In Partnership with
AI supercharges Australia’s cyber insurance risk
Underwriters explain how machine-driven attacks, falling premiums and shifting business email fraud are reshaping cover for Australian SMEs in 2026
Michael Lewis
CFC
Industry experts
Trent Nihill
Coalition
Anthony Wall
Cowbell
As cyber development manager, Michael Lewis supports CFC’s strategy for driving growth and innovation throughout the Australian market, while providing valuable solutions to clients facing the cyber threat landscape. He serves as a key contact for brokers in Australia, providing in-person education and broker training to help build confidence in cyber risks. A seasoned insurance professional, Lewis has 15 years of experience across underwriting, cyber and business development. His career began in underwriting before transitioning into the world of business development where he worked with both large insurers and underwriting agencies.
CFC
Michael Lewis
Trent Nihill is a seasoned risk professional with nearly two decades of experience in the Australian and London insurance markets. For the past seven years, he has focussed exclusively on cyber insurance underwriting. Nihill currently serves as general manager for Australia at Coalition, where he was one of the first local hires. Prior to this role, he held positions of increasing responsibility at domestic and international carriers and agencies.
Coalition
Trent Nihill
Anthony Wall is head of underwriting, Australia, at Cowbell Australia, a leading provider of AI-powered cyber insurance for small and medium-sized enterprises. He leads Cowbell’s Australian underwriting strategy, bringing deep expertise in cyber risk, financial lines and broker relationships. Throughout his career, Wall has worked across the Australian and US insurance markets, developing and underwriting cyber solutions for businesses of varying sizes and risk profiles. Before joining Cowbell, he served as cyber practice lead at AIG and held senior cyber underwriting roles at Munich Re and Chubb, with earlier experience at Liberty International Underwriters and Aon.
Cowbell
Anthony Wall
“There are many examples of how threat actors use AI now, and they are exploiting new vulnerabilities quicker than they ever have before”
Anthony Wall,
Cowbell
CYBERCRIMINALS USED to need time. A phishing campaign took planning, a systems vulnerability took patience to find, and a convincing scam took a subtle human touch. AI has removed most of that friction, and Australia’s cyber underwriters are watching the gap between attack and defence close in real time.
That shift is forcing insurers to rethink how they price, underwrite and respond to a risk that no longer moves at human speed. Premiums are falling even as attacks multiply, cover is broadening even as wordings diverge, and small businesses remain exposed despite ranking cyber as their number one concern. Insurance Business TV spoke to experts in the area at a recent Executive Insights panel to hear their views.
“A lot of our policies now are actually less than what I pay for my car insurance. The market has changed. It’s more competitive than it used to be”
Trent Nihill,
Coalition
Michael Lewis, Australian cyber development manager at CFC, takes a more measured view of what AI actually changes about the underwriting task itself.
“Cyber insurers are insuring the outcomes, not the technology used to facilitate it,” said Lewis. “AI is just a tool that defenders or attackers are using, not the attack itself or the outcome from the attack.” In his view, well-built cyber policies were already positioned to absorb AI-enabled losses long before the technology had a name.
That doesn’t mean the human side of the equation has caught up. Deepfake attacks have been seen by 59% of organisations,
“SMEs understand they have a cyber risk,” said Lewis. Surveys CFC has run recently show Australian small businesses rank cyber as their number one business risk, ahead of almost everything else on the list. What’s missing is the link between knowing that and acting on it.
Part of the problem, in his view, is that headline breaches distort what a typical claim looks like. “The reality is most of the cyber claims that we see are much more ordinary,” he said. “It’s phishing emails or invoice manipulation, email compromises. They’re not always newsworthy but incredibly disruptive.”
Nihill hears a version of the same reluctance directly from business owners, tied partly to embarrassment. “I think the
Wall noted the industry has quietly dropped something it used to offer freely, even as the AI-driven threat has grown. “It wasn’t that long ago when every insurer provided some level of free awareness training, but this seems to have changed,” he said, arguing it belongs back at the centre of prevention rather than at the edges.
Claims handling matters more than the premium Once an incident lands, all three underwriters argue the premium a client paid becomes close to irrelevant, and the response speed becomes everything.
“Nobody remembers the premium they paid when they’re in the middle of a ransomware attack at 2 am,” said Lewis. “What they remember is when someone picked up the phone and went through the triage.” For SMEs without an internal security team, that early response can determine how quickly a business recovers.
