Cyber Insurance & AI Tracker for MSPs

Expanded the definition of a "security failure or data breach" to include an "AI security event" and expanded the funds-transfer-fraud trigger to include fraudulent instructions via deepfakes or other AI. Announced March 26, 2024; folded into the base Active Cyber Policy in 2025.

Added a global endorsement (US, UK, Canada, Australia, Germany, Denmark, Sweden, France) providing technical forensics, legal takedown support, and crisis-communications support for AI-generated impersonation of executives and employees. Announced Dec 9–10, 2025.

Introduced a globally available cyber endorsement extending coverage for generative-AI risks for businesses building their own genAI models: data "poisoning," usage-rights/IP infringement, and regulatory violations arising from the EU AI Act. Reported October 2024.

Expanded the program: Beazley and Chubb joined founding partner Munich Re, offering affirmative AI coverage for Google-related AI workloads and using cloud-posture telemetry (Security Command Center / CIS Benchmark reports) for underwriting. For qualified digital natives, Beazley replaces the application with a single-page attestation. Announced at Google Cloud Next, April 2025.

Launched the first standalone Affirmative AI Liability Insurance covering AI underperformance (hallucinations, model drift, mechanical failures), with limits reaching $25M+ by Jan 2026. In Feb 2026 the "Vanguard AI" structure paired Chaucer’s cyber and tech E&O with Armilla’s standalone AI liability, a "conscious decision to partner rather than stretch cyber policies beyond their original intent."

Launched Prime One in the US, embedding AI-related risks (cybercrime, business interruption, data restoration, system failure, third-party liability from AI events) plus quantum risks directly into the base policy form rather than via exclusion or bolt-on. Introduced AI-risk "Cowbell Factors" rating for autonomy, observability, and governance. Launched Dec 2, 2025.

Launched three AI products: NOVAAI (liability/cyber for AI developers), PONTAAI (excess/DIC wrap where existing policies exclude AI), and RESCAAI (first-party response for organizations embedding third-party AI). Affirmatively covers IP infringement and discrimination. Launched Jan 14, 2025.

New standardized CGL exclusion endorsements CG 40 47, CG 40 48 (and CG 35 08 for products/completed operations) took effect Jan 1, 2026, giving carriers ready-made language to exclude bodily injury, property damage, and personal/advertising injury "arising from" generative AI. Verisk forms underpin the large majority of US commercial liability policies.

Introduced an "absolute" AI exclusion (reported as Form PC 51380) across D&O, E&O, and fiduciary liability, barring claims "arising out of" any "use, deployment, or development" of AI by any person or entity, reportedly naming tools like ChatGPT. Filed/reported late 2025, effective at renewal.

Filed requests with US regulators to exclude AI-related liabilities from various commercial policies; AIG reportedly told regulators generative AI is a "wide-ranging technology" where claims will "likely increase over time." First reported by the Financial Times, November 2025. Filing-stage; effective at renewal, jurisdiction-dependent.

Found 42% of respondents said their cyber policies already include exclusions tied to AI misuse or liability, and that 77% of insurers now require a formal internal/security-team review before issuing or renewing (up from 56% a year earlier).

A cyber insurer (a Chubb subsidiary) filed a subrogation action directly against an IT provider and an MSSP to recover exactly $500,000 it paid to insured CoWorx Staffing Services after an April 2024 ransomware attack. Alleges Congruity 360 failed to implement MFA for remote access and secure servers, and that Trustwave misclassified a detected event as "moderate," delaying response and preventing timely backups. Negligence + breach of contract. Filed Sept 15, 2025; recent and unresolved.

A court permitted Travelers to rescind a $1M cyber policy after a ransomware attack because the insured represented MFA was deployed across all systems when it was only at the firewall. Rescission applies even for unintentional/honest misrepresentation under the majority US rule. Court ruling 2022; widely cited through 2026.

Stated that underwriting AI use has changed: "It used to be, ‘Do you use AI and how do you use it?’ Now it’s, ‘What models are you currently utilizing?’" This indicates deeper, model-level questioning. Reported 2025 (Business Insurance).

Global cyber rates fell 5% year-on-year in Q1 2026 (following a 7% decrease in Q4 2025; US ~-2%; IMEA -14%), the seventh consecutive quarterly decline. Marsh notes AI-threat affirmative coverage and supply-chain covers are "under development."

AI rose to the No. 2 global business risk (32% of responses), up from No. 10, the biggest riser in the survey of 3,338 risk-management experts across 97 countries. Cyber remained No. 1 at its highest-ever score (42%). Published Jan 14, 2026.

Reports that MFA is "still table stakes" but "MFA everywhere with evidence" is the standard; EDR/MDR now means 24/7 monitored response; and that Marsh and Chubb have begun incorporating Zero Trust principles (least-privilege, continuous verification, segmentation, conditional access) into underwriting conversations. 2026.