Stryker disclosed it had no cyber insurance after a March attack that delayed surgeries and hit earnings. Jaguar Land Rover likewise declined coverage before a 2025 breach forced a system shutdown, leaving the carmaker to bear full costs.

Growing doubt about payouts has led to a decline in U.S. cyber policies, per the NAIC. Swiss Re forecasts premiums reaching $15.6bn last year, while prices have fallen. Yet three in four claims close without payment.

Cyber policies typically cover business interruption, crisis response, legal defence, and even ransom payments, but exclude crime or fraudulent funds transfer. For example, a $2mn theft via credential compromise would not be reimbursed; a separate crime policy is needed.

AI tools such as Anthropic’s Mythos are empowering attackers with more sophisticated ransomware and deep‑fake fraud. Existing policies still cover pre‑AI privacy breaches, but new AI‑driven exposures—like hallucinating enterprise AI—require updated coverage assessments.