BEYOND CYBER: UNDERSTANDING AI EXPOSURES ACROSS INSURANCE LINES
CyberCube webinar transcript
Speakers:
- Yvette Essen, Head of Communications and Market Engagement, CyberCube (host)
- Jon Laux, Head of Products and Analytics, CyberCube
- Ben Strickson, Cyber Researcher, Analytics, CyberCube
- John Anderson, Director of Product Management, CyberCube
------------------------------------------------------------
INTRODUCTION
YVETTE ESSEN: Hello everyone, and welcome. Thank you so much for joining us today. I'm Yvette Essen, Head of Communications and Market Engagement here at CyberCube, and I'll be your host for the next hour or so.
Today we're talking about a topic that's moving fast and touching nearly every corner of the insurance market: AI exposures, and how they extend well beyond cyber policies. As artificial intelligence transforms how business operates, it's also creating new and complex insurance exposures, and those exposures don't stay neatly inside cyber coverage.
Here at CyberCube, we've recently unveiled a new framework we're calling I2T2, which looks at AI risk through four dimensions: information, intelligence, tactics and technology. Today, our panel will outline that framework and what it means in practice. By the end of the session, you'll hopefully have a clearer idea of how AI-related claims may develop across cyber and non-cyber lines, the policy triggers most likely to determine coverage outcomes, and practical considerations for insurers as AI adoption accelerates.
To help us unpack all of this, I'm joined by a panel who work on this every day. In the studio, I have Jon. Jon, would you mind explaining what you do at CyberCube?
JON LAUX: Sure. Good to see you. I'm Head of Products and Analytics for CyberCube, and the best way to think about that is that I wear two hats. Our analytics team is the core research and development we do at the company: security experts, cyber research, looking at the threats and at how we defend against them, and then combining that with data and analysis to turn it into models for thinking about risk. The other side is the product management hat. That's how we engage with our customers, identify their needs and transform those insights into software they can run, as well as engaging with clients to identify the emerging frontier of problems they're grappling with, so we can keep advancing and improving things over time.
YVETTE ESSEN: Great. And next is Ben Strickson. Ben, tell us a little about your role.
BEN STRICKSON: Thanks. I'm one of the cyber researchers within the analytics team that Jon just mentioned. I bring a cyber lens to work alongside our team of actuaries, to bring that perspective to our models as we take them to market.
YVETTE ESSEN: Great. And online we have John Anderson, who is based in the States. John, tell us a little about your role.
JOHN ANDERSON: Thanks. I'm a Director of Product Management at CyberCube. I currently oversee a suite of products and also oversee our new product development.
YVETTE ESSEN: Here is how it will work today. We're going to discuss a number of ways that AI is raising questions and generating concerns. That conversation will mainly be with us in the studio, with a little input from John Anderson. Then the two Johns will chat to each other about some of the findings from our new AI framework. We'll then all reconvene and go through some of the many questions you've submitted.
------------------------------------------------------------
HOW AI IS CHANGING THE THREAT LANDSCAPE
YVETTE ESSEN: Jon, turning to you first, I'd like to hear a little about how AI is impacting the threat landscape.
JON LAUX: It's a really interesting moment, and I think we all feel like we're in it. There are a lot of headlines about AI and a lot of fear, uncertainty and doubt, and it could all be overblown. It's been interesting watching how things have unfolded: we haven't necessarily seen the wave of increased claims arrive yet. We'll get into all of that, but as an industry it's a moment we need to take very seriously. There are maybe some echoes of what we saw in 2019 with the rise of ransomware-as-a-service. It took some time to show up in insurers' income statements, but it was real nonetheless. So it's a moment to be thoughtful and prepared for what could be a pretty significant wave in the technology.
The high-level message as we think about the next 12 to 24 months is to expect the unexpected or, to put it more technically, our view of the future has more uncertainty and volatility in it than in the past. I'll show you two things to put some visibility on that.
