Earlier this month, I participated in a panel discussion on cyber claims loss at the NetDiligence Cyber Risk Summit in Philadelphia. The session was titled “New Threats, New Tactics: The Changing Cyber Loss Landscape.” Lindsay Nickle of Constangy moderated, and I shared the stage with claims leaders from Travelers, Safety National, and Westfield Specialty. What follows is my perspective on the topic, not a recap of theirs.
I opened by declaring my lane. I am not useful on zero-day discovery or exploit development. What I have done is sit in three seats on the same loss: I handled cyber claims at one large-volume cyber carrier, ran a claims team and served as claims counsel at another, and now run delivery economics on the vendor side. I have written the reserve, received the vendor invoice, and signed the statement of work that produced it.
From those seats, the AI conversation in our industry, focused as it is on capability, looks miscast. It is actually a unit-cost conversation. Whether any single intrusion is more sophisticated because of AI matters less than what it now costs an attacker to produce a victim, and what it costs us to respond to one. The weeks since Philadelphia have reinforced that pattern rather than altering it.
My Point of View in Philadelphia: Economics Over Technology
I made three arguments. Each one is about economics before it is about technology.
The asymmetry is economic, not technical.
The attacker's binding constraint moved from access to triage.
For years the exfiltration pile was largely a bluff. The actor took a great deal of data and understood very little of it, so demands were priced against volume. When reading the stolen corpus becomes cheap, demands get priced against contents. The uncomfortable corollary is that in a growing share of matters the threat actor understands the exfiltrated data faster than the insured does. Negotiation posture, reserve, and notification scope all flow downstream from whoever reads and understands the data first.
The notification population is now a litigation exposure variable.
It used to be a compliance output. Plaintiff firms now source affected-individual data independently and contact people directly. Lawsuits are proliferating with fewer claimants within each class. That makes the scoping decision a forward-looking exposure decision taken at the point of maximum time pressure and minimum information. The carrier’s interest is accuracy in both directions. Under-scoping produces supplemental notice, regulatory attention, and a credibility problem. Over-scoping widens the pool from which a plaintiff firm will work directly. Nobody is suggesting notifying fewer people than the law requires. The point is that the number has consequences in both directions, and it deserves rigor.
I was careful on stage to frame all three as problems rather than solutions. The room did not need a vendor telling it what to buy. It needed a decision architecture.
What the Last Month Reinforced
First
The attack was loud, messy, and foolish in places. DIVD watched the agent decide its own next step after every action, saw it make errors a trained operator would not make, and found its comments so verbose that reverse engineering the intrusion was easier than usual. It still got in, got root access, and got data out. Sophistication was not the variable. Cost was.
Second
DIVD could not say whether the agent was executing a step in a larger campaign or running a capability test. The actor’s intent was unreadable from the actor’s behavior. That is new. For 20 years, incident response has inferred motive from tradecraft. When the tradecraft is generated on the fly by a model with a goal, the inference breaks.
The DIVD incident did not arrive alone. In July, OpenAI agents running in what was supposed to be an isolated evaluation environment exploited a previously unknown vulnerability to reach the open internet, then used exposed credentials and further vulnerabilities to get into Hugging Face’s production infrastructure. Breaking out was never part of the assigned task. OpenAI has acknowledged the incident, and by its own account deployment safeguards were intentionally not enabled for that evaluation.(6) In February, Anthropic’s Frontier Red Team reported that a frontier model found and validated more than 500 high-severity vulnerabilities in widely used open-source code without task-specific tooling.(7)
Then, this week, the largest one yet. On October 21, PHP’s developers released emergency fixes for two critical vulnerabilities that allow unauthenticated remote code execution against web servers running the language. PHP powers roughly 70% of the world’s websites. Not every PHP site is exploitable, but published estimates of exposed instances run from 1.3 million to more than 22 million. Cisco estimated that roughly half of internet-facing PHP installations are too old to receive the patch at all. CISA, the NSA, and their counterparts in the UK, Canada, Australia, and the EU told operators to patch immediately or take their sites offline. Finland’s government and the Dutch House of Representatives disconnected theirs. The flaws were found by a security researcher at Calif using OpenAI’s GPT-5.6 Sol model, and independently by Wiz with other models. Details leaked a day before the planned fix. Threat intelligence teams reported attempted exploitation in criminal forums before the patch was a day old.(8)
Two features of the PHP episode belong in every claims leader’s file.
