Security Leaders Say AI Innovation Comes First. Insurers Are Asking Questions.

Estimated reading time: 6 minutes

Two in five security leaders in a Tevora poll say their company puts AI innovation ahead of security. Only 16% say security comes first. Now insurers are asking about AI oversight.

Companies are adopting AI fast and bringing security in late, according to Tevora’s 2027 CISO Trends Report. Chief information security officers (CISOs) often arrive after the business has approved, bought and embedded AI tools, the report says.

Insurance carriers are adding AI questions to their reviews of companies, according to Tevora’s Jeremiah Sahlberg. “Yes, we are actively seeing insurance carriers incorporate specific inquiries around AI usage guidelines, asset inventories, and risk evaluation procedures for integrated platforms,” Sahlberg, a principal and managing director at the firm, told me.

The chief information security officer (CISO) “should typically be involved” in those discussions, he said. That helps ensure the business posture is properly represented, he added.

Tevora is a cybersecurity consulting firm. It sells compliance, risk, threat management and virtual CISO services. Its 2027 CISO Trends Report says companies are adopting AI faster than they can understand, govern, secure, and measure it.

Tevora says the trends draw on more than 1,000 client engagements over the past year. Its own data come from two sources. A survey of nearly 350 security leaders and professionals ran from May to July 2026. They came from Tevora’s clients and prospects. A live poll at a July 8 webinar on AI compliance drew 36 to 44 answers per question. Sahlberg said the poll “should be treated as directional.”

AI Oversight Trails AI Adoption

In the webinar poll, 39% said their organization puts innovation ahead of security. Another 28% said it carefully balances the two. Seventeen percent were not sure, and 16% said security comes first.

Asked about their biggest challenges in governing AI, 61.4% named juggling innovation with control, oversight, and regulatory expectations. Half named visibility into where their organization uses AI. And 40.9% named clear ownership and accountability for AI risk.

In the larger survey, 31% named AI governance as a key initiative for the coming year. That led all other initiatives.

Ownership is unsettled elsewhere, too. In a new IANS and Artico Search benchmark, 15% to 19% of CISOs say no single executive owns AI governance. The Tevora report tells CISOs to “claim a formal role in AI oversight now, before adoption outruns governance.”

Where AI Risk Hides From The Inventory

Companies generally keep a list of approved AI platforms, Sahlberg said. The blind spot is AI that nobody has approved. He named three sources. Employees use personal AI accounts on corporate systems. Approved vendors add AI features after the fact. And internal teams build locally hosted large language models.

Permissions are a second gap. “We do see some clients that have enabled connections with excess permissions to get their internal AI capabilities off the ground,” he said. Many of them need to go back and tune those settings, he said. Permission management often gets pushed aside in the name of innovation, he added.

The report treats identity as the main control point for AI agents. It cites ManageEngine research that non-human identities outnumber human ones 100 to 1. An over-permissioned agent can act far faster than a person, the report notes.

Carriers now ask about AI inventories and usage rules. Yet a proposal form only captures what an applicant knows and declares. Sahlberg’s blind spots show where those answers could fall short.

AI Risk Spreads Through Vendors And Code

The report cites Verizon’s 2026 Data Breach Investigations Report on third-party exposure. A third party played a role in 48% of breaches, up from 30% a year earlier.

AI is also finding flaws faster. The report cites a 210% annual rise in valid AI-related vulnerability reports, from HackerOne’s October 2025 report. Often the flaw sits in software a company does not control, the report says. The company then carries known exposure until someone else ships a fix. Coalition now sends policyholders alerts on zero-days under attack.

Vendors are crowding into AI security. The report counts as many as 336 cybersecurity deals through the third quarter of 2026. It cites The Wall Street Journal, Momentum Cyber, and Solganick & Co. Its advice is to extend controls a company already owns and buy only for a genuine gap.

Compliance Is A Floor For AI Governance

Only 4% of survey respondents said ISO 42001, the AI management system standard, applies to them. SOC 1 or SOC 2 applied to 41%. The standard covers AI management systems, so it won’t fit every respondent, Sahlberg noted.

He expects ISO 42001 to grow in 2027. AI questions are multiplying in third-party vendor reviews, he said. Clients see the certification as one way to ease questionnaire fatigue.

Compliance does not guarantee security, he said. Frameworks set a minimum standard and often cover only a slice of the business. Examples include the cardholder data environment under PCI and the authorization boundary under FedRAMP. “Compliance in and of itself should not be considered a finish line for security,” he said.

CISO Trends: Resilience Beyond The Backup

The report says resilience is still a small slice of security budgets but is growing. Sahlberg sees gaps beyond data restoration. Many companies rely on a single cloud provider and assume it absorbs availability risk, he said. Many also lack working redundancy during a provider outage. Leaders then have to weigh those dependencies against their recovery time and recovery point objectives.

D&O Cover For AI Oversight

Taking on AI oversight also brings accountability. The Securities and Exchange Commission sued SolarWinds and its CISO in 2023. It dropped the case in November 2025.

I asked Sahlberg whether a CISO should confirm directors and officers (D&O) coverage or indemnification before taking that seat.

“Yes, I think this is an important conversation and one that any named CISO should have with their organization,” he said.

FAQ – AI Oversight

Are cyber insurers asking companies about AI?

Yes, according to Jeremiah Sahlberg of Tevora. Carriers ask about AI usage guidelines, asset inventories and risk evaluation procedures for integrated platforms.

Who should answer insurer questions about AI?

Sahlberg says the CISO should typically be involved, to help ensure the business posture is properly represented.

Where do companies miss AI in their inventories?

Personal AI accounts on corporate systems, approved vendors that later added AI features, and locally hosted large language models built by internal teams.

Do security leaders say they balance AI innovation and security?

In a Tevora webinar poll, 28% said their organization carefully balances the two. Another 39% said innovation comes before security.

Does ISO 42001 apply to many companies?

Only 4% of Tevora survey respondents said it applies. Sahlberg expects growth in 2027 as AI questions multiply in vendor reviews.

Should a CISO check D&O coverage before taking on AI oversight?

Sahlberg says any named CISO should discuss directors and officers coverage or indemnification with their organization.

Related Cyber Insurance Posts

• About One In Six Companies Say No Executive Owns AI Governance
• AI Risk Grows As Firms Sacrifice Identity Security For Speed(Opens in a new browser tab)
• Cyber Risk Management Lags Behind AI Adoption, Report Finds(Opens in a new browser tab)
• Lockton Re To Use CyberCube’s XM to Enhance Cyber Portfolio Risk Oversight(Opens in a new browser tab)
• Diligent’s New Board Dashboard Raises a Question Insurers Should Love(Opens in a new browser tab)