The first exhibit is from a panel of experts. We survey cybersecurity experts every other year, and we're in the process of completing this year's survey. Not surprisingly, AI has been one of the big topics. One of the headline questions is: on the whole, over the next year, does AI tilt more to the benefit of the attacker or the defender? You can see there's a range, but the answer pretty broadly is that things favour the offence, at least for the immediate period. In the longer term there may be ways it favours defenders, but right now there's definitely a skew in the direction of the offence. We need to take seriously what that could mean.
To frame it up with another exhibit, here are four scenarios to consider when we think about 2027. The numbers on the page are representative; they're just ways to think about it. The world we've been in in cyber insurance is what we've represented in column B: the grind state. Severity has been more or less flat and rather contained, frequency has continued to tick higher, and market conditions have been soft. It's entirely possible that continues for another year, maybe a little longer, before the market needs to adjust. There's also some potential for a more favourable outlook next year, and we'll talk about some of the things that might favour defenders. That would be the first column.
The thing we need to take really seriously is the potential for AI to produce a step change, whether in frequency, severity of claims, or both. The frequency piece is probably the easier one to see, in terms of setting off the attacks. The question is whether it starts to flow through into severity as well, and as we'll get into, there's evidence that could very much be the case. The tools becoming available with the frontier models, and whatever the frontier models are in another three to six months, could make that a very readily available toolkit in the hands of anyone who wants it.
The final possibility to consider is a rise in actual cat activity, which is always something we're thinking about at CyberCube. It's not necessarily something we're expecting for next year, but it would certainly cause the market to adjust pretty dramatically.
YVETTE ESSEN: A lot there about the future, which is fascinating, but I'd like to focus on what's happening presently. Ben, we've seen a really high watermark for AI capabilities this year in particular. What are you seeing, and what are you expecting?
BEN STRICKSON: It's always hard to put a date on these things, but I think it's fair to say that 2026 represents a step change, which was scenario C that Jon was just talking about. The thing I want to call out is the Jade Puffer incident. That was a ransomware campaign where an agent ran the full orchestration. It took a known vulnerability, but it did everything else: the lateral movement, the credential acquisition and finally the extortion. That end-to-end automation, for us, marks a real step change.
There are a couple of other events this slide calls out over the last year, including the Google threat group observing a threat actor using AI to generate a zero-day, which is an interesting moment. Although we're seeing those AI capabilities, they're not automatically an increase in attacks or claims frequency at the moment.
YVETTE ESSEN: How are we regarding the different kinds of threat actors with respect to these changes?
BEN STRICKSON: This will land differently for different threat actors. For nation states, we think this probably isn't the step change that it is for other groups. There have been some observations, for example of the North Korean group APT45 using a large language model to try to weaponise known vulnerabilities. But we think the real step change will happen slightly further down the capability spectrum. That's the middle group of financially motivated, everyday ransomware gangs, who will take known vulnerabilities and use an agent to chain the different campaign orchestration steps together, exactly what we saw with Jade Puffer. The cost of that is now plummeting towards zero, so the cost for them to run these campaigns is negligible, and we think that is going to drive frequency.
------------------------------------------------------------
AI FOR DEFENDERS
YVETTE ESSEN: There has been a lot of talk about how AI can benefit attackers, but I'd like to spend some time on how it can be used by defenders. Take what has been going on with Claude Mythos, when Anthropic delayed that launch to the spring and announced Project Glasswing, working with some of the software makers and developers to find vulnerabilities and try to prevent them being exploited. We're also seeing it with OpenAI's GPT-6 Astra and their Project Daybreak access programme. Are we seeing any evidence of how successful these open access programmes are?
BEN STRICKSON: It's a little hard to tell right now, because some of these programmes are still behind NDAs. But what we can say is that the number of vulnerabilities being published by the partner organisations is running at about five times what it was before Mythos and Project Glasswing. These organisations are using these capabilities on their own codebases, and some partners are pointing them at the major open-source codebases. So the number of vulnerabilities being published has increased significantly. That's good and bad. It's good because we hope it means safer code in the future. The real challenge now is triage. An interesting signal is that several open-source packages have suspended their bug bounty programmes, which speaks to how much they're struggling to triage the number of vulnerabilities being published.
JON LAUX: Building on that, it's good to identify vulnerabilities, but it's better to fix them. Whether companies actually follow through is perhaps the more important point. I think you've done some research on this, and the amount of patching we're seeing is surprisingly low.
