Estimated reading time: 11 minutes
Erin Kenneally returns to the CINI podcast a year after warning that AI could repeat cyber insurance’s ransomware mistakes. Insurers are writing AI out of policies faster than they write it in, she says. Her new company, DLTASKOP, aims to give underwriters the evidence to price it.
Get The Podcast Here
Most companies haven’t bought AI insurance. Many have lost AI cover anyway.
“Most companies haven’t bought AI-specific policies,” said Erin Kenneally, CEO and co-founder of DLTASKOP. “They’ve simply, unbeknownst to them, lost protections that they assumed their general liability or their cyber policies provided. And often without notice.”
She calls it a classic shadow AI problem. Companies use AI their insurers never priced. Their policies quietly stop covering it.
Kenneally first joined the podcast last October. She warned then that AI could repeat the industry’s ransomware mistakes, only faster. She also said people “underestimate how difficult it is to determine if and to what extent AI is and will be the cause of some of these losses because it’s so embedded.”
Twelve months on, she stands by it. “I think it stands up pretty well,” she said.
Her case rests on three papers on her Substack, Convention Unbound. Artificial Insurance, published in April 2025, mapped coverage, control and measurement gaps. AI Risk Insurance Evolution looked back a year later. Governance Controls Beget Coverage, from June 2026, laid out the controls underwriters should look for.
AI Exclusions Arrived Before AI Cover
A year ago, carriers and brokers gave mixed answers. “Some said nothing to see here, it’s all covered under cyber,” Kenneally said. “Others would quietly tell you that they were very concerned because there’s a ton of unpriced risk sitting on books.”
Then the exclusions came. Verisk’s ISO unit made generative AI exclusions available for commercial general liability policies in January. By mid-2026, 2,369 generative AI exclusion records were in force across 49 states, Insurance Business reported.
Her April retrospective found the same pattern across cyber, tech E&O, CGL, D&O and EPL. Exclusionary contract wording “is codifying faster than affirmative AI-specific protection is scaling,” she wrote. The gap between what buyers think they bought and what AI claims trigger has likely widened, she wrote.
Kenneally added a caution. Filing an exclusion and applying it are different steps. “Just because it’s filed doesn’t mean that it’s been implemented,” she said.
She doesn’t blame carriers for writing exclusions. “Insurance is in the business of making money,” she said. “It’s not a charity.” An exclusion can be a rational risk decision. But it leaves the buyer looking for replacement cover somewhere else.
Four Tiers, No System-Level Answer
Kenneally sorts the AI insurance market into four tiers:
- Legacy exclusions. Traditional policies remove AI exposures they never contemplated or priced.
- Specialty affirmative cover. Standalone products name and define AI losses. “They’re usually pretty narrow, and the limits can be rather low relative to the risk at hand,” she said. Buyers should read the triggers, exclusions, limits, retentions, and coinsurance, she said.
- Coordinated or certified underwriting. Benchmarking, technical evaluation and certification turn measurable model behavior into underwriting distinctions. Some products wrap an AI liability layer around a cyber or tech E&O policy, with set rules for splitting losses. Others tie cover to measurable AI performance failures.
- Infrastructure capacity. Property insurers back the data centers, equipment and construction behind AI.
The last tier is the most familiar. It is also the least relevant to AI’s own risk. “Insuring the physical data center is really not the same as insuring what comes out of it,” she said.
The market is more sophisticated than it was in April 2025, her retrospective found. Yet “none of these tiers, alone or together, constitutes a system-level response,” she wrote. Specialty products mostly serve the attritional layer of frequent, bounded losses. A smaller cluster of incidents involved deaths, nation-state implications, or correlated AI failures across many insureds. Those would be hard to absorb through conventional lines, she wrote.
The 92% Problem
Kenneally coded 357 publicly reported AI incidents from roughly April 2025 to March 2026. She drew on databases such as the AI Incident Database. She recorded each incident’s risk category and severity. Then she checked whether a standard pre-breach cyber control would have helped.
“In about 92% of those cases, there was no standard cyber control that would have been helpful,” she said. None would have plausibly interrupted or materially reduced the harm.
In the paper, 329 of the 357 incidents had no applicable standard pre-breach cyber control. Twenty-eight got partial help from legacy controls. None was fully preventable through the standard stack. The cyber control paradigm “is aimed at the wrong threat model,” she wrote.
