Your Business Started Using AI. Here Is What It Does to Your Insurance.

By Toby Hartman, MM Insurance Associates

I sat in three meetings last month where the owner told me, almost as a side comment, that his team had started using AI for something. Writing customer emails. Answering questions on the website. Putting together estimates. Nobody brought it up as a risk topic. It came up the way you mention a new phone system.

I think that is fine. These tools save real time and I use them too. But I have been doing this for twenty years, and every time businesses pick up a new way to move money and information, the losses follow about a year later. So I want to walk you through what I am actually seeing, and what it means for your coverage.

The scam has not changed. The quality of it has.

The most common cyber claim I deal with is not a hacker breaking into a network. It is someone on the team being talked into sending money to the wrong account.

The FBI logged 21,442 business email compromise complaints in 2024, with about $2.77 billion in reported losses, on top of 193,407 phishing complaints. One large cyber insurer reported that roughly 60 percent of its claims came from business email compromise and funds transfer fraud, and that 29 percent of those actually ended with money leaving the account.

What is different now is how good the fake looks. The bad grammar that used to give it away is gone. The email references the real job you are working on. The voice on the phone sounds like your controller because it can be copied from a thirty second video. I tell clients that the tell is no longer how the message reads, it is what the message asks for. Anything that says pay this today, or our bank details changed, gets a phone call to a number you already had. My colleague Scott wrote a good breakdown of how criminals are using AI itself to build these attacks if you want the technical side of it.

Ransomware is the other side of it. Payments to attackers actually fell about 8 percent last year, from roughly $892 million to $820 million, because more businesses had backups that worked and refused to pay. That is good news, but the attacks did not slow down. Not paying still means you are down while you rebuild.

Most of you do not run AI. You rent it, and that is the part I worry about.

When I ask a client what would shut them down for a week, they usually describe a fire. Then I ask what happens if their scheduling software, their payroll provider, or their IT company goes dark on a Tuesday morning, and the room gets quiet.

That is where the exposure has moved. Verizon's 2025 breach report found a third party involved in 30 percent of breaches, double the year before. Your data and your operations are sitting inside somebody else's system, and their outage is your lost week.

Here is the piece owners miss. Your property policy will not pay for that, because nothing of yours burned. A cyber policy can, under what the industry calls dependent business interruption, but only for vendors that meet the policy's definition and only after a waiting period runs. That language is where I spend most of my time when I place these, and it is the first thing I read on a policy somebody already owns.

The market is in your favor right now. That is not permanent.

Cyber pricing in the United States has come down for eleven straight quarters, and rates fell about 7 percent globally in the fourth quarter of 2025. There is more capacity, higher limits are available, and the terms are better than they were in 2021 when everyone was fighting for coverage.

I am not going to pretend I know when that turns. One big cloud outage and it tightens up. What I do know is that this is the least expensive version of this conversation you are going to have for a while. If you are still deciding whether this coverage belongs on your business at all, I laid out five real claims and what they cost in an earlier post.

What I would do if this were my business

• Put your payment verification rule in writing. Call a number you already have on file, never the number in the email, before any wire goes out or any vendor changes bank information. A lot of funds transfer fraud coverage expects that step.

• Tell your people which AI tools are approved. A free account is fine for writing a headline. It is not the place for customer records, employee information, or anything you promised a client you would protect.

• Name your three most important software vendors. If any one of them is down for a week, you should know before your renewal whether your policy responds.

• Use what you already pay for. Most cyber policies include a breach response team, employee training, and monitoring. Very few of my clients had used any of it before I pointed it out.

• Have someone read the policy against how you run today, not how you ran three years ago.

Questions I get asked

Does my business owners policy already cover this?

Usually not in any real way. Most property and liability policies either exclude cyber or include a small amount that runs out quickly. This needs its own policy.

We are small and we do not keep medical or card information. Does this still apply?

The most common loss is stolen money, not stolen records. If you send invoices, pay vendors, and run on email, you have the exposure.

Will using AI tools make us hard to insure?

No. Underwriters expect it now. They want to see that you know which tools your team uses and that you have basic controls, especially around payments.

What does cyber insurance cost for a small business?

Less than most owners guess, and less right now than it has been in years. I can put a proposal in front of you so you are looking at a real number instead of a rumor.

If you want a straight answer on what your current coverage would and would not do here, call or text me at (262) 754-4736. I would rather walk you through it now than after the money is gone.