BEN STRICKSON: Mean time to patch was a trend that already existed, but it's now really noticeable that it's increasing, up to around the mid-40s in days. Organisations were already struggling with this, and there's evidence they're now struggling even more as the CVE list grows. I think it was up 45% in the first half of this year versus the first half of last year, and the KEV list is up around 10%. So it's a really challenging time for companies trying to patch their IT estates.
------------------------------------------------------------
RISK MANAGEMENT
YVETTE ESSEN: I'd like to discuss what this means from the enterprise's or the insurer's point of view with regard to risk management. Does it further emphasise the importance of things we should already have been doing? I also want to bring John Anderson in, because I know this is your area. John, what do you think about risk management practices?
JOHN ANDERSON: It certainly comes back to doubling down on the fundamentals. We know phishing will still be a huge method of entry, and large language models are certainly making that much easier, so anything that helps with authentication, assuming you might accidentally give up your credentials, will matter. But as we've seen with some of these novel attacks, AI can also bypass some of this, or is smart enough to find a way into organisations. We've seen it move laterally within them. So anything that helps detect threats is important. For smaller organisations this is really critical. They need the most help, and they're hopefully outsourcing a lot of their security programme. From an insurer's perspective, it's about understanding what they're doing, what they're outsourcing, whether they're doing the fundamentals well, and whether there's something you can do to help them with the fundamentals.
YVETTE ESSEN: That's probably the stuff we already knew to be important. John was speaking to standard IT security practices, which will continue to matter, so anything we can do to help take that view to clients will be helpful.
JON LAUX: Adding to that, take what we're doing at CyberCube. Our head of engineering is preparing for a future where, when vulnerabilities are discovered, we need to patch them within minutes or hours, whereas previously days was considered pretty good. So, to John's point and yours, the pressure will continue to rise on organisations, and what is considered good enough will continue to change. The fundamentals are what they are, and maybe in a soft market we take our eye off the ball a little and adjust as needed. But the things we've been focused on for the last couple of years, like patch management and network segmentation, remain important.
One more thing worth saying is that inbound attack frequency is not the same as the frequency of material incidents to organisations. Those two are never the same. We know the inbound will be there; the question is whether events become material to the organisation. Everything we can do to stop them becoming material is a benefit to the enterprise and to the insurance sitting behind it. This might be one of the places where insurers can really do some good and help their insureds respond more effectively.
------------------------------------------------------------
VOLATILITY AND CATASTROPHE EXPOSURE
YVETTE ESSEN: Jon, with all this activity we're anticipating, what do you expect with regard to volatility? Is it likely to be an issue?
JON LAUX: The best way to understand volatility is to think about what happens before the event starts. Every business starts the year with a plan for how things will perform, and then there's what actually happens. The question everybody has to grapple with from an underwriting point of view is: I have a plan for the performance of the book at the start of the year, and by the end of the year, how different could that be, and what goes into it?
I'm going to move us to another exhibit. It's quite mathematical, but I'll put some words to it. As I said earlier, one of the big themes for the next 12 to 24 months is to expect the unexpected, and that really does mean more volatility. Volatility isn't necessarily bad. It can work to the benefit as well as the worsening of how the business is performing. We're talking about some things that may be beneficial, which remains to be seen, and some things, like frequency shocks, that could mean increased volatility.
There are a few things that have helped the market over the last couple of years that are worth recapping, because whether they hold will inform whether we stay in that grind scenario or move to more of a step change with respect to AI. The real question is whether the headline increase in frequency, which seems pretty certain under any of the scenarios we're considering, translates into a frequency of material events for organisations and their insureds.
Severity has been more dampened in recent years, on the whole. There are things to the contrary that we're starting to see, but insurers since 2020 have been insisting on immutable backups, and the willingness to pay extortion demands has come down pretty significantly in the last couple of years. These are good signs, in the sense that incidents that once would have been pretty material for organisations and their insurers have been more contained in terms of loss amounts. But frequency has continued to tick up in the meantime, and the rate levels that got the market to profitability in 2020 aren't necessarily the rate levels we need in 2026 or 2027.
