Skip to main content
Marsh logo

Report

AI-enabled cybersecurity, governance, and other considerations for clients

Contact us

AI is no longer our future state. It’s a present-day force transforming how organizations compete, create value, and conduct operations. 

Our clients are astute and inquisitive when it comes to AI, specifically generative and agentic AI. They regularly ask about how Marsh is managing the risks amplified by its use, what good governance looks like, and, specific to their own operations, whether their insurance programs will respond. 

This white paper offers insights into how we are approaching AI-enabled cybersecurity and what we believe clients should consider now and as capabilities mature in the short term. We also offer short-term considerations for governance and insurance in our role as risk advisors. 

Specific to cybersecurity, our perspective is currently anchored to the following realities: 

  • AI is increasing the speed, scale, automation, and adaptability of malicious and non-cyber activity. 
  • At the same time, well-governed environments with strong fundamentals and foundations remain effective controls as cybersecurity is comprised of far more than AI vulnerability exploits and patching. 

Foundationally, we offer the following as anchor points for planning and action:

  • Avoidance is not a commercially viable option: As AI reshapes the cyber threat landscape, cyber defenses must evolve with it.
  • Cybersecurity fundamentals still matter: Defense-in-depth, disciplined governance, cyber hygiene, continuous monitoring, and investment in AI-enabled security capabilities remain critical.
  • Security teams need to evolve: Increasingly, teams must work alongside AI and move from manual execution toward agility, speed, scale, and oversight, including advanced detection.
  • Cyber risk is inherently collective: Digital supply chains are global and interconnected, making resilience a shared responsibility across organizations and communities.

AI-enabled cybersecurity and governance

How is Marsh using AI in its security operations? 

Marsh is using AI to empower our cybersecurity professionals to move faster and operate at greater scale; however, accountability and control remain squarely in the human domain. In our own security operations, AI-enabled capabilities support the analysis of large volumes of security data, identify patterns and anomalies, prioritize issues, accelerate investigations, improve threat hunting, and help our team prepare and respond to incidents. 

From a threat-hunting perspective, we are using AI to enhance and scale existing hunting efforts and pursue threats that would otherwise be too resource-intensive to investigate. AI performs initial data collection and triage across a growing volume of indicators of compromise, surfacing anomalies for a threat hunter to validate. This allows us to run more hunts without sacrificing thoroughness, and focus analyst time by accelerating the research needed to distinguish baseline activity from true anomalies.

Specific to our use of agentic AI, we believe the concept of zero trust must extend to agents. There is no room for natural language ambiguity as agentic systems are designed to achieve specific outcomes and meet specific goals — permissions, executable pathways, segmentation, logging, and observability are not negotiable. The unintended consequences of agents’ misinterpretations of their mission could lead to significant breaches or disruptions. 

Probabilistic systems require deterministic parameters and controls from a security and operational perspective. 

Ultimately, the use of AI elevates the importance of defense-in-depth, identity security, data protection, segmentation, logging, application control, patching, scenario planning, and incident response tabletop exercises. It also makes weaknesses in those areas more consequential. 

What about AI governance?

The challenge clients have regularly expressed to us is the sheer volume, the perceived lack of clarity, and the competing requirements they are sorting through as they try to make sense of what “best practices” look like. 

Effective corporate governance extends to include an organization’s use of AI, not the other way around. 

There are a variety of existing AI frameworks and standards, including the NIST AI RMF, ISO 42001, Google’s SAIF, along with extensive legal standards, such as the EU AI Act. Many statutes and sectoral regulations are already in play — or under consideration — that apply to a business’s use of AI. 

Part of what appears to contribute to the feeling of being overwhelmed is fragmented internal ownership and accountability within an organization, combined with a lack of specificity as to how precisely AI is being used. 

With this in mind, we offer the following points for consideration:

Establish a cross-functional oversight committee, write down a formal AI policy (including an acceptable use policy for colleagues), agree on what must be measured (linked to your use cases), extend existing audit processes to include addressing AI use, and report to the board.

Distinguish between internal versus external business uses, HR decisions, reliance on critical infrastructure, and regulated applications, for example, healthcare and business-to-business versus business-to-government, or business-to-consumer applications, and/or interactions.

Are you using commercial off-the-shelf models, open-source deployments, or proprietary development? Is there data scraping? What are your vendor indemnification provisions?

Determine where it is appropriate to have human-in-the-loop requirements, employee training mandates, and a review of processes before business decisions or client interactions are activated.

Establish training data and prompt provenance, compliance with licensing requirements, obtaining customer consent, warranty disclaimers, and liability limitations for commercially sold AI outputs.

