AI Is Rewriting the Rules of Cybersecurity Risk for Insurers

Artificial intelligence has become both a risk and a resource in cybersecurity programs. Insurers use it to analyze data, automate processes, detect fraud, and help security teams identify threats faster. Attackers use many of the same tools to make fraud and social engineering more convincing and easier to scale. For insurance organizations, the stakes are high because they hold sensitive policyholder and underwriting information and process claims that can create strong incentives for fraud.

AI-related cyber risk can reach an organization well before it launches a formal AI initiative, whether through an employee using an unapproved generative tool, a vendor adding AI capabilities to an existing platform, or a fraud attempt using synthetic voice, images, or documents to evade normal review.

Regulators are already accounting for these risks, and boards are asking similar questions. Where is AI being used, what information does it touch, and how is that use being governed to ensure consumers are not negatively impacted and existing regulations are not being violated?

A Widening Attack Surface

AI can change how information is handled across an insurance organization without a new system implementation or major technology project. That makes it harder to maintain a complete view of where AI is being used and how it may affect existing controls.

Several areas deserve close attention:

• Shadow AI: Employees may use public generative AI tools for research, drafting, or analysis and enter proprietary or customer information into systems the organization has never reviewed.
• Third-party AI exposure: Vendors, MGAs, TPAs, and insurtech partners may add AI capabilities to products insurers already use, changing how those systems process information.
• Data use and retention: AI systems may retain or use information through prompts, logs, training data, or other inputs, raising questions about where data is stored and how long it remains available.

New York’s Department of Financial Services has specifically called attention to third-party exposure. Its October 2024 guidance notes that AI can help cybercriminals operate at greater scale and speed while also creating risks for organizations that rely on AI-enabled products developed by outside providers.

For insurers, that concern reaches into established vendor relationships. Claims administration platforms, telematics providers, MGA underwriting systems, and policy servicing tools can all gain new AI functionality over time. A system that was reviewed and approved several years ago may now handle information differently because of features added since the original assessment.

Third-party risk programs therefore need a way to account for changes within existing technology relationships as well as the introduction of new vendors.

AI in the Hands of Attackers

AI is making familiar attack methods more convincing and, in some cases, harder for employees to recognize.

Generative tools can help attackers create polished phishing messages in large volumes. Synthetic voice and video, known as deepfakes, can make impersonation attempts far more believable. The small warning signs employees once relied on, such as awkward wording or an unfamiliar voice, may no longer be present.

Consider a claims scenario in which someone calls shortly before a settlement and requests a change to payout banking information. The caller sounds like the policyholder and knows enough about the claim to make the request seem legitimate. With voice cloning and access to stolen personal information, an attacker may be able to get much further through a normal verification process than would have been possible a few years ago.

The same capabilities can support fraudulent claims through altered documents, AI-generated images, synthetic identities, and other fabricated evidence.

As these techniques improve, insurers may need to reconsider controls that depend heavily on an employee recognizing something as suspicious. Verification procedures can place more weight on the nature of the request, especially when money is being redirected, account information is changing, or an unusual action is being requested. Employees also need a clear path for escalating an interaction that feels inconsistent with normal activity.

AI as a Line of Defense

AI can also strengthen an insurer’s cyber and fraud defenses. AI-supported tools can help security teams analyze large volumes of activity, prioritize alerts, automate routine monitoring and response tasks, and identify unusual patterns that could be difficult to detect manually. Similar capabilities can support fraud teams by identifying connections across claims, transactions, or behaviors that may warrant further review.

AI-enabled defense tools require strong oversight as well. A fraud model trained on historical claims data may reflect weaknesses in that data, while an AI-enabled monitoring platform may depend on an outside provider that processes sensitive information or updates its technology over time.

Insurers need to understand what data these systems use, how access is managed, how outputs are reviewed before action is taken, and how vendors handle the information involved.

Johnson Lambert’s cybersecurity assessments already evaluate programs against recognized frameworks and regulatory requirements, including NIST, ISO 27001, and NYDFS Part 500. AI-related risk can be incorporated into that broader review of the organization’s cybersecurity environment.

Where Regulators Are Focused

Existing cybersecurity frameworks already provide much of the structure insurers need to address AI-related risk. 

NYDFS offers one of the clearest examples. Its October 2024 guidance applies the existing Part 500 framework to AI-related threats, including social engineering, third-party exposure, access controls, and incident response. It also directs covered entities to account for their own use of AI and AI technologies used by vendors when assessing cybersecurity risk.