We'll see how much those trends continue to hold. If the automation Ben is talking about leads to more effective lateral movement and getting to crown jewels in the organisation, or exfiltrating the thing that really makes them want to pay the ransom demand, then we may start to see severity tick up in addition to frequency, which would be a significant change in the market.
JOHN ANDERSON: And as Ben mentioned, the financial crime side of things is all getting easier with the trends we're seeing with AI as well.
YVETTE ESSEN: A question a lot of our audience will have on their minds is what AI means for catastrophe exposure. What do we expect to happen there?
JON LAUX: "Expect" is a tricky word. There are a number of things we're considering, and we'll talk about this after we introduce the framework, but there are a number of lenses this could play out through. What we're most focused on right now is, to a degree, the things we've been talking about: how AI influences the tactics, techniques and procedures that have been front and centre in threat actors' minds and capability sets. I was reading an article just this morning: we're not at the point yet where rogue agents are going out attacking things on their own. They still need someone to guide and point them. Once you point them they can be very effective, but that's important to remember for now, because the motivations of threat actors are one of the important constraints on some of the activity.
BEN STRICKSON: The rogue agent narrative aside, the most useful thing I took away from some of the incidents we saw this summer is the Hugging Face incident, where an agent broke out of its test bed, went online and corrupted another organisation's database in order to achieve a task it needed to. That tells me less about rogue agents and more that these agents can operate in totally unplanned spaces. They can handle the nuances that come with a foreign organisation's infrastructure, move around and achieve their goals. That's probably the most useful signal we have that there's real danger here.
------------------------------------------------------------
THE I2T2 FRAMEWORK
YVETTE ESSEN: I'd like to move on to how we've created a framework for these AI risks. Jon is going to ask John some questions. Just to set us up, why did we publish this framework, which you can download, "Machine State of Mind: A Framework for Quantifying AI-Driven Insurance Risk"? What led us to create it?
JON LAUX: A couple of things. We're studying this alongside our clients, and we're all watching it unfold in real time. With this framework we wanted to share our own reflections on how we're grappling with this peril as it evolves. It's actually not just one peril; it's a set of perils. Cyber fit within a relatively neat mould, and in the insurance world we now understand what cyber insurance coverage is. But all of our organisations are using AI in a variety of ways, so there's a great expansion in the scope of what technology risk can mean. This framework represents our own grappling and sense-making, and an attempt to bring some coherence to how the insurance world is responding. We read different things: insurers denying AI coverage or excluding it, others granting it. It can feel cacophonous, but there are some through lines we think are important, and we wanted to bring those to the surface.
YVETTE ESSEN: Great. You've got some slides to talk through, so I'll let you and John discuss.
JON LAUX: Thanks, I've got the powerful button. John, maybe I'll put this one to you to start. There are ways AI risk is like cyber risk, and ways we're identifying that it's different. Can you talk about each?
JOHN ANDERSON: Certainly. Starting with where it's like cyber risk: digital supply chains and malicious attacks fit more neatly into some of the buckets we would consider. That's especially true of tactics, techniques and procedures, meaning how threat actors use AI to assist them in attacks, and also of single points of failure, the technology itself and that supply chain, which is quite familiar to many of us, especially when we think about cat or aggregation risk. AI has its own digital supply chain.
Then, in terms of what can go wrong outside of cyber, third-party liability seems to be much greater than what you would see with cyber risks. AI certainly amplifies cyber as a tool, but it also brings operational risk and various liabilities from its sheer existence. For instance, you could have an agent that's doing what it's been told to do but produces a bad output, and that can leave you liable in a whole host of ways. Or perhaps there's no bad output, but the AI itself is just wrong because society deems it to be wrong. You could also run into operational risk, where nothing malicious happens but the AI starts deleting a database. You have to recreate it; maybe it doesn't cause any business income loss or business interruption, but you've lost data and have to fix that. Especially as companies lean more on agents, that brings about some changes, and LLMs themselves have a huge liability exposure surrounding them.
