AI, Geopolitical Tensions, and Human Error Are Reshaping the Cyber Risk Landscape
Cyber risks facing businesses have grown significantly more complex, driven by AI-enabled attacks, geopolitically motivated intrusions, and an increasing share of losses stemming from companies’ own decisions rather than external attackers, according to Lockton’s 2026 Cyber Threat Report.
Munich Re claims data cited in the report found that 25% of cyber incidents in 2024 were non-malicious — up from 11% in 2021 — a trend that is straining coverage assumptions and prompting underwriters to scrutinize governance alongside technical controls.
AI Amplifies Attack Capabilities Across Multiple Vectors
Artificial intelligence has become a force multiplier for threat actors, lowering the technical bar for executing sophisticated attacks while dramatically increasing their speed and scale. CrowdStrike data cited in the report found an 89% increase in attacks from adversaries using AI, with average breakout times falling 70% since 2021 to just 29 minutes, with the fastest recorded breakout at 27 seconds.
AI has reshaped several categories of attack. In ransomware, large language models now allow modestly skilled attackers to craft evasive malware that previously required significant expertise. In business email compromise and social engineering fraud, AI enables highly convincing impersonations through deepfake video and voice cloning, which the report identified as increasingly rivaling traditional phishing. Hackers can also use AI to rapidly analyze exfiltrated data and identify sensitive records for ransom or extortion, as well as to evade endpoint security controls.
Beyond attacks, AI introduces distinct liability risks tied to media and intellectual property. AI models trained on copyrighted content can generate unauthorized reproductions, while AI-generated content that contains inaccuracies can expose companies to defamation claims. Employees who upload sensitive data into publicly available AI tools also pose privacy risks that fall outside traditional breach scenarios.
Anthropic’s decision in April to withhold its latest AI model, Mythos, from public release, citing its potential to identify previously unknown software vulnerabilities, underscored the dual-use risk that advanced AI poses for cybersecurity, Lockton said.
Business Interruption and Third-Party Risk Drive the Largest Losses
Operational disruption, not ransom payments, often accounts for the largest component of cyber losses, the report found. The 2024 Change Healthcare breach illustrated this dynamic: the company incurred an estimated $867 million in business interruption losses, far exceeding the $22 million ransom payment.
An IBM-Ponemon Institute study cited in the report found that 86% of organizations experiencing a data breach reported operational disruption, with 76% saying recovery took more than 100 days.
Third-party and supply chain vulnerabilities are now the top challenge to cyber resilience, according to the World Economic Forum’s Global Cybersecurity Outlook 2026, which is referenced extensively in the report. Verizon data found that 48% of breaches in the year ending Oct. 31, 2025, involved third parties, up from 30% the prior year.
Underwriters are responding by requiring more detailed vendor risk assessments and dependency mapping from policyholders, particularly regarding cloud providers, managed service providers, and software-as-a-service platforms.
Coverage Gaps Widen as Risks Evolve
Non-breach privacy claims represent one of the fastest-growing areas of cyber-related loss, particularly in the U.S. Lawsuits alleging improper pixel tracking surged to 2,200 in 2025, according to Fisher Phillips data cited in the report. A San Francisco jury awarded $425.7 million against Google in September 2025 for unauthorized tracking of users who had opted out.
Insurers have pulled back on coverage for these claims, frequently arguing that pixel tracking reflects deliberate business decisions rather than accidents, which can trigger intent-based exclusions.
Data breach class-action lawsuits in the U.S. also reached 1,488 in 2024, a 1,265% increase since 2018, according to Duane Morris. The report noted that plaintiffs’ attorneys increasingly employ technicians to scan the dark web for stolen data, sometimes filing lawsuits before the targeted company has detected a breach.
The report noted that policyholders commonly assume cyber policies cover any loss involving computers or electronic devices, an assumption that can leave significant gaps, particularly for social engineering fraud, non-breach privacy violations, and intellectual property claims.
Obtain the report here. &
