Cyber security and resilience regulation is changing rapidly. Newer regimes are moving beyond the traditional GDPR focus on personal data and requiring organisations to understand and protect the wider technology environment on which their businesses depend, including systems, information assets, suppliers, cloud, and infrastructure dependencies and, increasingly, AI. At the same time, AI creates new security risks that conventional cyber controls were not designed to address, including prompt injection, manipulated data and autonomous agents using legitimate access in unintended ways. Crucially, these advanced AI risks converge with persistent, high-impact threats like ransomware, which now leverage automated speed to bypass traditional perimeters.

For managing agents, this matters twice: they must manage these risks within their own operations while also underwriting insureds whose governance, security and liability exposures are changing just as quickly. Existing policies may already respond to AI-related and ransomware losses across cyber, PI, Tech E&O, D&O and other classes, despite those exposures never having been specifically identified, underwritten or priced. The challenge for managing agents is therefore not simply understanding new regulation, but determining what risks their insureds present, ensuring they utilise modern detection and containment solutions, and identifying where common technology dependencies could turn individual losses into significant portfolio accumulation.