JON LAUX: The visual on the screen is where we started when we thought about cyber insurance, in terms of how we move from threat actors to techniques to single points of failure to impacts. That was how we started thinking about AI risk. To your point, AI can play any of the roles in that chain. The single points of failure and the tactics align fairly well, but then things get weird, and we ended up creating an entirely new framework, which we're calling I2T2. Why don't you give us an overview?
JOHN ANDERSON: As the name suggests, we've split the framework into things more familiar from cyber and crime, those being tactics and technology stack, the two Ts, and risks more novel to AI itself, information and intelligence, the two Is. From these four dimensions we've constructed six AI event families organised across them. Each event family encompasses a variety of potential loss scenarios, with each quadrant reflecting a different way AI produces risk. It's important to note that these events span many of the common property and casualty insurance coverages: E&O, GL, property. For many of the scenarios you might conceive of, you'll think, that looks like something I've seen before. That's a good thing to note, because while many of us are quick to view AI as a risk akin to cyber, a digital risk, it ends up being broader, and the potential impacts are far broader than any single line of insurance.
JON LAUX: Let's get into examples, because from our conversations with clients, it's generally the cyber teams that are getting the AI questions. Of course, the cyber people are the ones who know something about computers. Part of our purpose in sharing this framework is to suggest this should be far broader than that. Let's go through each family. John, within the information category, what kinds of events fall there?
JOHN ANDERSON: Within information, we're considering how the very nature and design of AI causes risk. That can span regulatory considerations for the AI itself and even protected or sensitive information. Notably, the AI doesn't perform any erroneous action per se when it's running. Rather, it causes harm or ends up violating a legal standard in the process of gathering inputs or producing outputs, and in doing so creates liability for the organisation as it impacts a third party.
This is where we house event family 1: media, regulatory and protected information. You can think of these events as training data disputes, transparency violations, regulatory and compliance violations, output disputes and unsanctioned use, meaning shadow AI. There's a litany of cases out there against foundation models over what they're training on. And it's very easy to conceive of what could go wrong when someone who is not a foundation model chooses to rely on and use AI, simply from the fact that they're using it.
JON LAUX: And maybe even a bit of privacy liability there, if the model is being trained on something it shouldn't have been exposed to and is now being used to publish things that were previously considered protected information. Let's move on to intelligence, because we have a couple of different flavours here. Walk us through the kinds of events in this family.
JOHN ANDERSON: Intelligence is definitely a loaded one. This is where we're looking at AI producing bad or harmful outputs or making bad decisions itself. It can cause a human error, or it could be the machine itself, given autonomy, doing something bad. We've also divided it into physical and non-physical impacts, thinking about the autonomous design given to physical infrastructure or autonomous vehicles. I'm sure we're all aware of some of the incidents that have happened there, especially with Teslas that seem to stop in the middle of a highway.
We end up breaking intelligence into three event families. The first divide is on the autonomy component: whether AI is authorised to make a decision in the real world.
Event family 2 is output generation failure. These are events where AI does a bad job and feeds its output to a human, who then takes the next action that causes the harm. There are good examples out there. One is Deloitte Australia, where employees used fabricated citations they got from an LLM in a report they gave the government, took a fee for it, and ended up having to return the fees.
Event family 3 is automated decision failure. This captures events where AI makes a bad decision itself. This family is really for non-physical actions with undesirable consequences. The Air Canada incident falls here, where the chatbot offered a non-existent refund to a customer. There's also a good GEICO example, where an agent unexpectedly cancelled a policy on one of the policyholders. It's also important to carve out the Hugging Face breach that many of us are familiar with. That's another example that falls into this category: the AI agent acted autonomously to cheat on its own test and broke into a third party as a result. Nothing malicious there, but it was given a task, had the autonomy, and did something bad with it.
The last family in intelligence is event family 4, which bridges into a different category; you'll also see it in tactics. This is the other side of the physical divide, where the bad decision itself has physical-world consequences. These could come from a malicious actor, or they could be more innocent, just a bad decision: sensors, cars, physical product defects, even if those were generated using AI. Very simply, a bad paper cup that can't hold its water, designed by AI. All of that falls in this bucket. This one is quite loaded, but it certainly evokes triggers for different policy types than pure cyber.
