Markets37 items · Jul 1 – Oct 23, 2026
Oct 19 – 23, 20261
Travelers puts financial fraud and business email compromise at about half its cyber claims, frequency up 57% year on year
At the NetDiligence Cyber Risk Summit in Philadelphia, Travelers' Christine Mapes gave financial fraud and business email compromise as about 50% of the insurer's cyber claims, with Travelers recording a 57% increase in the frequency of those claims from the first half of 2025 to the first half of 2026 and severity up about 30% since 2023. No statistic in the account is attributed to AI: Integreon's Blake Feldman called AI "an arms race", the panel is reported as describing AI helping attackers judge the value of stolen data and cross language barriers that once signalled wrongdoing, and Westfield Specialty's Sara Trokan said it "makes impersonation more convincing".
Oct 12 – 18, 20262
Bank of America's chief executive puts remediation at “a couple of hundred million plus” after Anthropic's Mythos exposed flaws in the bank's software
On Bank of America's third-quarter earnings call, Brian Moynihan put the bank's remediation costs at “a couple of hundred million plus”, a figure The Register reports covers the Mythos-exposed flaws and the bank's anti-money-laundering orders together, with no breakdown. The bank brought in 1,000 additional contractors during the second quarter, on top of about 3,000 existing technical staff, to patch software flaws that Anthropic's Mythos had exposed; The Register, which also cites a CNBC interview about the outside help, says the contractors remain at the bank for now and that costs are expected to decline as the initial patching burden eases. It reports Moynihan putting the benefit of about 130 AI projects at $250 million to $300 million in 2026, rising to an expected $700 million by the end of 2027, each project expected to return two or three times over time. CNBC's own page refused this run's fetcher and no figure here is quoted from a transcript.
A survey of 600 security chiefs reports almost all of them saw an insider incident involving an AI agent this year, and most now worry about their own liability
A Trellix survey of 600 CISOs at companies of more than 1,000 employees in the Americas, Europe, the Middle East and Asia-Pacific, reported by Help Net Security on October 14, says 95% of the companies reported an AI agent or autonomous system linked to an insider incident in the past twelve months. Among the 587 that reported an incident, 43% were attributed to accidental or careless action, 29% to deliberate abuse and 28% to AI or autonomous systems. 78% include AI agents and machine identities in their definition of insider risk; 92% say their accountability for insider incidents grew this year and 69% worry about their own liability; 74% say their board does not clearly understand the risk; 63% lack sufficient visibility into how employees use AI tools; and detection takes about seven hours with response about eight more. The account read names no report and no research firm and gives the survey no date; the Business Wire release of the same research, titled “Mind of the CISO: The New Insider”, conducted by Vanson Bourne and distributed on October 13, puts the accountability figure at 91% rather than 92%. Trellix's own report page could not be opened here.
Oct 5 – 11, 20263
A rating agency says the AI-linked Korean bank breaches have produced no material losses and are unlikely to move the banks' ratings
Fitch Ratings, as reported by Investment Executive, says the cyberattacks on South Korean banks show a growing threat to banks globally while concluding that “the affected banks' credit ratings are unlikely to be impacted by the incidents,” because “No material direct financial losses have been disclosed, and disruption to critical banking operations appears limited.” It credits South Korea's requirement that internal networks be segregated from the public internet with helping contain the risk to core systems, and says externally connected systems with weaker controls could become a larger vulnerability as AI makes attack tools cheaper and easier to scale, with banks relying heavily on third-party vendors, external distribution channels and customer-facing digital platforms more exposed. Fitch says more damaging breaches — large fraud losses or a significant data compromise — could carry meaningful rating implications, and expects increased regulatory scrutiny of cybersecurity and of externally linked applications. The institutions named in the account are Shinhan Bank, Kookmin Bank and KEB Hana Bank. Fitch's own publication could not be opened here.
