The Australian Signals Directorate warned that attackers target AI services. It listed five entry points including stolen API keys and tokens. Three recent incidents showed financial losses from AI credential theft. Standard cyber policies do not cover AI-specific risks clearly. One in five insurers reported AI-related losses in the past year. Half of those losses were not fully covered. CFC added explicit AI language to seven policies in June 2026. Most Australian policies still lack AI-specific wording. APRA warned financial firms that AI adoption outpaces risk controls. ASIC told licensees that AI lowers the barrier to sophisticated attacks. Brokers must now ask clients about AI deployments and controls. Renewal forms rarely require disclosure of AI usage. The ASD advised five control areas for AI credentials.
What changed
Cyber policies did not address AI credential theft or AI service access risks.
What it unlocks
Brokers can now assess and clarify AI-specific coverage gaps before renewals.
- 84,700 cybercrime reports in 2024-25
- $80,850 average business loss per incident
- 50% rise in average losses
- 20% of insurers reported AI-related losses
What you need to act on it
- AI services in use
- existing cyber insurance policy
Sources