JON LAUX: To me, the three families that sit under intelligence are the most fundamentally new, because we now have machines capable of doing things that previously we only ascribed to humans, and maybe primates and the occasional other example. It also highlights where AI risk doesn't look like cyber. There can be accidental issues in cyber, but a lot of these can have no malicious intent whatsoever; harm is created simply by virtue of how things unfolded. From a security and controls point of view, one of the interesting things each organisation will have to grapple with is whether it is in event family 2 or event family 3 land. Am I using AI to help me with something, or am I actually offloading something to it, and what am I entrusting it with? There's probably more potential benefit from offloading, but also a higher level of risk.
Let's talk about the last two: tactics and the technology stack.
JOHN ANDERSON: We touched on tactics before; the name probably looks familiar from our cyber framework. This is where we house adversarial use of AI, where AI enables new ways to exploit things. Event family 5 is adversarial exploitation, which could result in financial damage and operational disruption, and of course a whole host of deepfake and phishing activity being enabled. It would also include some of what Ben was showing before, with agentic reconnaissance and automated attacks. We're considering how it could be either a human or a machine being exploited, and in the tactics category it could go physical or non-physical, so event family 4 creeps up here again.
A good example for event family 5 is the Jade Puffer incident: a fully AI agent-driven, end-to-end ransomware operation, going from recon all the way through credential theft, lateral movement, escalation and ransom demand, doing all these steps on its own or assisting a threat actor to carry them out. It's not hard to conceive of how there could also be physical impacts. The example that always comes to mind is a water treatment facility in Florida that was deliberately targeted. I don't know that that one was AI-specific, but you can imagine how more attacks on critical infrastructure like that could become easier.
The last one is the technology stack, also quite familiar to those who work in cyber and know the rest of our framework. This is event family 6: supply chain and dependency failure. These events consider both availability and integrity for the broader tech stack and ecosystem, especially around AI. You could have concentrated incidents, but also more widespread ones. We're looking at how there could be a compromise of a foundation model, but also at availability, such as a government choosing to revoke or block a model. We've seen this in the US with Mythos and then Fable for a brief period, and it's not unreasonable to suspect that other governments might take similar actions periodically, for a whole host of reasons. It doesn't just have to be governments either. These models and platforms have shown their own availability issues, much to the chagrin of several of my colleagues who have become more reliant on this technology for their day-to-day jobs. Sometimes these models are not available. If you build a lot of agents on these models and the agents can no longer act due to their dependency, there's a lot more that can go wrong and a lot more disruption. Nothing malicious is needed; it's just all this further reliance on a novel technology.
JON LAUX: Absolutely. An important point to underline is that we created this framework recognising that some of these things could be very attritional in nature and some could be very catastrophic. AI is challenging a lot of the assumptions we make in cyber. Ben, to connect it back to the earlier conversation, when we put a more systemic lens on it, what's your read on the framework? Where do you see the most systemic potential across the event families?
BEN STRICKSON: For me, the most systemic risk sits in the technology stack. A useful parallel is the cryptocurrency universe, where it's the connectivity layer between the exchanges. In this instance of AI, it's the model protocols, the models speaking to each other. The vast majority of APIs by the end of this year are going to be using a very singular set of standards to communicate across model providers. It's that new layer of exposure, which I would argue sits slightly higher than we previously thought, that for me is where the most systemic risk will sit in this new AI cyber world.
JON LAUX: In addition, you could also think about common codebases across different software being built on it, and the degree of homogeneity of code that becomes part of everybody's system. We could have widespread vulnerabilities as well.
BEN STRICKSON: Sure, that's the monoculture code argument. I wouldn't argue that all these models create exactly the same code or write the same way. What you would argue is that there are classes of vulnerabilities they tend to overlook, because the training data isn't there to help them deal with those types of vulnerabilities, and there are whole classes where they continuously misallocate their resources.
YVETTE ESSEN: John, how are we helping insurers navigate these different considerations? We have a framework; how do we help people apply it?