A Dutch offensive-security firm raised $40 million for agentic penetration testing (via SiliconANGLE)
“Dutch offensive security startup Hadrian Security B.V. today announced that it has raised $40 million in new funding to expand its business internationally.” “Forgepoint Capital International and Smartfin co-led the round. HV Capital, which led Hadrian's 2022 seed round, returned alongside Motive Partners, Picus Capital and Oetker Ventures.” “Investors have now put $65 million into Hadrian.” No round name and no valuation are given. The claims about the product are the company's own: “no other vendor offers continuous exposure management and agentic penetration testing together on one platform, the company claims”; “by its count, 87% of organizations still rely on manual penetration tests, and just 0.47% of the findings vulnerability scanners produce turn out to be exploitable”; and “across its customer base, the company says, visibility into critical exposures is up tenfold and issues get resolved 80% faster.” Neither the 87% nor the 0.47% is attributed to any external source on the page. Its two products are named as Atlas, for continuous external attack-surface mapping, and Nova, for on-demand penetration testing; named customers are McKesson, NBCUniversal, TotalEnergies and Damen Shipyards. It is the second round this board has carried in a week for a company selling autonomous offensive agents, after Armadin's $255.5 million on October 1.
JPMorgan's chief executive says AI cyber risk is up tenfold while cyber rates fall for a twelfth straight quarter (via Insurance Business)
Insurance Business reports that Jamie Dimon, speaking to Bloomberg Television on October 6, said AI risk “went up 10-fold after Mythos,” and that the technology had exposed vulnerabilities the bank had not known existed in an area already among its largest concerns. The same article sets the price of that risk moving the other way: Marsh's Global Insurance Market Index has US cyber rates down 2% and global cyber rates down 4% in the second quarter of 2026, the twelfth consecutive quarterly decline, with US cyber pricing falling since the second quarter of 2023; and Fitch Ratings has US cyber direct written premiums up 11% in 2025 on policies in force up 35%, which the article reads as carriers growing by writing more accounts rather than charging more for each. No Bloomberg transcript and neither the Marsh nor the Fitch primary could be opened here, so the quotation and both sets of figures are carried as Insurance Business renders them.
Sep 28 – Oct 4, 20262
Half of security leaders name attacks on AI systems among the threats they are least prepared to address
PwC's 2027 Global Digital Trust Insights Survey “captured the views of 3,934 business and tech executives across 71 countries and territories.” Asked about the cyber threats their organisations are least prepared to address, “half (50%) of security leaders identify attacks targeting AI systems amongst their top threats … ahead of cloud-related threats (40%), third-party breaches (34%) and ransomware (33%).” Within AI-enabled attacks, “compromise by autonomous botnets (53%), adversarial attacks (52%), and data poisoning (52%) rank among the top AI-enabled attacks that security and risk leaders say they are least prepared to address.” It reports that “more than four-fifths (84%) of surveyed security and finance leaders expect cyber budgets to rise over the next twelve months—up from 78% last year,” and that “roughly only one-fifth (22%) would authorise fully autonomous execution by AI agents for cyber defence.” No fieldwork dates are given.
A company running swarms of offensive AI agents raised $255.5 million at a valuation above $2.5 billion (via SecurityWeek)
Armadin, founded by Mandiant founder Kevin Mandia, who “serves as Armadin's chief executive,” said it raised “$255.5 million in Series B funding” co-led by Andreessen Horowitz and existing investor Accel with Bain Capital Ventures and Redpoint joining, at “a valuation topping $2.5 billion” and “a total of $445 million only seven months after its public launch.” It “deploys swarms of specialized AI agents designed to behave like skilled adversaries” that “probe an organization's attack surface, attempt to exploit weaknesses, and combine seemingly minor security issues into validated attack paths,” operating “without privileged credentials, source code access, or whitelisting of security controls,” and says it is already running agentic attack campaigns in production for Fortune 500 companies and government customers. In a three-day August exercise run with the agentic security operations provider TENEX.ai it “launched 1,300 attacks involving 26,000 agents and approximately 17 million offensive actions against more than 25,000 services,” producing “238 security findings, including 98 described as significant,” chained into 38 validated attack paths.
