This article first appeared on www.insurancethoughtleadership.com. View the original article here.
AI emerges as both threat and solution in cyber insurance, reshaping risk assessment and breach response.
AI is transforming the work of professionals everywhere. Unfortunately, that includes cybercriminals. These threat actors can now harvest and analyze more data than ever, automate phishing attacks and mimic human voices with alarming accuracy, allowing them to penetrate the defenses of the most sophisticated organizations.
According to Microsoft’s latest digital defense report, cybercriminals and nation-states launch more than 600 million attacks against the company’s customers daily. That’s nearly 7,000 per second. The advent of generative AI will likely increase the severity and frequency of those cyberattacks, which could drive claims and premiums.
However, AI also offers immense potential to benefit the cyber insurance market. It can counter costs associated with cyberattacks, both in the reactive phase of breaches and in proactive risk mitigation.
More cost certainty with AI-powered data mining
One of the most significant costs in assessing the potential damage and cause of cyberattacks is data mining — the process of analyzing logs, files and other digital information in search of clues about a breach. This work helps organizations and the industry better understand and manage cyber risks.
Before the widespread commercialization of generative AI, human analysts and lawyers predominantly conducted this work, sifting through millions of documents to determine if sensitive information was exposed or exfiltrated and what required reporting to authorities.
Today, generative AI and machine-learning tools offer ways to automate more of the data-mining process, delivering faster, more accurate results — and, crucially, with more cost certainty.
Consider a breach involving sensitive data points like tax identification numbers or Social Security numbers. Confirming whether those numbers were exposed at a global company would require months of work by human analysts. With the right search instructions and parameters, AI-powered tools can search for the numbers instantly.
Human oversight still needed
The results cannot be blindly trusted. As effective as the technology is, it’s not a standalone solution. Human input and oversight remain crucial. Getting accurate results and avoiding false positives require cyber experts with extensive experience searching for sensitive data points and understanding the context in which they appear in documents. That experience allows them to provide the right prompts and test the results to ensure accuracy.
Without human expertise, data will continue to be vulnerable to attack. Additionally, the cost savings of an AI-powered data-mining operation could be lost if lawyers challenge the findings and must conduct their own investigation. The technology may stand alone one day, but it’s not there yet.
Generative AI's next frontier: pre-breach maintenance
A data breach often surprises company executives. Many are unaware of the sensitive information exposed. Sometimes, they didn’t appreciate the number of people not following company guidelines around data preservation. Other times, they were unaware employees were using private messaging apps to transmit files to personal devices. Occasionally, executives weren’t informed that data relating to spun-off or sold entities remained undeleted. These realizations are spurring organizations and the cyber insurance industry to rethink ways to improve pre-breach data maintenance.
Cyber health scans
Despite the billions of dollars that organizations spend yearly on building cyberinfrastructure, attacks persist. That’s why there is unprecedented focus on the content of the data — rather than the walls around it. This new approach could significantly alter how cyber insurance companies assess risk.
AI development is helping to power the new approach. With large language model-based tools, organizations can receive a data scan that generates a heat map detailing sensitive data and potential risk levels in the event of a cyberattack. This allows companies to understand their vulnerable data before an attack.
A scan can give organizations an outline of the internal data stored in their systems. With that picture, they can improve data governance by making informed risk-mitigating decisions, such as removing or further securing sensitive digital information. By making that information more secure, organizations make ransomware attacks less inviting and reduce their costs and risks.
AI's positive influence is just beginning
AI’s application to the cyber insurance market has only begun to show its impact. However, by leveraging AI for both pre- and post-breach processes, organizations and insurers can reduce breach-related costs while improving risk management.
