If you sat through a cyber renewal in 2021, you have seen this movie. It is Groundhog Day, the clock radio just went off, and the same guy is insisting the risk is unknowable. Only the editing is faster this time.
1. Silence Is Not a Coverage Grant. Cyber losses were once covered mainly because nobody had excluded them. The industry called it silent cyber. Now it says silent AI, the same coin flip, except the coin talks back.
2. Act Two Is Always the Exclusion. ISO’s generative AI endorsements, CG 40 47 and CG 40 48, took effect January 1, 2026, with a definition broad enough to swallow anything producing text, images, audio, video, or code. Cyber took a decade to get here. AI took twenty-four months.
3. Cyber’s Numbers Explain Cyber’s Manners. Loss ratios at major carriers crossed 100% in 2020 and 2021. Marsh clocked premiums up 79% in 2022. AM Best put U.S. premium up 50% to $7.2 billion, with the standalone loss ratio dropping 23 points to 43%. Carriers did not find religion. They found a spreadsheet.
4. The Application Form Became the Security Program. By 2021, MFA went from best practice to no MFA, no policy. Microsoft says it blocks over 99% of automated account-compromise attacks. A two-page questionnaire hardened more networks than a thousand keynotes. Answer it wrong and you get a decline, a sublimit, or a rescission at claim time.
5. AI Is Running the Same Play. Carriers now want a model inventory, human-in-the-loop review, a tested kill switch, a named accountable executive, and provable data provenance, mapped to NIST AI RMF, ISO/IEC 42001, and AIUC-1. AI sublimits near 10% of the limit are the polite way of saying we are unsure.
6. New Carriers Arrive Before the Actuaries Do. Armilla lifted its Lloyd’s capacity to $25 million in January 2026. AIUC came out of stealth with $50 million tied to its own audit standard. Testudo began underwriting in January 2026. Munich Re’s aiSure has guaranteed model performance since 2018. That is how cyber started.
7. Actuaries Have the Hardest Job in the Building. Nobody can price a tail event on twenty months of data, so the loss triangle is being built from court dockets: Bartz v. Anthropic, reportedly $1.5 billion over training data; Moffatt v. Air Canada, where a chatbot’s improvisation became a contract; Mobley v. Workday on algorithmic hiring.
8. What to Do Before the Next Renewal. About 74% of small businesses use AI; almost none have read their endorsement schedule. Is CG 40 47 or 40 48 attached to my policy? Do I have affirmative AI coverage, or just the absence of the word no? Can I prove my governance, or only describe it? “We told everybody to be careful” is a sentiment, not a control.
Murray escaped Punxsutawney only once he used what the repetition taught him. We already have the cyber tape.