JOHN ANDERSON: One thing we've created is a mapping sheet that insurance companies can fill out relative to their different lines of business and the coverages within them. It's a very good exercise for insurance carriers to do themselves, as they all have different policy wording and different intents for what they're covering or excluding across these lines. We've been engaging with customers already on this framework, helping them think through what these scenarios could look like, much like the discussion before, and then using the different event families to map across their various insurance policies. You'll see cyber and crime on here, but also media, because a lot of event family 1 gets into media liability considerations. Outputs start to go into E&O and professional liability as you become reliant on AI to perform your service. Then GL, property and products liability, and we talked about design, and so on. This list is not holistic; it's really just a starter of some lines, and you can fill it out across everything you have.
JON LAUX: The paper has examples, though we're not necessarily doing the mapping ourselves; there are a number of examples that could fit a variety of these lines, so definitely check out the paper if you haven't. The other thing that's important, and why we're sharing a blank page rather than something filled out, is that in our discussions with clients the answers are very bespoke to each insurer. There are important echoes here of what we saw as an industry with non-affirmative, or silent, cyber six, seven, eight years ago. From analyses we did at the time, the answers really depended on the insurer. There are some common patterns, but the details matter, and every company I worked with at the time had some surprises where they hadn't realised they had exposure, or didn't have it. So it's not our job to pronounce. What we're trying to do is raise the question so each insurer can grapple with it on their own.
The framework is just the beginning of what we're planning to do, and this is all new territory for us. To say a little about what we're doing at CyberCube before we move to Q&A: we are actively thinking about those tactics, techniques and procedures, both for how they affect the non-cat model we're working on now and for our cat model release, which will come out next year. We've begun thinking through how we reflect those different flavours of volatility as they could play out through the threat landscape into our models.
We're also beginning to develop some new tools to help the market play out a much wider range of scenarios. We've been calling it Scenario Builder, a framework to reflect on scenarios, whether in an event response context or a build-your-own context, and AI fits naturally within that kind of framework. What we don't want to do is add a bunch of hypothetical assumptions into the models our customers know and trust, but we do want to give them a sandbox environment to experiment, play and test the edges as new things become available. A lot is keeping us busy, and we're excited to continue.
------------------------------------------------------------
Q&A
YVETTE ESSEN: Thank you to everybody who submitted questions. We have so many, and I'm going to try to get through quite a few, so gentlemen, please be on your guard to answer quickly. Jon, I'm going to start with you. Can you discuss who is liable for AI wrongful acts? Is it the originator, developer or deployer of the AI? Who else could it be?
JON LAUX: Really interesting question. We're seeing a lot of this still unfold. The originators of the AI platform, the frontier model developers, have been in and out of court on this very thing. If you're interested, look at the plaintiffs' bar activity around OpenAI, Anthropic and others facing some of this. This is where event family 1 is playing out, with people contesting what AI is being trained on. Developers of AI, building on top of what are often foundation models, certainly have some fault when you think about their E&O and the software they provide. Then there's the deployer of AI, those using it for whatever their function is. It's their responsibility to maintain the output, or they're making the decision to use AI for their services, and they have their own regulatory and infringement concerns.
One thing I would add from our research is that where there's relatively little coverage today is for the company using AI themselves, which makes sense. If a company screws something up and there's no AI involved, there isn't a lot of insurance that says, "I screwed up, pay me." But given how complex a technology this is, it will be interesting to see how that plays out. In some ways the most compelling case for new standalone AI coverage sits in that area, where an organisation needs some kind of warranty or performance cover for what it is taking on.
YVETTE ESSEN: Another question. Jon, what information about an insured's AI use can be captured in an external scan? Specifically, can you see which LLM vendors they're using and convert that into an aggregation report?
JON LAUX: It's a good question, and it's something we're tracking right now. Customers with SPoF Intelligence can see that today. What's been interesting, given how fast this is moving, is the trend line. Over the last year or so, we've seen observations of the three big models increase between three and 15 times. I think ChatGPT was probably in the lead at the beginning, so that's the 3x, Anthropic caught a big wave, so I think that's the 15x, and Gemini is somewhere in the middle. We can see them, though it's always hard to observe perfectly.
