Cyber Insurance News story on executive cyber protection showing a glowing line running from an office tower to a family home at night

Cyber Cover Follows The Executive Home, And Gets Clearer On AI

by

Estimated reading time: 4 minutes

CFC has updated Cyber Proactive Response, its cyber policy for small and mid-sized businesses. Senior executives gain personal protection. The affirmative AI wording gets an update. The business interruption period stretches to 18 months.

A cyber extortion threat does not have to stop at the company network. It can follow an executive home.

CFC’s latest policy update is built around that idea. “Increasingly, they target the people responsible for running the business,” said Scott Bailey, CFC’s head of global cyber underwriting.

The specialist insurer announced three changes to Cyber Proactive Response (CPR) on 6 October:

  • new personal protections for senior executives
  • enhanced affirmative AI coverage
  • a business interruption indemnity period extended from 12 to 18 months

Executive Cyber Protection For SME Leaders

The executive cyber protection covers personal crime and extortion exposures. CFC lists personal cyber attacks, identity compromise, and cyber-enabled theft of personal funds.

It also pays to temporarily relocate executives and their families when a cyber extortion event brings credible threats of harm. The cover also includes trauma counseling. CFC has not published limits for the new protections.

The targeting behind executive cyber protection shows up in recent research. Zscaler ThreatLabz found that 62% of victims in one ransomware group’s campaigns held manager-level titles or above. In VikingCloud’s survey, 63% of large multi-location brands said a location received a deepfake or AI-generated message impersonating an executive.

Affirmative AI Coverage Gets An Update

CFC says businesses and brokers want more certainty about how cyber insurance responds to AI-related exposures. CFC says it designed the updated wording to provide that certainty.

See also  Axio And Dragos Link OT Risk Data To Cyber Liability Insurance Underwriting

This is not CFC’s first step. Insurance Business reported in July that CFC added affirmative AI wording to CPR in June. It then extended that wording to its media policy, completing a rollout across its portfolio. The earlier cyber wording covered incidents where AI hallucinations or large language model prompts cause system downtime, Insurance Business reported.

That places CFC in a particular part of the market. RAND’s study of insurance filings sorted carriers into three groups. The largest says nothing on AI. Verisk and ISO introduced optional AI exclusions effective January 2026. A smaller group, including AXA XL, Coalition and Munich Re, affirms cover. CFC’s wording falls in that third group.

Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!

Business Interruption Indemnity Period Moves To 18 Months

CPR’s business interruption indemnity period now runs 18 months, up from 12. CFC says many business interruption losses continue long after a business restores its systems.

Recovery often runs well past the restart. The Jaguar Land Rover attack halted production for about five weeks in 2025. A hauler lost £390,000 in the month after the attack, Cyber Tzar’s Andrew Horkan told the CINI podcast.

AI On Both Sides Of The Policy

CFC launched CPR in 2025, building its prevention services into the policy wording. The insurer is also applying AI to its own work. In April, it launched Lane Assist, an agentic underwriting system. It turns routine cyber submissions into quote recommendations, with an underwriter reviewing every output.

FAQ – Executive Cyber Protection

What has CFC changed in Cyber Proactive Response?

Three things: new personal protections for senior executives, enhanced affirmative AI coverage, and a business interruption indemnity period extended from 12 to 18 months.

See also  How AI is Changing Insurance: Risks, Coverage Challenges, and Industry Adaptation

What does the executive cyber protection cover?

Personal crime and extortion exposures, including personal cyber attacks, identity compromise and theft of personal funds. It also covers temporary relocation when extortion brings credible threats of harm, and trauma counseling.

Is this CFC’s first affirmative AI cover?

No. Insurance Business reported that CFC added affirmative AI wording to the policy in June 2026 and extended it across its portfolio. The October update enhances that wording.

What is affirmative AI coverage?

Policy wording that expressly confirms cover for losses involving AI, rather than staying silent or excluding them. RAND found most carriers’ filings say nothing on AI either way.

Why extend the business interruption period?

CFC says many business interruption losses continue long after a business restores its systems. The 18-month period is meant to match real recovery timelines.

Who is CPR for?

Small and mid-sized businesses. CFC launched the policy in 2025 with prevention services built into the wording.

Martin Hinton
Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.

Leave a Comment

×