AI is speeding up attackers, claims are piling up, and carriers are racing to keep pace. The organizations that come out ahead will be the ones that can prove what happened to the data. I just got back from the NetDiligence Cyber Risk Summit in Philadelphia, and one idea surfaced in nearly every session and hallway conversation. A cyber incident is no longer judged by whether it happened. It is judged by how quickly and defensibly you can show what was affected, who needs to know and what you did about it. That is the lens I brought home.
Here is what stood out.
Insurers are becoming AI companies
The most striking shift I heard came from the carriers themselves. Insurers are no longer content to be data companies. They are choosing to become AI companies because the alternative is falling behind. AI is moving faster, attackers are moving faster with it and claims teams are struggling to keep up with the volume of filings. The numbers back that up. The 2026 NetDiligence Cyber Claims Study analyzed 10,309 claims from 2021 to 2025. Ransomware and business email compromise drove nearly 64% of small and mid-sized business claims in 2025 alone. Large companies made up only 3% of claims but 56% of total incident costs. CrowdStrike reported an 89% jump in AI-enabled attacks in 2025 and the study’s contributors expect AI to keep narrowing the gap between amateur and sophisticated criminals.
Getting ahead of the lawsuit
Carriers want to anticipate data breach litigation, not just react to it. They want to know earlier what they can protect and where their exposure sits. That matters because notification is now a leading indicator of litigation. The claims study notes that as more people are notified, class action risk generally rises. For SMEs, crisis services such as breach counsel, forensics, and notification already make up about 47% of total incident cost. The exposure is also widening beyond breaches. The non-breach privacy and behavioral profiling panels focus on tracking pixels, AI-driven profiling, biometrics, and employee monitoring. Plaintiffs’ firms can find a pixel with ordinary browser tools. Companies now weigh one class action against thousands of individual arbitration demands and these claims often straddle cyber, D&O and EPL policies.
Trust is the new perimeter
Here is the irony of 2026. With so much now managed digitally, companies are reaching for old-school methods: code words and verbal passphrases to confirm who is real.
That makes sense once you see how social engineering has evolved. Synthetic voice and video can now impersonate an executive or a vendor without anyone breaking into an email system. The Security Controls on Trial panel showed how even MFA gives way to token theft, push fatigue and a convincing caller. Authentication has changed, and consumer-facing businesses must decide in advance how they will verify customers and contain business email compromise after a breach.
Carriers are also weighing what this means for counsel. Impersonation affects how lawyers can act during an incident and how organizations protect their reputation when trust itself is the target.
The regulatory clock keeps ticking
Regulators are moving from “tell us about the breach” to “show us your controls, all the time.” A few dates from the regulatory panel worth putting on the calendar:
- Colorado’s ADMT Act takes effect January 1, 2027, with notice and 30-day adverse-outcome disclosures for automated decisions.
- California CCPA risk assessments for pre-2026 processing are due December 31, 2027 and the first CPPA submission, with an executive attestation under penalty of perjury, follows on April 1, 2028.
- The HIPAA Security Rule overhaul has slipped to a long-term action, but its proposed controls are already the benchmark regulators, plaintiffs and underwriters use.
Healthcare deserves its own mention. It accounted for 7% of SME claims but 14% of SME incident costs. Meanwhile, 78% of health systems surveyed for the 2026 Healthcare AI Trends Report are running AI projects, yet only 52% feel operationally ready.
What does this mean for you?
Carriers and claims teams: AI can help you keep pace with filings, but forecasting litigation still depends on accurate, early data about who was affected and what was exposed.
Breach counsel: Notification lists are now litigation evidence. Build review workflows that are defensible from day one and plan for vendor incidents. Malicious third-party events cost more than five times as much as accidental ones.
Corporate legal and privacy teams: Inventory your trackers, AI tools, and vendors before a plaintiff or regulator does and agree on verification steps, including code words, before an incident tests them.
Healthcare organizations: Treat PHI review and AI governance as one conversation. Underwriters are starting to ask about both.
Where Aeren LPO fits
When an incident hits, Aeren LPO’s cyber incident response review teams identify PII and PHI, remove duplicates and build the affected population lists that drive notification. We scale incident timelines and we support the work that follows: DSARs, privacy-claim document review and contract review for notification and indemnity terms after a vendor incident. All of it runs in an ISO 27001:2022- and SOC 2 Type II-certified environment. Philadelphia made one thing clear. The industry is moving fast, but the fundamentals still win: know your data, verify who you are talking to and be ready to prove it. If you were at NetDiligence, or wish you had been, I would love to compare notes.
Sources
