation establishing federal automobile safety standards.26 Over the following decades, regulations expanded, requiring increasingly sophisticated safety equipment. These standards were largely sponsored by insurers. Insurance companies continued cooperating through organizations such as IIHS, establishing testing methods and safety ratings.
What really changed things was putting a price on safety. By pricing car insurance based on the car’s features, the economic incentive to introduce better safety was created.
Because cyber security is already established and so effective, the reduction would be far more than happened with automobile accidents. Cyber losses theoretically approach zero eventually.
This is really the key to understanding the cyber crisis. Cyber problems exist because insurance has removed the perception of financial loss. At some point, the moral crisis will get too large. Once risk is priced properly and required controls are enforced, it begins to go away. Companies respond to market forces, not only to increase revenue, but also to reduce costs. Because reducing cyber risk has such a high return on investment, the market can encourage it.
In cyber security, we can say, with great confidence, that this will basically, for all intents and purposes, end the problem. We can be so confident because the data in cyber is so solid and consistent, the systems are well known and entirely manmade.
When this happens, most of the visible cyber security will begin to fade. Standardization will build transparent controls into systems. You will no longer need a firewall or anti malware. It will be built into the system and you will not worry about it. Firewalls will be at ISPs. Devices will be fully approved.
We won’t need to worry about it. It won’t vanish, but it will be taken care of.
Legislation and regulations will finally be results-based. Because insurance cares about losses, most of the security theater today will be replaced with real and effective security. Loss control measures will be far easier to implement and use. It will fade into the background and companies will eventually consider it “just another thing you do.” Insurance is excellent at consistent low-drama enforcement.
We can also expect that many of the worst legacy systems and practices will finally be gone. An aggressive effort to sunset password protected systems is obvious.
The most important change will be the professionalization and recognition of cyber security. Currently, anyone can call themselves a cyber security expert and any company can offer cyber services. Many people do, including insurance underwriters who know nothing about it. There’s a general impression that IT geek means cyber security expert.
There are certifications for cyber security. There are some very important ones. For example, high value systems really should be audited by a Certified Information Systems Auditor (CISA). The problem is that insurance, which forms the baseline for risk in the private sector, does not want to endorse this because they are afraid it will be too expensive. Compared to any other safety area, this is bonkers, and it won’t last forever.
AI makes the shift non-negotiable. It’s not simply that AI increases the potency of the threat landscape. AI deployment increases reliance on IT infrastructure and the amount of automation being used. AI models themselves can also be attacked, with prompt injection and other attacks. AI is part of the bigger shift the world has made to a digital-first economy. This won’t slow down. It will only speed up.
AI also does reduce the cost of some cyber security work. Code inspection and auditing are labor intensive. As more model-generated code enters the world, we can hope standards do improve.
Other Ways AI can be Misused
The use of agents and other AI technology in online harassment is an especially nasty use. Online harassment is already a huge problem, in the age of social media. It’s difficult to control, because it may not be apparent who is doing it or where they are located. Recourse is not always easy.
AI can amplify the problem significantly. There have already been a handful of cases of agentic harassment documented. There will likely be more in the future. In these attacks, a swarm of AI agents can be used to deluge social media and other sites with false and harassing information. The AI can be used to attack a person’s accounts, spawn new attacks, post false information and contact people directly.
Sites and apps exist to “nudify” pictures. This allows a user to upload someone’s picture and have an AI generated image of them nude or in an explicit sexual situation generated.28 Of course, the image is not really the person, but it can look very real. This has been used on a number of occasions for harassment. There have been news stories of nudified images causing conflicts in high schools and elsewhere. There is even legislation proposed to make the act itself a crime.
Deepfakes have also been raised as a concern for public misinformation. There have already been incidents, and there will likely be more. The circumstances and motivation for this are highly variable. Some deep fakes start out as legitimate jokes or entertainment and others are very much intended to deceive the public for gain. This could be used in an organized misinformation or propaganda campaign.
Deep fakes can also be used as false evidence or to make untrue accusations. This can happen in the workplace or elsewhere. It can also be used with law enforcement and crime accusations. The act of “Swatting” is when a person calls a police force and accuses someone of planning an attack or other wrongdoing in order to get the police to deploy a SWAT team to their home. Deep fakes have sometimes been used to lend credibility to the accusations.
AI can also be used for doxing or researching a person, in order to facilitate harassment or threaten them. AI can be used to identify persons in images, and this has led to concerns over public images and participating in events like protests. AI can also deeply research a person’s background or link postings to them. In effect, a group of AI agents can do what would have previously taken an army of detectives.
There are greater privacy concerns as well, extending to government use of AI.
There are documented cases of persons using chatbots to facilitate other crimes. For example, criminals have used chatbots to get harmful information or plan crimes. Most chatbots have guardrails, but there’s only so much that these can do. If a person asks for obviously harmful advice, most chatbots will not fulfill the request, but not all information useful in the commission of a crime is obvious.
The concerns expressed over the use of chatbots to find harmful or criminally useful information do seem a little out of proportion. All of the information available, such as how to break into a house or build a bomb, is already available on the internet. Interestingly, there was also panic over Google and other search engines in the early days of internet search. There is an obvious novelty effect. There are surely more illegitimate uses for AI, just as there are surely more legitimate ones. AI can help both criminals and defenders. We will certainly be seeing even more capabilities, for good or bad, in the years to come.