- Almost a third (30%) of insurance leaders say AI-enabled attacks are the emerging risk the industry is least prepared for
- Most leaders say cyber resilience should be top priority for 2027, with better industry coordination needed
- Cyber security should be UK’s highest priority to bolster national resilience
KPMG’s latest UK Sentiment Survey of over 100 insurance leaders found that 30% identify AI-enabled cyber attacks as the emerging risk the industry is least prepared for, ahead of climate-related catastrophes or technology system failures and outages. So-called AI fronter models are increasingly exposing vulnerabilities in IT systems and challenging the operational resilience of major financial institutions and their extended ecosystem of suppliers, partners and customers.
The research also highlights the operational resilience capabilities insurance leaders believe should receive greatest attention in the coming year. Six in ten (60%) say cyber resilience should be strengthened over the next 12 months, while 45% point to AI governance and oversight.
At the same time, AI is seen as an important part of the solution with 30% of leaders identifying it as the emerging technology offering the greatest opportunity to strengthen UK resilience.
Huw Evans, Head of Insurance and Partner, Financial Services at KPMG UK, said: “The rapid development of AI frontier models is challenging insurers’ operational resilience against a range of rapidly evolving Cyber attacks.
“As concerns around the risks of AI frontier models intensify, insurers are increasingly acting at speed to enhance protection, strengthen cyber protection and use advanced AI to protect themselves against AI-enabled threats. This enhanced protection brings added benefits, enabling more confident investment in wider business transformation and reassuring customers and suppliers.
Cyber security beats national security and defence as top priority for strengthening UK resilience
Concerns around cyber resilience also extend beyond individual insurers and their commercial interests. The survey also reveals the importance insurance leaders place on cyber resilience as a national priority, with more than a quarter (28%) of insurance leaders say cyber security should be the UK’s top priority for strengthening national resilience over the next year, placing it well ahead of defence resilience (17%).
To strengthen resilience, almost four in ten (39%) say improving cyber resilience is the area requiring the greatest collaboration between insurers, government and tech companies, compared with 18% who point to protecting national infrastructure.
However, when asked about the biggest barrier preventing insurers from providing greater protection against systemic cyber risks to clients, almost a third (32%) point to limited industry co-operation because of competitive sensitivities. This was more than twice the number who said the biggest barrier was accumulation of systemic risk or regulation (15%).
Huw concluded: “Financial services is interwoven into our lives and the global economy; this interconnectivity means resilience cannot be built firm by firm. Cyber risk also increasingly sits within a much wider geopolitical picture. As an industry, we need to improve our ability to translate geopolitical risk into better underwriting, risk management and overall resilience.
“Greater co-operation will be grow as the risks materialise. Insurers, government and technology providers need to increase further the sharing of information and understanding where vulnerabilities and dependencies sit to minimise the risk of systemically damaging attacks.
