In Partnership with

Hackers upgrade. Has your cyber policy kept up?

With AI-fuelled threats exploding, brokers must rethink cyber insurance strategies

Clay Stabert

Sompo

Industry experts

Emily Licitra

Arch Insurance

Matthieu Chan Tsin

Cowbell

Clay Stabert is senior vice president, cyber product manager, Sompo Pro, Sompo North America. In this role, he is responsible for product development, setting the appetite, creating underwriting standards through assessing risk, industry forecasting, and portfolio management. Prior to joining Sompo in 2021, he was most recently with Chubb, serving as national cyber underwriting manager in their property and casualty division. Before that, he held various underwriting and product roles within their professional and management liability units. Stabert graduated from the University of Massachusetts – Amherst with a bachelor’s degree in advertising management.

Sompo

Clay Stabert

Emily Licitra is the vice president, professional liability of the northeast and southeast regions for Arch Insurance. In this role, she is responsible for overseeing the East Coast team for the cyber liability department within professional liability. Licitra’s group considers cyber, technology E&O, and miscellaneous professional liability for a diverse range of revenue and industry classes. After graduating from the College of the Holy Cross in 2014, she joined Arch Insurance as an underwriting trainee. Her career has developed within Arch over the last 11 years; she has been vice president since 2022.

Arch Insurance

Emily Licitra

Matthieu Chan Tsin is vice president, cybersecurity services at Cowbell. He holds a PhD from Purdue University and is an expert in cybersecurity and intelligence. Before working at Cowbell, he held senior positions at AIG, in the intelligence community, and in academia. He has authored and contributed to academic and government reports on cyber and military topics. He has lived and worked in over 11 countries.

Cowbell

Matthieu Chan Tsin

“We’ve definitely seen a shift in the maturity and sophistication [with which] criminals are able to manipulate our insureds and get into their networks”

Emily Licitra, Arch Insurance

IN A world that’s increasingly digitized, where cybercrime is a daily threat and ransomware attacks are on the rise, cyber insurance is fast becoming a main priority for brokers and organizations alike. Earlier this year, the World Economic Forum released its much-anticipated Global Cybersecurity Outlook 2025 – a comprehensive analysis of the growing complexities within the digital landscape and the challenges these pose for companies and governments across the globe. The report found that 54 percent of large companies cite supply chain risks as the biggest barrier to achieving cyber resilience, with one-third of CEOs adding that cyber espionage and intellectual property theft are keeping them awake at night. Furthermore, 66 percent of organizations say AI will have a major impact on cybersecurity this year, although only 37 percent of firms have established processes to evaluate the security risks of AI tools before deploying them.

“There’s a lot of noise in cyber. Cyber insurance companies and carriers can really help brokers cut through the noise and carry that message to the end users”

Matthieu Chan Tsin, Cowbell

Another area of increasing concern revolves around supply chains – an area in which risks are notoriously difficult to predict and subsequently control. According to the report, 54 percent of large companies consider supply chain risks to be the biggest barrier in securing cyber resilience. “The increasing complexity of supply chains coupled with a lack of visibility and oversight into the security levels of these suppliers, has emerged as a leading cybersecurity risk,” added Licitra. “It’s important to focus on having an understanding of their redundancies and making sure that there are multiple suppliers should one of them experience an issue.”

Licitra also cited the need to understand responsibility in relation to security controls. She told IB that while there’s a shared responsibility between the vendor and the insureds, the latter also have a responsibility to understand what their controls look like – making sure they have the resiliency measures in place. And Chan Tsin agrees, going one step further in adding that it’s about holding providers to the same standard as vendors. “One of the main shifts in understanding the cyber and modern supply chain is that the relationship goes beyond the services themselves to include how the services are being rendered,” he explained. “Therefore, it’s crucial for any business or policyholder to hold service providers accountable for cyber security and to

firms’ understanding of AI and subsequent risks is something of a mixed bag – especially in relation to how it’s attributed to insurance solutions. “At Sompo, we address these exposures in a two-pronged approach,” he explained. “Are our insureds utilizing technology to provide a service or to make a product? Or are our insureds actually building an artificial intelligence solution? Both of these are addressed within our technology services ensuring agreement. However, the underwriting of those risks is very important. For underwriting issues that could include copyright and trademark infringement, [it’s about looking at] what type of information is built into these artificial intelligence models and how they’re spitting that information back out to the user. Are they using protected information from a copyright and trademark infringement perspective?”