But just observing that you're using one of the foundation models doesn't tell you much about the important questions: how are they using it, what are they using it for, and what guardrails have they put around it? Back to the framework, those are the things that distinguish event family 2 from event family 3. Do mistakes translate through to customer harm, or is someone intervening and gating them? We're actively exploring discussions with some telemetry providers that can help us fill in those gaps.
YVETTE ESSEN: John Anderson, I think this next one is for you. How would leveraging AI to render a professional service change the service provider's inherent liability? Unless it's specifically excluded, how could coverage be precluded?
JOHN ANDERSON: That's a good question, and I was starting to answer some of this before. A lot of the use of AI is just an extension of what professionals are doing. AI is a tool. What we're hearing and seeing is that you're still performing a service, and you're using AI to perform it. If the AI gives you a bad output, it's still on you to check your work and do your own research before finalising the service. There could be some liability pushed back if it's a specialty AI service you're using to carry out your professional service, so perhaps some subrogation, depending on the nature. But that's most of what we've seen, and it's tough to say it would be fully excluded for professional services work.
YVETTE ESSEN: Moving on. This one is for John, but Ben, I want to bring you in as well. How can we expect insurers to prove attribution to AI, or are there other ways to carve this risk out? Ben first.
BEN STRICKSON: It's hard, and I think it's going to get harder. Identifying whether it's a human or a machine that has moved through your system is something I don't think most organisations are up to right now. In the future we may see defensive technologies adapt and be able to help classify that, but right now it's extremely hard, so there's a lot of uncertainty around that risk. John, do you want to add anything?
JOHN ANDERSON: Understanding and inventorying your AI is really the first step, and understanding where your insureds or clients are with that. Companies are on a spectrum of maturity. Many are racing to leverage AI and put it to use to be more efficient, but others are laggards, and might just be instructing their employees to go and purchase their own individual ChatGPT plans, for example. So there's a wide spectrum of how companies are using this. You want to understand what that looks like, and if you're advising clients on what good looks like, monitoring and inventorying the tools themselves seems a logical starting point for understanding the risk.
YVETTE ESSEN: Ben, you and I talked earlier about defence. How can you protect against internal threats posed by AI?
BEN STRICKSON: I'll try to keep this brief. I think we're likely to see a second generation of identity and access management tools. We'll get to the point with AI of being able to monitor how individuals or agents move around a company's network, and I think these tools will come out in the next year or so, giving security tools much greater observational data. That will be a real boon to defenders, I would argue, if you're able to monitor movement and access requests at a scale not previously seen.
YVETTE ESSEN: I have a question about the new European product liability directive, which comes into effect soon. Would you see this driving a change in where AI claims land in Europe, for example more in general liability covers than other lines of business?
JON LAUX: I'll start. Most of our comments so far have been about the technology and the framework, but there are definitely differences in how different geographies and jurisdictions are thinking about all this. In the cyber market, Europe has much less of the litigious tendency the United States does. What it has more of is regulatory excitement, we should say, and a willingness to be organised and come down on these organisations. I've already forgotten the acronym, but I know the law you're referencing. The important thing, as we'll see in how it plays out, is that there is potentially a strict liability standard that may apply depending on certain technology faults. That's a very different liability world. It's not negligence; you don't have to prove fault. It's just: this is now what's happening. I think it potentially blurs the lines between technology risk and things we would think of much more as product safety and general liability. Does either of you want to add?
BEN STRICKSON: It touches on consumer product regulations, where there are currently highly regulated products and we expect a lot of pre-release testing. I think we may see that in the software world, where pre-release there will be a greater expectation that you're doing a lot more vulnerability and security testing on your code than you were previously.
------------------------------------------------------------
CLOSE
YVETTE ESSEN: I'm afraid that's a wrap on our Q&A, and what a rich discussion we've had. Jon, John and Ben, thank you very much for sharing your insight and expertise today. It's given us a lot to think about. Thank you again to everyone who joined us and for your excellent questions; we really appreciate the time you've given us. If you'd like to find out more about us, visit our website, cybercube.com, or drop us an email at info@cybercube.com. Have a great rest of your day, and we hope to see you at our next webinar. For CyberCube, I'm Yvette Essen.
------------------------------------------------------------