Nihill put it bluntly. “You’re paying for a promise,” he said. “The claims service is that promise.” He argues brokers should weigh recommendations toward insurers with strong pre-loss monitoring as much as strong post-loss response, since preventing a claim outright beats resolving one well.
“There are many examples of how threat actors use AI now, and they are exploiting new vulnerabilities quicker than they ever have before,” said Anthony Wall, head of underwriting, Australia, at Cowbell. “Automation and AI are now standard tools in phishing campaigns, too, which means the volume of attempts SMEs face has grown alongside their sophistication.”
Trent Nihill, general manager for Australia at Coalition, sees the same acceleration in raw numbers. “The AI revolution means we’re seeing more vulnerabilities found in the last couple of months than we have seen in the last couple of years before that,” said Nihill.
According to the 2026 Thales Data Threat Report, 70% of security professionals now cite the pace of change within AI ecosystems as their single greatest AI-related risk, ahead of concerns about trust, confidentiality or data availability.
Insurers are fighting fire with fire If attackers are moving faster, insurers argue they have no choice but to match the pace, and all three panellists describe building AI directly into how they assess risk.
challenge is at times cyber incidents for these small businesses are kind of seen as they’ve done something wrong,” he said. Quietly resolved incidents at uninsured firms simply never surface, keeping the perceived odds of an attack artificially low.
On price, Nihill offered a number most brokers would not expect. “A lot of our policies now are actually less than what I pay for my car insurance,” he said. “The market has changed. It’s more competitive than it used to be.”
Wall added, “Whilst businesses see the exposure, we see a real lack of urgency to go out and actually buy the policy.”
His fix is to shift the conversation toward outcomes rather than controls. “It’s a great time for SMEs to buy cyber,” he said, arguing that value-added services now often outweigh the premium itself.
AI concerns are increasing among security and IT management professionals
“The days of just relying on traditional proposal forms are over,” said Wall. Cowbell has built scanning tools and dark web monitoring into its underwriting process, alongside in-house teams dedicated to tracking the threat landscape as it shifts.
“At Cowbell, we bring together AI, data science, industry risk signals, dark web intelligence and external attack surface monitoring to build a detailed, continuously updated view of an organisation’s cyber risk. We call the resulting ratings Cowbell Factors,” he said.
The same Thales research shows why insurers feel the pressure: 61% of organisations now report their AI applications are being directly targeted by attackers, with sensitive data the leading prize.
and AI-generated misinformation now ranks as the second fastest-growing attack type behind credential theft, per the Thales data. Close to half of all organisations (48%) report suffering reputational damage directly attributable to AI-generated misinformation.
Read on
Getting the basics right while AI raises the stakes Sophisticated attacks make headlines, but every underwriter on the panel insists the fundamentals still decide most outcomes.
Lewis put a number on it, saying that “75% of the incidents we see are from human error or driven by human error, like clicking on a malicious link, approving a fraudulent payment process, whatever it is, sharing credentials.”
Nihill agreed the basics are being tested daily, regardless of how advanced the attacker’s toolkit has become. “We’re still seeing clients clicking on obvious phishing links, not putting MFA in place, not patching,” he said. “The simple things still work.”
More than half of Coalition’s claims now originate in the inbox through business email compromise, which prompted the insurer to act. “We actually launched a tool for our customers last month called Login Security; it provides identity threat detection and response,” said Nihill. “We’re giving that tool away for free because we think the investment in our customers’ security is going to pay back in the claims savings.”
Wall stressed the same principle from the vendor side, noting a business without in-house maturity depends entirely on the experts an insurer brings in. “Without a good claims handler, you can have a lot more problems down the track,” he said. Early engagement with legal counsel, forensics and incident response specialists, in his experience, separates a contained incident from a prolonged one.
A rare disagreement over wordings For all their agreement on AI’s acceleration of risk, the panel split over how the industry should respond to one of its side effects: a growing tangle of policy wordings that even brokers struggle to compare.
Nihill was the one prepared to break ranks in favour of some uniformity. “I think there’d be some benefit from some standardisation [of policy wordings].” His argument centres on language rather than cover itself.
“A good example is contingent business interruption,” he said. “Some markets will call that contingent business interruption, it could be dependent business interruption, or it could be supply chain cover. They all kind of mean the same thing, but then the devil’s in the detail, and they can be named the same but also cover different things.”