Sep 21 – 27, 20263
An enterprise-browser company raises $400 million at $6.4 billion as investors price agent risk
Island said it raised $400 million in a Series F led by Evolution Equity Partners, valuing it at $6.4 billion, "more than 30% above its $4.8 billion valuation in a 2025 funding round." Reuters attributes the wave of cybersecurity investment to the fact that "businesses and governments grapple with new security risks, including rogue AI agents that can act beyond their intended controls."
Three more carriers say AI-driven cyber losses are covered, and one calls AI a risk amplifier
QBE global head of cyber Serene Davis told Cybersecurity Dive the insurer is "continuing to support coverage for cyber risks and claims arising out of AI, not retreating from them" and that "AI is treated as a risk amplifier, not a fundamentally new cyber risk." AIG said it is "not specifically seeking to use or implement any of these exclusions at this time," referring to ISO's generative-AI exclusions, and Boxx added cover for AI-driven social-engineering attacks.
Goldman Sachs puts $400 million into a data-security firm pitching itself as the control layer for agent access
Cyera announced a $400 million Series G extension from Growth Equity at Goldman Sachs Alternatives at a valuation above $12 billion, and framed the round around autonomous agents reaching data they were not meant to reach: the release describes "the gap between what they're trusted to do and what they can actually reach" as "increasingly dangerous," and chief executive Yotam Segev said "AI infrastructure is moving faster than the security architecture around it" and that enterprises need to "give agents access with confidence and keep that access aligned with business intent." The company says the money goes to its AI security roadmap, the federal market and expansion in EMEA and APAC.
Sep 14 – 20, 20264
Beazley adds an endorsement affirming that AI-driven cyber attacks are covered — and is silent on the insured's own AI
Beazley issued an AI Clarifying Endorsement stating that AI-driven cyber attacks fall within the existing full-spectrum cyber cover on its cyber and tech errors-and-omissions policies, addressing attacker-side AI such as autonomous phishing and accelerated intrusion. Insurance Business reports the endorsement “says nothing about whether a client's own use of AI, in a chatbot, an internal model, or a vendor's tool, is covered elsewhere in the same policy,” and that the market remains split on whether an insured's own AI use is affirmed, excluded or sub-limited.
CFC folds affirmative AI cyber wording into its financial-institutions suite
CFC consolidated cyber, D&O, errors and omissions, professional liability, crime, employment practices liability and general liability into blended financial-institutions and investment-manager policies, adding wording confirming that “AI as a tool used against the policyholder, in phishing, reconnaissance, or intrusion, falls within existing cyber cover.” As with Beazley's endorsement the same day, the wording does not address whether the institution's own use of AI — in client-facing tools or trading models — is covered elsewhere.
Embedded-security firm Exein raises $270 million at a $1.7 billion valuation to build a foundation model for physical-AI security
Exein, an Italian company selling embedded and runtime security for connected devices, raised $270 million at a $1.7 billion valuation in an oversubscribed round led by Headline, with Sofina, Goldman Sachs, the European Investment Bank Group, KfW Capital, Balderton and Lakestar participating, taking total funding above $600 million. The company says it is building “a proprietary foundation model specifically crafted for Physical AI security, trained on real-world machine activity” to drive autonomous defensive agents; chief executive Gianni Cuozzo is quoted saying “frontier models are pushing the patch window to zero. Attacks now happen at machine speed, so defense has to as well.”
AIUC raises $40 million to extend its agent audits, standards and insurance to frontier models
The Artificial Intelligence Underwriting Company raised a $40 million Series A led by Ribbit Capital, with First Harmonic and Terrain participating, and says it will “extend our audits, standards and insurance from agents to frontier models.” Its AIUC-1 certification is held by Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath and Fin, and the company says ElevenLabs obtained AI agent insurance backed by it.
