The Center for Cybersecurity Policy and Law today published a new whitepaper, Cyber Insurance in the Age of AI Phishing: Why Underwriters Should Care About Phishing-Resistant Authentication, examining how the cyber insurance industry can better address the growing risks posed by AI-enabled phishing.

The paper comes at a time when rapid technological change is reshaping the cyber threat landscape. Generative AI is making phishing and other social engineering attacks faster, more scalable, and more convincing, while new threats continue to emerge at a pace that can make it difficult for defenders and policymakers to keep up. 

Recent industry and government data cited in the paper indicate that AI-enabled attacks are becoming not only more common, but also more costly. This creates an immediate challenge for businesses and their customers, but it also has significant implications for the cyber insurance industry. Phishing and social engineering already sit upstream of many of the most frequent and costly cyber insurance claims, including business email compromise, funds-transfer fraud, ransomware, and data breaches. As AI makes these attacks more effective, growing losses could place additional pressure on the cyber insurance market and insureds.

To make matters worse, many businesses are relying on outdated security controls that are growing irrelevant against modern AI powered attacks. Phishing-resistant multi-factor authentication (MFA) solutions, including passkeys and hardware security keys, help address these challenges, and their impact in risk reduction is notable: a major cyber insurer found that using phishing-resistant MFA reduced likelihood of a breach by 2.25 times relative to legacy multi-factor authentication (MFA)—such as SMS codes and push notifications—that attackers can phish or otherwise bypass.

However, while phishing-resistant MFA is widely available and increasingly deployed, adoption remains well below where it needs to be. This is because many organizations continue to rely on older, less secure types of MFA that cannot stand up to phishing attacks. This leaves an important gap between the protections available today and those many organizations actually have in place.

Cyber insurers are well positioned to help close that gap. The industry has done so before, helping move organizations from passwords alone to MFA as ransomware losses increased. The paper argues that insurers can use their influence in the market once again by replacing questions around legacy MFA with those focusing on stronger authentication control practices—helping accelerate the transition from legacy MFA to phishing-resistant MFA.

To help underwriters put that approach into practice, the paper offers four recommendations:

• Modernize cyber insurance applications. The paper recommends that underwriters replace broad, low-signal questions about MFA with more specific questions about how authentication and identity controls operate in practice. It provides 12 specific questions underwriters can use to update their applications, organized into three tiers for small and medium-sized enterprises, mid-market organizations, and larger enterprises. 
• Help insureds improve during the policy period. The paper recommends that insurers use the policy period to encourage stronger identity controls through broker and insured education, implementation guidance, partnerships with security providers, incentives for verified phishing-resistant MFA deployments, and other measures that can help insureds improve their security posture. 
• Capture better claims data. The paper calls on insurers to develop a more consistent claims taxonomy that captures the specific identity-control failures behind losses, rather than recording only outcomes such as business email compromise, funds-transfer fraud, or ransomware. Better data can help improve underwriting decisions and identify emerging control weaknesses earlier. 
• Future-proof for agentic AI. For more forward-leaning insurers that want to proactively address risks evolving at an unprecedented pace, the paper recommends beginning to incorporate questions about AI agents and automated workflows into underwriting applications. These include questions about least-privilege access, human accountability, machine identities, and human approval for high-consequence actions. 

The paper also includes a technical annex that provides both underwriters and risk engineers with a practical guide to the different forms of MFA they may encounter. By explaining how legacy and phishing-resistant authentication methods work and differ in practice, the annex can help insurers ask more informed questions, interpret applicants’ responses, and better understand whether an organization’s MFA deployment meaningfully reduces risk.     

Taken together, these recommendations give cyber insurers a practical path to modernize their underwriting practices, encourage broader adoption of phishing-resistant MFA, and prepare for both today’s AI-enabled phishing threats and the risks that will follow.