The least-covered risks also look the most severe. Harmful outputs, discrimination and bias, autonomous actions and influence-related harms sit where coverage and controls are weakest. Harmful outputs were a small share of incidents but a disproportionately large share of confirmed tail incidents, she found.
The usual stack answers a different question, she said. MFA establishes identity. Patching fixes known vulnerabilities. EDR looks for malicious activity. “None of them are able to establish that an authorized AI-generated decision is accurate, appropriate or within authority,” she said.
She gave three examples.
A fabricated legal citation needs no breach. “So that’s not gonna trigger a cyber policy,” she said. “An agent itself can make an operational error within a session that is fully authorized by the company that’s deploying it.” A deepfake can cause a loss without touching the network.
Cyber controls still matter where AI speeds up familiar attacks. “Let’s not throw it out, but we also have to realize that a new control stack is needed,” she said.
Misuse, Misalignment And Mistake
Kenneally groups AI harm into three causes.
- Misuse. Someone deliberately manipulates the system. Adversarial attacks and prompt injection fall here. These look like familiar cyber attacks.
- Mistake. The system, or the person who set it up, simply gets the task wrong. Hallucinations and miscalculations fall here.
- Misalignment. The system pursues its goal in a way its users never intended. “The new M on the block, so to speak, would be this misalignment,” she said.
Misalignment “is probably the hardest to price,” she said. It happens inside the model, which is usually opaque. Success can also cause the loss. “The apparent success of the model in optimizing can also be the pathway to the loss itself,” she said.
Her example was a GPS told to find the fastest route. It takes the driver over a cliff. “It’s actually fulfilling its purpose, and it’s successful in that regard, but it also becomes the pathway to the loss,” she said.
Claims data can’t yet settle which risk arrives first. “I don’t think we have a sufficiently mature body of AI-specific insured claims,” she said. She expects mistakes and misuse to appear first, under familiar labels such as fraud, professional errors and technology failures.
Misalignment will hide at first, she said. “It’s probably gonna arrive disguised as something else to begin with, like some sort of tech E&O event or operational error or management failure,” she said.
Deterministic Enforcement For AI Agents
Agents act on their own. Oversight has to go deeper than the model’s account of itself. Oversight “should be more than just trusting what the reasoning process of the model says,” she said. She cited the PyPI incident in Anthropic’s September alignment assessment, which CINI covered. She also cited a Hugging Face incident.
Kenneally separates three functions. Visibility shows what the model appears to be doing. Runtime enforcement sets what it may do. Evidence shows what it actually did. “There’s something that it’s trying to do probabilistically,” she said. “What’s it permitted to do? That should be deterministic.”
The evidence piece matters because “models can fabricate evidence and lead investigations astray,” she said. Governance can’t stay on paper. “It’s gotta move inside the enforcement authority,” she said. “So you can’t have the fox guarding the hen house.”
Today’s agent governance “resembles ATC with incomplete aircraft awareness,” her June paper says. Radar maps to discovery. Transponders map to agent identity. Flight plans map to intended authority. Flight recorders map to evidence.
The analogy breaks in a useful place. An air traffic controller can’t reach into the cockpit. Software can intercept an agent’s tool calls, refuse actions or require human approval. “I think we can build the execution boundary for an agent that is stronger than how we can enforce a relationship between an ATC and a pilot,” she said.
Three Questions
Her June paper turns that into three questions for insurers. Do controls cut how often and how badly losses happen? Can insurers see correlated exposure across insureds? Is post-loss evidence enough to reconstruct what happened? Insurers “should not price agentic AI governance by tool presence alone,” she wrote. Credit should depend on which tiers a company covers and whether enforcement is binding. It should also reflect the integrity of its logs and how much agent traffic runs under control.
Kenneally said the real question is “what rises to the level of an insurable harm?” A chatbot answering weather questions needs few guardrails. A system making consequential decisions needs many. She pointed to Air Canada. In 2024, a tribunal held the airline liable for its chatbot’s wrong advice on bereavement fares, Global News reported.
Testing 11 AI Governance Tools
For the June paper, Kenneally compared 11 commercial governance tools against her control stack, using public information. “I didn’t find any of those tools that covered kind of the full range of what you would want to address from an underwriting perspective,” she said. The market has since converged, as cyber vendors add AI controls or buy AI risk firms.