CFC is a specialist insurance provider and a pioneer in emerging risk and a market leader in cyber. Our global insurance platform uses cutting-edge technology and data science to deliver smarter, faster underwriting and protect customers from today’s most critical business risks. Headquartered in London with offices in New York, San Francisco, Austin, Toronto, Brussels, Sydney, Melbourne, Perth and Brisbane, CFC has over 1,000 employees and is trusted by more than 250,000 businesses in 100 countries. Learn more at cfc.com and LinkedIn.
Find out more
Cowbell is a pioneer in adaptive cyber insurance, helping Australian SMEs manage evolving digital risk with confidence. Its cyber insurance program, Prime One, combines fast online quoting with practical risk insights powered by Cowbell Factors™, local underwriting and claims support and 24/7 incident response. Written on Zurich Australian Insurance Limited paper, Prime One protects businesses with annual revenue up to $100 million. Every policy also includes Cowbell Resiliency Services, providing cybersecurity tools, training and expert guidance to strengthen resilience before, during and after an incident. Founded in 2019, Cowbell operates across Australia, the United States, Canada, India and the United Kingdom.
Find out more
Coalition is the leading provider of cyber insurance and security, combining comprehensive insurance and proactive cybersecurity tools to help businesses manage and mitigate cyber risk. The company created the active insurance category to provide active cyber risk assessment, protection, response and coverage to Australian businesses. Coalition’s cyber risk management platform provides automated security alerts, threat intelligence, expert guidance and cybersecurity tools to help businesses remain resilient in the face of cyberattacks.
Find out more
Share
Published 6 Oct 2026
“Nobody remembers the premium they paid when they’re in the middle of a ransomware attack at 2 am. What they remember is when someone picked up the phone and went through the triage”
Michael Lewis,
CFC
Organisations reporting AI applications are being targeted by attackers, with sensitive data as the leading target
61%
Organisations reporting deepfake attacks
59%
Organisations reporting reputational damage as a result of AI-generated misinformation
48%
Source: 2026 Thales Data Threat Report
Top three concerning AI security risks among cybersecurity professionals in 2026
Source: 2026 Thales Data Threat Report
Ecosystem changes
70%
Trust
58%
Confidentiality
46%
0%
10%
20%
30%
40%
50%
60%
70%
Wall sees the same fragmented market and reaches the opposite conclusion. “Full standardisation isn’t realistic or even desirable — insurers’ price and structure cover differently because they assess risk differently, and standardising a wording down would slow genuine innovation,” he said.
His advice is to narrow the field rather than wait for consensus. “If I had to put my broker shoes on, I would really focus on computer crime,” said Wall. “Having just social engineering fraud is not enough anymore. You really need to cover reverse social engineering, invoice manipulation and loss of third party i.e. funds.”
Lewis agreed uniform wording would cost the market something it can’t afford to lose. “I understand why standardisation sounds attractive, but I’m not convinced it’s
the answer,” he said. “Innovation’s been probably the defining feature of cyber insurance.”
Businesses are more resilient, but attackers are stronger The panel’s closing question drew the most useful answer for brokers advising clients on where they genuinely stand against an AI-accelerated threat.
Nihill has watched the baseline shift over a decade in the sector. “Looking at when I started doing cyber about 15 years ago, if you saw a client that had MFA, that was a godsend,” he said. “Now most businesses have decent baseline controls.”
His caveat is that attackers have improved just as fast, and businesses outsourcing IT to a managed service provider can develop a false sense of who is actually responsible for what.
Wall agreed progress is real but pushes back on how far it’s travelled. “A lot of MSPs (managed service providers) manage many, many clients,” he said. “They have thin margins. They’re often not cybersecurity experts.” Businesses cannot outsource their liability along with their IT support, in his view, even if they believe they have.
Lewis closed with the line that sums up the whole conversation. “It’s the old Mike Tyson adage, everyone’s got a plan until they get punched in the face,” he said.
Resilience has nothing to do with whether a business has avoided an attack so far. “Don’t measure resilience by whether you’ve avoided an attack,” he said. “It’s the measurement on how effectively you would respond if one happened tomorrow.”
Why so many small businesses still go without cover
Faster, AI-enabled attacks would matter less if Australian SMEs were broadly covered. They are not, and Lewis puts the disconnect down to relevance rather than ignorance.