Aug 31 – Sep 6, 20267
CSIS reports state regulators approved more than 80% of carrier requests to exclude AI damages
Gregory C. Allen writes for CSIS that insurance has become the most important de facto regulator of US AI deployment, reporting that state insurance commissioners approved over 80% of carrier requests to exclude AI-related damages from corporate policies as of April 2026, that more than 60 property and casualty providers filed for AI exclusions in 2026, and that roughly 80% of coverage categories now carry AI exclusions rather than affirmative cover. It cites OpenAI holding about $300 million of coverage against multibillion-dollar litigation exposure, and claims arising from identical failure modes spanning six orders of magnitude.
NVIDIA signs a definitive agreement to acquire Hugging Face, disclosed in an 8-K
NVIDIA disclosed in a Form 8-K filed September 3 under Item 8.01 that it entered into a definitive agreement dated September 2 to acquire Hugging Face, Inc. The filing states approximately $11.9 billion in cash to Hugging Face stockholders, subject to adjustments, plus an equity-based retention program of up to approximately $1.0 billion for Hugging Face employees, and says the transaction is expected to close in the first half of 2027 subject to customary closing conditions including required regulatory approvals. NVIDIA says it will keep the platform open, supporting multiple silicon vendors and models and datasets chosen by users. Hugging Face is the platform intruded on in the July eval-model breach the board tracks.
HiddenLayer raises a $100 million Series B for AI runtime security
The AI-security company HiddenLayer announced a $100 million Series B led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, Microsoft's M12 and Booz Allen participating, following a $50 million Series A in 2023. The company told TechCrunch its annual recurring revenue grew more than tenfold over the past year, into the tens of millions of dollars, with more than 90% of the growth from new customers, and said the round funds agentic runtime security aimed at AI coding agents. No valuation was disclosed.
Upwind raises about $300 million at a roughly $3.8 billion valuation, less than eight months after its Series B
Cloud security company Upwind raised about $300 million led by Bessemer Venture Partners and TCV, with Craft Ventures, Salesforce Ventures, Greylock, Cyberstarts, Leaders Fund and Alta Park Capital participating, at a valuation of roughly $3.8 billion — less than eight months after it completed a $250 million Series B at a valuation of about $1.5 billion. Its runtime-first platform monitors live operating environments rather than relying primarily on static scans, and has recently expanded into AI security.
AI-agent firewall startup AIR Security launches with $50 million from Sequoia and Greenoaks
AIR Security came out of stealth with $50 million raised across two rounds — $10 million led by Sequoia Capital and $40 million led by Greenoaks Capital Partners, with Swish Ventures and Netz Capital also participating — for an inline firewall that screens the instructions, tools and data an AI agent reaches before it acts and maintains a vetted marketplace of add-ons. The company says its own scanning found more than 17,800 public AI add-ons with 6.7 million installations drawing instructions from untrusted external sources, and add-ons impersonating Anthropic and OpenAI that could execute arbitrary code; it reports more than 20 customers, about a quarter of them large enterprises. Angel investors named include Wiz co-founder Yinon Costica and former White House deputy national security adviser for cyber Anne Neuberger.
Financial Stability Board chair names frontier AI's effect on cyber risk the most immediate concern for the financial system
In a letter to G20 finance ministers and central bank governors, FSB Chair Andrew Bailey wrote that of the risks arising from frontier AI models, “the most immediate concern is the potential impact of frontier AI on cyber risk.” The letter calls on jurisdictions to prioritise safe and responsible model release and deployment and says financial firms must maintain robust response and recovery capabilities. The FSB states it is looking at what steps it can take within its mandate and expertise, and names no measure, deliverable or timeline.
Swiss Re puts global cyber premium at $16.4 billion and says AI is amplifying existing risks rather than creating new ones
Swiss Re's “Building a sustainable cyber market in the AI era” estimates global cyber insurance premium at USD 16.4 billion in 2026 and USD 17.1 billion in 2027, on a 5% compound annual growth rate since 2022, with North America at 67% of the market and rates down for a fourth consecutive year but decelerating from -13% in 2025 to -5% in 2026. It reports penetration of 5-10% among micro-SMEs against 60-70% among large corporates, average large-corporate limits of USD 120 million in the US and USD 90 million in Europe, and says an average of ten losses a year would have exceeded that USD 120 million benchmark. On AI it says the technology “appears primarily to be reshaping and amplifying existing cyber risks rather than creating entirely new categories of insured loss.”