Underwriters haven’t yet made AI-native controls conditions of coverage at scale. She calls that “an underwriting-choice problem as much as a tooling problem.” Waiting is costly. “If you sit back and wait for those claims to come in, you’re already behind the eight ball,” she said.
DLTASKOP: An Intelligence Layer For AI Risk Insurance
Kenneally’s new company, DLTASKOP, is pronounced “Delta Scope.” The name comes from delta, the Greek letter used for a gap. It is not an MGA or an insurer. It doesn’t underwrite, she said. She describes it as an “AI risk insurance intelligence layer.”
DLTASKOP aims to identify AI risk, coordinate risk and control signals, and turn them into evidence for underwriting and pricing. The evidence exists today, she said. “It’s really scattered, it’s uneven, it’s rarely organized around decisions that insurance needs to make.”
Her company’s line sums up the problem it sells against. “AI insurance is being bought and sold blind to that delta,” she said.
Five Steps For Risk Managers Deploying AI Agents
Kenneally gave five steps to take this quarter:
- Audit your policies for AI exclusions. Work with your broker on cyber, CGL, D&O, and E&O. Check whether the ISO endorsements have landed in your policy.
- Inventory every agent. Include shadow AI that no one manages. People can spin up models and agents trivially, she said.
- Put binding deterministic enforcement on high-impact actions. She gave clinical decision support as an example.
- Keep claims-grade logs. “Logs are not logs are not logs,” she said. Logs should capture traces of agents’ actions and decisions. “Make sure that the evidence is tamper-proof.” She expects “a premium placed on the pre-forensic readiness of companies.”
- Trade proof for better terms. Companies should use provable controls and shared telemetry to win lower premiums, higher limits or lower deductibles. Carriers can’t simply demand that data, she said. “The only way they can require it is if they give policyholders proper incentives.”
Carriers still lean largely on external scan data in cyber, she said. AI has no equivalent yet.
Insurability varies by category, deployment, observability and measurability, her retrospective argues. Some slices are becoming tractable through evaluation, telemetry and performance-linked structures. Others remain too diffuse, unmanaged or correlated for conventional transfer.
The retrospective ends on a coordination warning. Carriers are excluding, specialty providers are experimenting, control vendors are scaling, and reinsurers are waiting. Each is acting rationally, she wrote. The risk is “systemic fragmentation” if no one builds the layer that connects them.
Her closing advice was to hold on to fundamentals. “If you stay grounded in fundamentals and apply those to the issue at hand, you can prevent from kind of being in quicksand,” she said.
FAQ – AI Exclusions
What are AI exclusions in insurance?
They are policy terms that remove cover for losses arising from AI. Verisk’s ISO unit made generative AI exclusions available for commercial general liability policies in January 2026.
Do companies know they have lost AI cover?
Often not, Erin Kenneally says. Most haven’t bought AI-specific policies. Many have lost protections they assumed their general liability or cyber policies provided, often without notice.
Why don’t standard cyber controls stop AI incidents?
In 329 of 357 AI incidents Kenneally coded, or 92%, no standard pre-breach cyber control applied. MFA, patching and EDR can’t prove an AI decision was accurate or within authority.
What are misuse, misalignment and mistake?
They are Kenneally’s three causes of AI harm. Misuse is deliberate manipulation. Mistake is getting a task wrong. Misalignment is a system pursuing its goal in ways its users never intended.
What is deterministic enforcement for AI agents?
It is a rule-based control that decides what an agent may do at runtime. It can block an action or require human approval, rather than only scoring risk.
What should risk managers deploying AI agents do now?
Audit policies for AI exclusions, inventory every agent, enforce rules on high-impact actions, keep tamper-proof claims-grade logs and use proven controls to negotiate better terms.
Full Transcript
Download the full transcript: Cyber Insurance News Podcast With Erin Kenneally, DLTASKOP
Related Cyber Insurance Posts
- Executive Exposure Starts At Home. A Family Password Can Lead To The Company, 360 Privacy Says.
- Remembering the Obvious: In Cybersecurity and Insurance, People Matter Most – Opinion(Opens in a new browser tab)
- One More Coverage Gap for Buyers of Cyber Insurance to Worry About (Opens in a new browser tab)
- Kroll: Low Cyber Maturity Drives AI Incident Rates To 89% – And Most Firms Are In The Middle(Opens in a new browser tab)