As AI-Driven Attacks Spread, How Much Does Cyber Insurance Cover?

A single hack can hit multiple companies
From attacks on customer-facing systems to cloud outages
Cyber insurers wary of "simultaneous losses"

As cyberattacks become more sophisticated and the risk of losses spreading across multiple companies grows, insurers are finding it increasingly difficult to assess the scale of potential losses and determine the scope of coverage. Overseas, some insurers have begun explicitly including AI-related cyber risks in their coverage, while concerns are also mounting that attacks on shared infrastructure, such as cloud services, could lead to losses for numerous companies. Although South Korea's cyber insurance market is growing, industry observers say insurers need to strengthen their ability to assess and underwrite emerging risks, as loss data that could be used for underwriting and other purposes remains insufficient.

According to the insurance industry on October 8, global specialty insurer CFC recently added wording to an insurance product for financial institutions explicitly covering cyber risks involving AI. The aim is to reduce uncertainty over coverage by specifying in the policy whether such cyber risks are covered. The policy also covers existing cyber risks, including ransomware, financial fraud and business interruption.

CFC also offered a hypothetical example of how AI-related coverage could apply: a financial company's AI customer service system is attacked, resulting in the exposure of customer information. If an attacker manipulates the AI system to disclose sensitive customer information to a third party, and the incident qualifies as a covered cyber event, the policy could provide specialized support for responding to the incident, the company said.

One risk factor is that the impact of cyber incidents can spread beyond the affected company to others. An attack on a cloud service or data center shared by multiple companies could also disrupt the operations of other businesses. According to a survey released last month by global property insurer FM and Economist Enterprise, 88% of 1,800 senior executives in data center-related industries across 21 countries said cyberattacks could affect digital infrastructure as a whole. "We need to understand how many companies use the same infrastructure," one industry official said. "Looking only at the security of individual companies makes it difficult to estimate the maximum losses that could result if a single incident spreads to multiple businesses."

South Korea's cyber insurance market is expanding. The number of corporate cyber insurance policies reached 7,683 last year, up 42% from 5,406 the previous year. Direct premiums written also rose 68%, from 47.8 billion won in 2021 to 80.1 billion won last year. However, industry observers say insurers need to strengthen their risk assessment and underwriting capabilities, as it is difficult to set premiums and coverage limits for risks with little claims experience or statistical data, such as new attacks using AI or large-scale infrastructure outages.

"When a company is hacked, its immediate priority is to restore its systems and resume normal operations, but in some cases it is difficult to know exactly which costs will be covered by insurance," a financial industry official said. "With limited incident data, an outage affecting shared infrastructure such as cloud services could prompt multiple companies to file insurance claims at once, so coverage and exclusion criteria for such large-scale risks must be set carefully." The official added, "Cyber insurance will increasingly play an important role in providing support for initial investigations, recovery and legal responses before losses escalate after an incident."

This content was produced with the assistance of AI translation services.