A detailed IT Security Risk Assessment concept depicted with a magnifying glass focused on

“Ransomware continues to be top of mind in the insurance community,” said Stabert. “At Sompo, we’ve seen increased frequency in ransomware events, which is certainly not a good thing. However, the positive is that the severity has also inversely gone down. So, while we continue to see ransomware as a difficult issue to address from a cyber insurance perspective, we have been able to achieve better outcomes from a payment perspective for ransomware. That means that our insureds are better

hold them to the standards which apply to every single client – especially for businesses which operate in regulated or critical infrastructure sectors.” It’s a case of knowing not just your customer but your vendor, too. Insureds have to check in with both parties to ensure that nothing falls through the cracks and policies are as up to date and secure as possible – something Stabert knows all too well. “In theory, it makes sense for some insureds to utilize a vendor, therefore allowing them to handle the information, to keep it private, rely on their uptime, set it and forget it,” added Stabert. “In actuality, it’s more of a ‘trust but verify’ model that we have at Sompo. We want our insureds to utilize vendors, but also understand the controls, the policies and procedures that the vendors have in place to protect our insurance information. One way in which I think the brokers, the clients, and Sompo can all work together to better inform each other is off cycle. We don’t look at insurance transactions as a ‘set it and forget it’ approach – we want to be involved with our insureds as often as possible throughout the policy year to help improve any controls that they might have.”

AI threats a primary risk factor

controlled through [enhanced] backups, they understand their systems better – and so we’re able to respond [faster].” While threat actors are not a new risk, they are becoming more and more advanced in their criminal activities. According to the report, 47 percent of organizations view generative AI-powered threats as a primary risk factor. “We’ve definitely seen a shift in the maturity and sophistication [with which] criminals are able to manipulate our insureds and get into their networks,” explained Licitra. “They’re able to outpace the traditional defenses that we’ve seen in the last few years.”

Read on

At Sompo, it’s a similar playing field. Considering Gallagher’s report, Stabert agrees with the notion that

added Licitra. “[However], it’s important to continue to focus on what other things carriers are offering and what other value they could provide. A good example of this is understanding the claims process on the carrier side – having the claims experience be a point of differentiation is huge because it all boils down to how your insurance will react to a potential issue. You want to ensure that you’re partnering with a claims team that is obviously flat, fast, and flexible.” For Chan Tsin, the future is bright, but it’s important to shut out the chaos in the market and embrace the true role of brokers. “Be a liaison, be a facilitator between a policyholder and the carriers. There’s a lot of noise in cyber. Cyber insurance companies and carriers can really help brokers cut through the noise and carry that message to the end users,” he said. And as Stabert reminds all professionals, to succeed in the coming years, it’s essential that the insurance community continue to lead the way. “The insurance community at large, from a cyber perspective, started top down – the multinationals [and] the publicly traded companies bought cyber insurance first. It then trickled down into the middle market. There’s a tremendous amount of opportunity for us as insurance professionals to influence, to educate, and to ultimately convert non-buyers in the small business space.”

Arch Insurance is a market-leading insurer, providing a wide range of property, casualty, and specialty insurance options for corporations, professional firms, and financial institutions across the US. Our approach to doing business is based on collaboration, responsiveness and commitment. Together with our business partners, we pursue better ways of doing things and designing more effective solutions to respond to the needs of our customers.

Find out more

Cowbell is a leader in Adaptive Cyber Insurance, offering SMEs and middle-market businesses AI-driven coverage tailored to evolving threats. Its continuous underwriting platform streamlines the insurance process to under five minutes. Backed by 25 global (re)insurance partners, Cowbell serves businesses with revenues up to $1 billion across the US, the UK, and beyond. It also provides cybersecurity services through Cowbell Resilience Services (CRS). Founded in 2019, Cowbell is based in the San Francisco Bay Area, with a global team across the US, Canada, India, and the UK.

Find out more

We are Sompo, a global provider of commercial and consumer property, casualty, and specialty insurance and reinsurance. Building on the 130 years of innovation of our parent company, Sompo Holdings, Sompo employs approximately 9,500 people around the world who use their in-depth knowledge and expertise to help simplify and resolve complex challenges. Because when you choose Sompo, you choose The Ease of Expertise™.

Find out more

In Partnership with

M&A Insights 2021

Insurance Business America uncovers the answers to brokers’ biggest questions about mergers and acquisitions, with expert insight from MarshBerry, Baldwin Risk Partners and Relation Insurance

Read on

Phil Trem

MarshBerry

Timothy J. Hall

Relation Insurance

Gerard Vecchio

MarshBerry

Industry experts

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Tellus in penatibus condimentum malesuada ante vulputate nisi, arcu leo. Amet urna sapien purus vestibulum fermentum a. Cursus metus massa donec sed varius. Nunc enim sit morbi lacus, molestie et nunc. Nullam sed facilisi id malesuada. Ante purus velit, quam scelerisque ultrices scelerisque donec. Velit egestas vel ornare pellentesque ridiculus. Mauris tempor augue quis mattis suspendisse feugiat commodo posuere. Faucibus massa adipiscing nullam elit, ac vel accumsan. Phasellus eget ac dignissim fermentum ac placerat elit, metus. Nulla porttitor ante egestas molestie quis quam. Pharetra magna sit mauris tellus gravida rutrum libero sit. Justo orci cras euismod proin massa lorem ut. In non tellus phasellus faucibus ullamcorper nullam odio dui et.