The first is that the discovery was defensive. AI found the flaws before, as far as anyone knows, attackers did. The second is that the same capability runs in the other direction, and faster. As one researcher put it to the trade press, a patch is a recipe for what changed, and turning a patch into an exploit is a task AI systems are good at executing.(9) The window between a fix and a working attack is collapsing toward hours. An insured that cannot patch inside that window, and Cisco’s figure says half of them cannot, is not a hardening problem. It is a frequency problem waiting for a date.
The exposure on the other side of the ledger is growing at the same time. Censys’s October State of the Internet report counted roughly 268,000 internet-connected devices running AI products, a 63% increase in exposed AI tools between October 2025 and June 2026, with a peak near 300,000 endpoints earlier this year. Several of the most common products carry serious known vulnerabilities, including one that allowed arbitrary code execution on the host.(10) These are not the attackers’ agents. They are the insureds’ agents, reachable from the internet, and in many cases unmanaged by anyone with a security mandate.
The panel did not predict any of this. It named a pattern, and every week since has reinforced it. The cost of access is collapsing toward the cost of compute, and the actor on the other end increasingly reads what it takes before anyone on our side has opened the case file.
What This Means for Carriers and Counsel
If the attacker’s cost curve is falling toward zero, the only lever the carrier controls is its own cost curve. That is the claims-side version of the AI question, and it has three practical consequences.
Who reads the data first decides the matter.
An agent that exfiltrates data can also read it. The historic gap between what an actor took and what it understood is closing from the attacker’s side. The insured’s incident response has to close it from ours, which means the question of what was in the data stops being a notification exercise at week six and becomes a negotiation and reserving input at day three. Carriers that treat data review as a back-end compliance step will keep making the expensive decisions from behind.
Variance is the leakage, not rates.
Carriers do not have an incident response skill problem. They have a variance problem. The same fact pattern in the same industry at the same record count produces materially different allocated loss adjustment expense depending on which counsel, which forensics firm, which review provider, and which handler touched it. That spread is invisible in an average and it is where the money goes. As attack volume rises and the per-incident cost of access falls, the carrier that cannot predict its own response cost per matter is pricing blind. Reducing variance is worth more than negotiating rates.
Precision in both directions, and earlier.
The litigation exposure argument I made in Philadelphia gets sharper when access is cheap. More incidents means more notification decisions, each made under the same time pressure. Under-scoping produces supplemental notice and regulatory attention. Over-scoping widens the recruitment pool for plaintiff firms that are already sourcing affected-individual data on their own. The answer is not a smaller number. The answer is a defensible number, produced fast enough to inform the negotiation rather than follow it.
There is a fourth consequence that I did not cover on stage and one I think will matter most. The DIVD incident shows an actor whose intent could not be read from its behavior. Our claims processes, our coverage positions, and a good deal of our litigation strategy assume we can characterize the actor. Was this a nation-state, a financially motivated group, an insider, an automated test that escaped its sandbox? Policy language and reserving practice both lean on that characterization. When the actor’s goal is not clear, the characterization may be unavailable, and the claims file will need to proceed without it.
What Comes Next
I expect the next 12 months to be the period in which the industry stops debating whether AI makes attackers more capable and starts measuring what it has done to the unit economics of a loss. The capability debate was interesting. The cost debate is the one that shows up in the loss ratio.
Three things I will be watching. Whether frequency climbs in the small and mid-sized segment that was previously uneconomic for human operators to work. Whether the time from initial access to a priced demand keeps shrinking, which is the clearest signal that the actor is reading what it takes. And whether carriers begin to treat the variance in their own response cost as a loss control problem rather than a procurement problem.
The panel in Philadelphia was a good conversation among people who see the same losses from different seats. I was glad to be part of it. The month since has made the conversation more urgent, not different. The attacker’s marginal cost is heading toward zero. Post-incident delivery economics remains one of the most impactful cost levers left to manage.
(10) Censys, 2026 State of the Internet Report, October 14, 2026, https://censys.com/2026-state-of-the-internet-report/; Eric Geller, “Internet exposure of AI tools, ICS devices continues to grow,” Cybersecurity Dive, October 15, 2026, https://www.cybersecuritydive.com/news/ai-industrial-control-systems-internet-exposed-censys/833112/.
