Cyber risk has returned to the top of US business concerns as companies expand artificial intelligence use faster than their internal governance practices.
Travelers’ latest Risk Index found 58% of respondents worried a great deal or somewhat about cyber threats. Those concerns ranked ahead of economic and geopolitical risks, placing cyber first among business risks for the fifth time in eight years.
Artificial intelligence now sits on both sides of the cybersecurity equation. Businesses increasingly use AI for operational efficiency and decision-making, while attackers apply the same technology to phishing, social engineering and exploitation of system vulnerabilities.
The gap between adoption and internal controls remains wide. Travelers found 89% of respondents use AI in daily operations, yet only 59% have established business practices governing employee use of the technology.
John Menefee, vice president and enterprise cyber lead at Travelers, said companies increasingly recognize cyber threats as a serious business problem. Firms are investing in security controls, building internal capabilities and seeking advice from insurance carriers, even as AI gives attackers additional methods for targeting corporate systems.
Organizations of every size need to treat AI-related cyber risk as a business issue and strengthen their defenses accordingly. The survey suggests many companies have started moving in this direction, though governance practices still lag behind adoption.
Travelers surveyed 1,202 US business insurance decision-makers. Among them, 55% identified a security breach or other cyber event involving AI as a concern.
Respondents cited malicious use of AI to exploit system weaknesses and develop phishing or social engineering campaigns. They also raised concerns about companies retaining corporate data for training AI models, adding another layer of exposure around information handling.
Growing concern around cyber risk has coincided with higher cyber insurance adoption. Travelers found 70% of businesses now purchase cyber coverage, the highest level since the Risk Index began focusing on cyber issues in 2018.
Insurance carriers also received strong marks as sources of cybersecurity expertise. Among surveyed business leaders, 92% expressed confidence in insurers as providers of cyber guidance and technical support.
Companies have increased spending across several defensive measures. Investments include firewalls and data backups, along with employee background checks, stronger onboarding and offboarding procedures, and multifactor authentication.
Preparedness remains less developed in some areas. Travelers found fewer businesses regularly conduct cyberattack simulations or test incident-response plans, leaving room for additional work around operational readiness when a breach occurs.
