Cyber insurance doesn’t stand still, so it was fitting that Zywave Horizon: Cyber Risk New York opened with an invitation to think rather than react. Welcoming more than 400 registrants, about 20% of them on the buy side, Zywave’s Jeff Cohen asked the room to listen to every session with one question in mind: “Is this taking me towards more productivity operationally, or is this taking me simply to more efficiency?”
As might be expected, AI ran through nearly every conversation, with conference co-chair Rich Goldberg of Constangy, Brookers, Smith & Prophete setting the tone for a day of spirited debate by calling AI “a new Frankenstein.”
AI Is Amplifying Familiar Attacks, and the Industry Is Split on What Comes Next
Carriers and tech experts largely framed AI’s impact as acceleration, not reinvention, of risk. Emily Licitra of Arch Insurance Group said, “AI is primarily amplifying existing cyber concerns, not necessarily creating new categories of loss,” and Craig Linton of Beazley said the end-to-end agentic attacks the market feared haven’t arrived: “We’re just not seeing a whole lot of those…or any of those, really.”
Others see the curve bending faster. Michael Phillips of Coalition forecasted that AI will increase business email compromise frequency 30 to 50 percent in 2027, noting that “in the last six months, we have alerted our clients to more zero days than we did in the combined last six quarters.” Kroll’s Natasha Vij said that vishing has displaced phishing, adding, “I actually can’t even remember the last time I had a phishing-related incident on my cases.”
An audience poll ranked agentic ransomware as the top AI threat for the next year, but Linton called the framing a “trick question”: deepfake vishing gets attackers in and agentic ransomware follows. “It’s all one thing.” Phillips said, expressing worry less over the headline catastrophe than “the frequency at scale,” while Linton agreed that lower severity would be no comfort if claims multiply. “It’s the attorney who lowers the hourly rate and bills ten times the hours,” he warned.
Speed Has Become the Control Gap
Jill Burkholder of CrowdStrike, formerly of the FBI and CISA, put it plainly: “What hasn’t changed is the playbook still works.” What has changed is tempo, with breakout time for cybercriminals accessing a system now under 30 minutes. Arch’s Licitra said the recent PHP vulnerability, dubbed by some observers the “vulnerability tsunami,” mattered less for severity than for scale and accumulation, and that carriers add value by scanning to pinpoint exposed insureds “before it becomes a claim.”
Underwriting expectations are following. Linton said patching is moving toward 24 hours, and that “if your attackers can move at machine speed, then you ought to be able to do so too.” Identity is the other pressure point: LevelBlue’s Ashim Kapur noted more than 90% of the cases his team sees involve MFA-enabled clients, yet attackers bypass it through token theft and voice phishing.
A Market at a Crossroads: Rates Down, Claims Up, and No Consensus on the Turn
QBE North America CEO Julie Wood opened with the growth case: U.S. cyber premium has risen from about $2.75 billion in 2020 to more than $8 billion, and claims from fewer than 10,000 in 2017 to nearly 60,000. But “cyber rates have been coming down, and loss ratios are now starting to inch up,” and pricing tools remain “relatively weak.”
The State of the Market panel weighed in on a market that faces some challenges. Licitra said a combined ratio near the high 90s “would certainly necessitate some rate increases,” though whether the market responds is another question. RPS’s Steve Robinson agreed, citing new capacity willing to write accounts for 40% less. Brown & Browns’ Britt Eilhardt said brokers are “playing the role of therapists with underwriters more than we ever have before,” yet buyers “have a sunny outlook, and they should.” Lockton Re’s Brian Lewis flagged coverage creep and SME accumulation risk, while Malone of AXA XL hoped for stabilization. “I don’t think anyone wants any sort of shock events that…see rates go 50, 100%,” he said.
Inside the Extortion Economy: Fragmentation, Hard Choices, and Geopolitics
Lauren Winchester of Travelers moderated a panel that put numbers to a fragmenting ecosystem: 2,274 victims on ransomware leak sites in Q2 2026, up 53% year over year, across a record 89 active groups. Kapurr said roughly 40% of LevelBlue’s cases are now pure data exfiltration with no encryption. Chaintrax Cyber’s Don Wyper noted that when one group, Luna Moth, was itself hacked, the leaked chats exposed victims who had paid for silence, and urged clients to remember the data is “relatively worthless” to attackers.
Panelists offered up debate on some of the toughest calls for cyberattack victims. On paying for suppression, AXA XL’s Gwen Cujdik said every case is fact-specific but “when the data is out the door, you’ve already lost,” while Wyper advised taking any promise of suppression “with a grain of salt.” On the geopolitical front, Burkholder walked the audience through this year’s Iranian-affiliated targeting of U.S. water-systems in 12 states. The utilities are easy targets, often public-facing with default credentials and no MFA.
Growth Depends on Making Cyber Simpler to Buy and Easier to Sell
QBE’s Wood urged “the advisor that’s trying to provide resiliency and rebuild communities” and added that from a non-cyber perspective, the industry complicates the purchase of cyber with lengthy applications. RPS’ Robinson put SME penetration below 25 percent and advocated for brokers moving cyber “from what’s currently an opt-in to an opt-out” by baking quotes into every property and casualty presentation, focused less on scare tactics and more on operational resiliency. A roundtable discussion later in the day zeroed in on simplifying the cyber product to boost take-up by small businesses, offering a first look at new Lloyd’s Market Association language,
For a sustainable 2027, panelists pointed to educating retail agents, vetting carriers’ claims track records, and more data sharing from underwriters to brokers. Wood framed talent the same way: students respond to a job that is “recession proof” with “tons of variety,” and attracting them “is on all of us.”
Up Next – Join Us March 4 for Zywave Horizon: Casualty Conference
If you missed the conversation at Zywave Horizon: Cyber Risk NYC, our 2027 line-up of Horizon thought leadership events is around the corner. Up first: the Zywave Horizon: Casualty Conference in New York City on March 4, 2027, headlined by an opening keynote from Steve Hearn, Executive Vice President, Chief Operating Officer & President – Retail Segment at Brown & Brown. Early bird registration is open, with complimentary registration offered to full-time Risk Managers and Insurance Buyers as a courtesy from Zywave.