Mashberry

Gerard Vecchio

Relation Insurance

Timothy J. Hall

Mashberry

Phil Trem

In Partnership with

M&A Insights 2021

Insurance Business America uncovers the answers to brokers’ biggest questions about mergers and acquisitions, with expert insight from MarshBerry, Baldwin Risk Partners and Relation Insurance

Read on

Phil Trem

MarshBerry

Timothy J. Hall

Relation Insurance

Gerard Vecchio

MarshBerry

Industry experts

Mashberry

Phil Trem

Relation Insurance

Timothy J. Hall

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Tellus in penatibus condimentum malesuada ante vulputate nisi, arcu leo. Amet urna sapien purus vestibulum fermentum a. Cursus metus massa donec sed varius. Nunc enim sit morbi lacus, molestie et nunc. Nullam sed facilisi id malesuada. Ante purus velit, quam scelerisque ultrices scelerisque donec. Velit egestas vel ornare pellentesque ridiculus. Mauris tempor augue quis mattis suspendisse feugiat commodo posuere. Faucibus massa adipiscing nullam elit, ac vel accumsan. Phasellus eget ac dignissim fermentum ac placerat elit, metus. Nulla porttitor ante egestas molestie quis quam. Pharetra magna sit mauris tellus gravida rutrum libero sit. Justo or24ci cras euismod proin massa lorem ut. In non tellus phasellus faucibus ullamcorper nullam odio dui et.

Mashberry

Gerard Vecchio

‘Be a liaison, be a facilitator’

Published Apr 24, 2025

“Ransomware continues to be top of mind in the insurance community”

Clay Stabert, Sompo

Source: World Economic Forum: Global Cybersecurity Outlook 2025

47% of organizations see generative AI-powered threats as a primary risk factor

66% of organizations lack the talent necessary to meet current cybersecurity demands

Only 14% of leaders have confidence in their workforce’s capabilities

66% of leaders believe AI will have a major impact on organizations in 2025

Source: World Economic Forum: Global Cybersecurity Outlook 2025

57% of large companies cite supply chain risks as the biggest barrier to achieving cyber resilience

CEOs reveal cybercrime concerns

1/3 of CEOs think cyber espionage and intellectual property are major threats

The cybersecurity skills gap has widened by 8% since 2024

45% of leaders are focused on the potential disruption of critical business operations

In a recent roundtable, Insurance Business was joined by Emily Licitra, VP of professional liability at Arch Insurance; Matthieu Chan Tsin, VP of cybersecurity services at Cowbell; and Clay Stabert, RPLU, SVP, cyber product leader, Sompo Pro, Sompo North America, to discuss the report’s findings and what this analysis really means for firms in the coming months.

Ransomware and threat actors increasingly sophisticated

Supply chain concerns: A shift in responsibilities?

In Gallagher’s recent 2025 Cyber Insurance Market Conditions Outlook, the firm noted there had yet to be absolute clarity on AI driven perils. However, there is evidence that cyber markets are beginning to evolve to reflect those emerging risks. As such, organizations need to be one step ahead – looking at addressing any ongoing risks and identifying potential new ones. “At this time, it’s crucial to understand that the use of AI for malicious purposes is not creating new threats,” said Chan Tsin. “Rather, AI is being used to accelerate and improve the deployment of existing threats.”

He added that, when considering AI use, firms are currently seeing two kinds of risks: one is associated with a firm’s internal use of AI, which can lead to privacy violations or security concerns, and the other is that AI can also be used to assist malware developers in evading detection and reconnaissance of targeted networks. At Cowbell, Chan Tsin says they’re adapting to these risks accordingly. “Because we understand that AI is not creating new threats, it’s improving actors’ capabilities, we’re not releasing AI specific insurance products,” added Chan Tsin. “We’re partnering with security vendors to educate policy holders and brokers, to provide them with security solutions that’re created specifically to decrease detection times and decreased response times. For example, managed detection and response (MDR) solution, penetration testing (pen testing) solution, and cybersecurity awareness training.”

‘AI is not creating new threats – it’s improving actors’ capabilities’

Understanding underwriting risks in AI

Looking ahead to what the future holds for brokers and cyber in 2025 and beyond, one sees a complex and as yet unknowable landscape. With AI and automation evolving at an exponential pace, firms have to keep their finger on the pulse or risk falling behind, especially where client care is concerned. “In this market, it’s easy to view a successful outcome as getting the best possible price and coverage for your client,”

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Specialty

Best in Insurance

Resources

Risk Management

News

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Specialty

Best in Insurance

Resources

Risk Management

News

RSS

Sitemap

About us

Conditions of Use

Terms & conditions

People

Specialty

Best in Insurance

Resources

Risk Management

News