Governance requirements also extend to how insurers use AI in the business. The NAIC Model Bulletin on the Use of Artificial Intelligence by Insurers establishes expectations for AI-supported decisions and the governance programs surrounding them, while New York Circular Letter No. 7 addresses AI systems and external consumer data used in underwriting and pricing. Both reinforce insurer responsibility for the technology it uses, including systems supplied by third parties.

Additional requirements depend on an insurer’s footprint and corporate structure. Colorado has established insurance-specific governance requirements for certain uses of external consumer data, algorithms, and predictive models. Its broader Automated Decision-Making Technology Act was revised in 2026 and takes effect January 1, 2027, with provisions addressing how the law interacts with insurance-specific requirements. Publicly traded carriers also need to consider existing SEC rules for material cybersecurity incidents and annual reporting on cybersecurity risk management and governance.

For insurers, the regulatory direction is becoming easier to see even as individual requirements continue to evolve. AI risk is increasingly being incorporated into cybersecurity and third-party risk management processes insurers already have in place. That makes it important to understand where AI is being used across the organization and whether existing controls still address the risks those uses introduce.

How Insurers Are Managing AI Risk

Johnson Lambert is already helping insurers understand where AI is in use, how it is being governed, and where existing controls need additional attention.

In one recent engagement, an insurer had already approved enterprise AI tools for employees to use. A Johnson Lambert assessment identified opportunities to strengthen governance around that use, including how the organization evaluated new applications of the technology and determined when additional review was needed. The engagement also identified opportunities to get more value from tools the insurer had already approved.

A separate carrier had established an AI task force and begun developing formal use cases. Our assessment identified areas where the organization could strengthen that structure and bring its approach into closer alignment with the NAIC Model Bulletin.

Across both engagements, the same governance question surfaced: How does an AI use case move from an idea into something the business can rely on?

That requires a record of how the use was evaluated, what risks were considered, and who approved it. A documented history gives the insurer a way to explain those decisions when a regulator, auditor, or board member asks.

Where to Start Assessing AI Risk 

A useful first step is identifying where AI is already in use, what information and systems it touches, and how those uses fit within existing cybersecurity and risk management processes.

From there, insurers can identify gaps in governance, documentation, third-party oversight, or cybersecurity controls and determine where additional attention is needed as AI use expands.

Johnson Lambert works with insurance organizations to assess cybersecurity programs against recognized frameworks and regulatory expectations, with AI-related risk incorporated into the review. If your organization is evaluating how AI fits within its cybersecurity environment, contact us today.

Frequently Asked Questions About AI and Cybersecurity Risks for Insurers

• What AI cybersecurity risks should insurers be watching? Insurers should pay close attention to employee use of unapproved AI tools, AI capabilities added by third-party vendors, data entered into generative systems, and AI-enabled fraud such as voice cloning, synthetic identities, altered documents, and phishing. These risks can affect existing cybersecurity controls even when an insurer has not launched a formal AI program. 
• How does shadow AI create cybersecurity risk for insurers? Shadow AI occurs when employees use AI tools that have not been reviewed or approved by the organization. An employee may enter policyholder information, internal documents, financial data, or other sensitive material into a public tool without knowing how that information will be stored, retained, or used by third parties.
• How can third-party vendors introduce AI risk? Vendors may add AI features to claims platforms, underwriting systems, policy servicing tools, or other technology that an insurer already uses. Those changes can affect how data is processed or retained, which means vendor risk assessments may need to be revisited as technology changes over time.
• How are cybercriminals using AI to target insurers? Attackers can use generative AI to create more convincing phishing messages, clone voices, produce synthetic video, alter documents, and fabricate images or identities. In insurance, these techniques can support fraud attempts involving claims, payment changes, account information, or impersonation of policyholders and employees.
• How can insurers use AI to strengthen cybersecurity and fraud detection? AI-supported tools can help security and fraud teams analyze large volumes of activity, prioritize alerts, automate routine monitoring, and identify patterns that may warrant further review. These tools still need oversight around data use, access, vendor management, and how results are reviewed before decisions are made.
• What AI regulations should insurers consider? The requirements depend on where an insurer operates, how it uses AI, and its corporate structure. Relevant guidance may include the NAIC Model Bulletin, NYDFS Part 500 and its AI-related cybersecurity guidance, New York Circular Letter No. 7, Colorado requirements, and SEC cybersecurity disclosure rules for public companies.
• How should an insurer begin assessing AI-related cyber risk? A strong starting point is to identify where AI is already being used, what information and systems it touches, and how those uses fit within existing cybersecurity and risk management processes. That review can help identify where governance, documentation, vendor oversight, or cybersecurity controls need additional attention.