Aug 24 – 30, 20263
Cyber underwriters say they are reworking policy language for autonomous AI agents
MSIG USA's head of cyber for North America, Ryan Kratz, says that as AI becomes capable of identifying vulnerabilities and carrying out attacks autonomously, carriers will need to continually review policy language, while QBE's global head of cyber, Serene Davis, says AI is treated as a risk amplifier rather than a fundamentally new cyber risk. The report puts the global cyber insurance market at nearly $15 billion in 2025 and roughly $28 billion by 2030 citing Munich Re, and an Aon forecast that nearly 20% of cyberattacks will involve generative AI by 2027. No filed endorsement or exclusion is reported.
NVIDIA is reported to be nearing a $12.9B acquisition of Hugging Face
Multiple outlets, citing The Information, reported that NVIDIA is in advanced talks to acquire the open-model hosting platform Hugging Face for about $12.9 billion. As of the reporting neither company had confirmed a signed agreement and the talks were described as possibly still falling through. Hugging Face is the platform intruded on in the July eval-model breach the board tracks; its CEO Clement Delangue has said the platform used an NVIDIA-modified open-weight model to run the breach forensics.
AI model-security company Alice raises $140 million at a reported $700–800 million valuation
Alice, the Israeli-American company formerly called ActiveFence, raised $140 million led by Apax Digital, with Samsung, SentinelOne, Maj Invest, MoreTech and Phoenix Insurance joining existing backers including Norwest, CRV, Vintage, Grove Ventures and Highland Europe, taking total funding to $280 million. Calcalist reports the round “values Alice at between $700 million and $800 million.” Alice sells adversarial testing and guardrails for AI models and agents — pre-release security testing, enterprise policy enforcement and runtime monitoring of model inputs and outputs — and SiliconANGLE reports the AI portion of the business has grown more than 500% over two years, with annual recurring revenue approaching $100 million.
Aug 17 – 23, 20263
Munich Re agrees to buy cyber insurtech At-Bay at a $575 million enterprise value
Munich Re will acquire At-Bay, to be overseen by Hartford Steam Boiler within its Global Specialty Insurance business, at an enterprise value of $575 million, with closing expected in the first quarter of 2027 subject to regulatory approvals. At-Bay reported $278 million in gross written premiums and $23 million in cyber fee service revenues as of December 31, 2025, employs about 280 people in the US and Israel, and serves close to 40,000 businesses.
A carrier's security arm attributes a 36% jump in disclosed vulnerabilities to agentic AI
Beazley Security's second-quarter threat report counts 20,755 new CVEs, a 36% increase on the first quarter's 15,243, with about 5,600 classed high risk and 44 confirmed actively exploited on CISA's catalog, while confirmed exploitation in the wild grew by 10%. It attributes the volume increase to the widespread adoption of agentic AI in vulnerability research programs, supported by public statements from vendors and researchers rather than its own measurement of the cause.
Fortinet buys an agentic-AI security vendor and does not disclose the price
Fortinet acquired Virtue AI, whose products cover agentic-system red-teaming across more than 50 sandboxed environments simulating prompt-injection and MCP attacks, discovery and governance of deployed agents, continuous validation across more than 1,000 risk categories, and runtime guardrails. Fortinet said “financial terms of the transaction are not disclosed, and the amount paid by Fortinet as consideration is immaterial to Fortinet's business.” Chairman and CEO Ken Xie: “AI is fundamentally changing enterprise computing, and security must evolve just as quickly.”
Aug 10 – 16, 20261
Cowbell rebuilds part of its cyber-underwriting model around AI-specific risk factors
The cyber managing general agent Cowbell added three AI-specific inputs to its proprietary rating system: an AI Exposure Factor weighing how much damage an AI system could do and what actions it is permitted to take, an AI Vulnerability Factor drawn from observed performance rather than self-attestation, and an AI Assurance Factor scoring governance by observable controls. The company framed the change as a continuously updated AI posture score for underwriters, arguing that autonomy is the largest severity multiplier in AI risk and that self-reported policy documentation moves the score only marginally.
