Attackers can adopt a new offensive capability in an afternoon. Companies need budget, approval and a change window. That gap changes five things about how security gets bought and built.

Verizon has been counting data breaches for nineteen years. This year, for the first time, the most common way in wasn’t a stolen password. It was an unpatched flaw, at 31% of initial break-ins against 20% a year before. That’s the opening AI cyberattacks are built to widen.

The figures underneath are worse. Across scanner data from 13,000 organizations, the median time to fully patch a flaw already under attack rose to 43 days from 32. Only 26% of the government’s known-exploited list was fully remediated, down from 38%. Both numbers moved backwards in one year.

Both sides get the same tools. Only one can deploy them without asking. Software scales globally, and security gets fixed one company at a time.

The Fastest Movers Could Become The Hardest To Insure

Insurers don’t wait for legislation, and regulation of AI agents remains unsettled. Their sharpest lever isn’t what they charge. It’s whether they cover you at all. After September 11 the Insurance Services Office asked states to strip terrorism out of commercial cover, and 45 agreed. Reinsurers cut back or stopped writing it, cover became expensive or unavailable, and Congress passed the Terrorism Risk Insurance Act in 2002.

The same body has now reached for AI, on a smaller scale. In January 2026 the ISO issued generative AI exclusions for general liability, and a few carriers are adopting them. Underwriters are asking how you use it.

Follow that and the usual story inverts. The exposure carved out belongs to whoever deployed the most AI, which would make the fastest movers the hardest to insure.

Aon reports a soft cyber market with price cuts and higher limits for well-managed risks. Across commercial insurance it says “AI has........

© Forbes