Insurance considerations

Am I covered when I use AI?

Clients consistently ask — does my policy have an AI exclusion?

Marsh’s position on AI exclusions

We cannot support broad or absolute AI, or generative AI, exclusions that create protection gaps for our clients.

At this transformational moment, creating such gaps in insurance programs would be a backward step and limit progress. It would increase coverage uncertainty and disputes over whether AI was involved anywhere in a claim’s causal chain.

We recognize that where novel exposures emerge around agentic AI and autonomous decision-making, or exposure concentration and accumulation around core large language models arise, insurers, brokers, and clients will need to effectively problem solve on how best to attribute, manage, and transfer those risks.

Marsh will always endeavor to find clear, tailored solutions to our clients’ exposures. In so doing, we will reaffirm the insurance industry’s mandate to manage evolving risks and support economic growth.

Notwithstanding the above, the ISO and a few insurers have developed exclusionary language applicable to commercial general liability policies and some financial lines products. Though multiple articles have opined on their use, we have not witnessed any pattern of broad application of AI exclusions.

In contrast, cyber and technology errors and omissions products have introduced endorsements intended to clarify and/or enhance coverage for the use of AI.

Additionally, new products are being introduced that build upon existing insurance concepts, such as:

  • Difference-in-conditions (DIC) liability contracts designed to fill gaps in underlying established products where an AI exclusion is applied
  • Performance guarantees specific to identified use cases and/or model outputs
  • Contractual liability insurance policies that fill gaps between liability product coverage and assumed risk via customer contracts

When exploring new products, we suggest consideration be given to the following:

Typically, DIC products require that an underlying policy invoke an exclusion. Attention should be paid as to when the DIC policy is triggered, for example, upon final denial of claim (which could take considerable time), or some other measurable action or point in time.

Any lack of alignment between terms, conditions, coverage triggers, and definitions between policies may increase ambiguity and add complexity when seeking to recover under a DIC policy.

Contractual liability policies are generally bespoke and intended for specific use cases. For such manuscript writing, clarity of intent is imperative for a meeting of the minds.

Scenario analysis provides clarity toward potential coverage gaps and impact of amendments, which will help determine if a new product is needed.

Lastly, be aware of various exclusions in your existing portfolio of insurance policies. The absence of an AI exclusion does not automatically mean a claim involving the use of AI is covered. In many cases, AI is only the technology from which harms manifest. It is imperative to understand what harm may result from a specific AI usage, like copyright infringement, bodily injury, or an AI-powered cyber event. One can then narrow down the potential products in scope, examine coverage triggers, definitions, conditions, and the relevant exclusions. For example, insurers apply “cyber” exclusions across many lines of insurance, and they may exclude an otherwise covered claim when a “computer system” contributes to causation.

The fact remains that client optionality exists, the market remains robust, and Marsh will continue to be a fierce client advocate.

On the horizon

We expect AI-enabled cyber activity to become more autonomous, persistent, and operationally integrated. We are already seeing some examples of offensive campaigns chaining reconnaissance, vulnerability discovery and exposure, tool selection, and workable exploits with less human engagement during the process (although still very much required).

The near-term impact is likely to remain uneven, with capabilities advancing faster than the ability of many organizations to govern, detect, and remediate. That said, exploitable targets remain constrained by human engagement, activity, the costs of crime, and other real-world obstacles.

You may wish to consider four key priorities: 

  • First, establish an inventory of AI use cases, agents, models, data, and connections to business systems. 
  • Second, extend zero-trust principles to agents, with least privilege and multi-factor authentication, explicit verification, approval gates, segmentation, logging, and the ability to stop or isolate activity. 
  • Third, test whether vulnerability management, threat hunting, and incident response can operate at “machine speed”, including across suppliers and shared technology. 
  • Fourth, translate governance into evidence for defensibility: defined ownership, testing, monitoring, training, and documented decisions.

Boards and executives should also expect closer scrutiny of third-party exposure, identity architecture, remediation capacity, and overall evidence of business resilience.

Regarding coverage considerations, there are signs and signals of the market reflexively reacting through the use of exclusionary language, and some are likely biding time, waiting for the market to turn — we unequivocally believe that any actions that leave our clients unprotected is unacceptable and are taking action to prevent that market narrative from becoming a reality.

While we live in a changing world of AI unknowns and its use evolves and expands, you can count on Marsh to be your resolute risk advisor. We are committed to keeping you informed and assisting you with understanding, measuring, managing, and responding to the risks that matter most to your organization, your success, and your resilience.

Contact us to learn more