The Next Cyber Insurance Claim May Start With Authorized AI

Jay Bavisi is the Founder, Chairman, and Group CEO of EC-Council, a global leader in AI governance and cybersecurity education.

​In the current insurance landscape, underwriters know how to ask about stolen credentials, ransomware, unauthorized access, data theft and the controls that reduce those risks. That work is still needed. In fact, the cyber insurance industry has spent decades getting better at measuring compromise.

In a world where IBM’s “Cost of a Data Breach Report 2026” put the global average breach cost at $4.99 million, up 12% from the prior year, AI agents create a different level of exposure because a system can create material loss while using valid credentials, following an approved workflow and operating inside the authority the business gave it.​

Gartner predicts that by 2028, one-third of interactions with generative AI services will use action models and autonomous agents to complete tasks. As more of those agents move into business workflows, cyber risk will include what authorized systems are allowed to do when they are operating normally.​

Two companies can use the same model and carry very different levels of risk. One may only read information and recommend a next step. Another may send emails, approve transactions, modify customer records, change identity policies or call another automated system. For insurers, model choice is only part of the assessment. The authority attached to the system determines how a mistake becomes a loss.​

Set an authority budget.

The question should be whether the marginal utility of giving an agent more authority justifies the additional exposure. If a recommendation produces most of the business value, allowing autonomous execution may add little utility while significantly increasing the consequence of failure.​