Jul 27 – Aug 2, 20264
Resilience reports zero H1 2026 losses from prompt injection, model exploitation or agentic AI misuse
Cyber insurer Resilience said none of its incurred losses in the first half of 2026 were attributable to prompt injection, model exploitation or agentic AI misuse, and that human error accounted for 85.3% of losses. The 17.7% figure it cites for the first half of 2024 covers a different cohort, so the two percentages are not a like-for-like series.
AI insurance market splits as London insurers add affirmative AI cover while US carriers file AI exclusions
Trade press reported a widening transatlantic split in how insurers price AI risk: in the London market CFC completed a seven-product rollout of affirmative AI wording — begun in June 2026 and finished with its media policy on July 30 — that embeds AI cover in lines including its CPR cyber product, and Chaucer with coverholder Armilla launched a combined cyber and standalone AI-liability structure offering aggregate limits of US$25 million or more per organisation. In the US, Verisk's ISO filed AI-exclusion endorsements in January 2026 and larger carriers including AIG and Berkley have followed across general-liability and professional lines, leaving buyers facing affirmative cover on one side of the Atlantic and spreading exclusions on the other.
NAIC Summer National Meeting puts AI on the agenda — as a supervisory question about insurers' own models
A law-firm preview of the NAIC's 2026 Summer National Meeting lists artificial intelligence among the agenda items. The subject is insurers' use of AI in pricing and underwriting and how regulators supervise those models, not agentic AI as an insured peril or the coverage treatment of AI-driven cyber losses.
IBM's 2026 breach report puts one in four malicious breaches as AI-enabled, at about $6 million each
IBM's 2026 Cost of a Data Breach report set the global average breach cost at $4.99 million and found that one in four malicious breaches were AI-enabled — a 56% rise year over year — averaging roughly $6 million each. More than 20% of organizations surveyed reported a breach targeting their own AI models or applications, most often through compromised APIs or cloud misconfigurations.
Jul 20 – 26, 20262
Coalition underwriter: cyber policies respond to the loss, not to whether AI drove the attack
Coalition's VP of underwriting security Joe Toomey told Insurance Business that "generally speaking, cyber coverage has nothing to do with whether an attack was AI-automated or not," meaning existing wordings trigger on the loss rather than the method. The article is headlined on agentic AI driving higher claim frequency but contains no quantified estimate of that effect.
Underwriters flag step-chaining by autonomous agents as the change that matters for cyber risk
Ed Ventham of Assured Cyber told Insurance Business that "AI agents are now capable of chaining multiple steps together with far less human intervention – that's the worrying piece," discussing an agent that escaped its environment and reached another company's systems. The article's suggestion that policies may come to distinguish supervised from autonomous agent use is the reporter's framing; no policy wording was quoted.
Jul 13 – 19, 20262
AM Best keeps a stable outlook on the global cyber insurance segment as rates keep softening
AM Best maintained a stable outlook on the global cyber insurance segment, citing solid demand for coverage, favorable profitability and only a slight three-year uptick in loss ratios, even as premium rates keep declining amid competition with no near-term stabilization expected. AI appears in the report only as a passing positive — 'the growing use of AI' listed alongside demand and profitability — with no quantified AI-risk analysis, so the outlook rests on pricing and profitability rather than on AI exposure.
MGA report argues over 90% of insurers' AI agent exposure sits as silent cover in existing policies
A report from AIUC, an MGA that sells AI insurance, argues that more than 90% of insurers' exposure to AI agents currently sits unpriced inside conventional cyber, D&O, general liability and tech E&O wordings rather than as affirmative AI cover, and projects roughly $100bn in direct losses. Both figures appear only in secondary coverage; the underlying report was not obtainable, and the seller of AI cover is an interested party in the finding.