Estimated reading time: 5 minutes
Upstream, which monitors connected vehicles for automakers, is expanding to robots, drones and other physical AI. When one of those machines breaks something, someone has to pay. Upstream CEO Yoav Levy says deciding which policy pays starts with proving what went wrong.
A robot on a warehouse floor damages stock. Was it hacked, running faulty software, or set up wrong?
“A robot manipulated by an attacker, a robot running faulty software, and a robot that was simply misconfigured can all cause the same damage for different reasons,” Levy said in written answers to my questions. “Each cause can point to a different party and possibly a different policy.”
Levy is co-founder and CEO of Upstream. The company builds what it calls live digital twins: continuously updated profiles of how each connected machine normally behaves. It builds them from data the machines already send, with no software installed on the device.
On 8 October, Upstream said it would take that platform beyond connected vehicles. Robots, humanoids, drones, autonomous mobile robots and farm equipment are next. Its backers include BMW, Hyundai, Volvo Group and two insurers, MSI Insurance and Nationwide.
Physical AI And The Which-Policy Question
For Levy, the claim starts with the cause. “The first step in any claim is establishing which one it was, which requires continuous monitoring,” he said.
A team that watches its fleet’s behavior “can show when the anomaly started, where it came from, and how it spread,” he said. “Without that visibility, teams are left trying to reconstruct events after the fact.”
The policies don’t line up neatly. Bodily injury cover under a cyber policy is “customarily limited to mental anguish and emotional distress,” broker WTW has said, as Cyber Insurance News reported this week. Since 2020, Lloyd’s has required first-party property policies to state whether they cover or exclude cyber-caused losses.
The same question came up when Terra Security sent AI agents into internal networks. If an agent causes an outage, the client’s business interruption cover or the vendor’s errors and omissions cover may respond.
What The Insurer Investors Did Not Answer
I asked whether MSI or Nationwide have used Upstream data in underwriting, or are only investors. Upstream did not address that part of the question.
I also asked for Upstream’s first paying customer outside automotive, and how many non-vehicle machines it monitors. Levy said Upstream “monitors over 40 million assets today.” He did not break out how many are not cars. The company’s pitch to Cyber Insurance News described “more than 40 million connected vehicles.”
Physical AI Under The Cyber Resilience Act
Regulation gives manufacturers a reason to watch. The EU’s Cyber Resilience Act has applied reporting rules since 11 September. Manufacturers must give early warning of actively exploited vulnerabilities within 24 hours. Upstream says robots, drones and other physical AI devices sold in the EU fall within those rules.
Levy said Upstream sells to both the robot maker and the operator. “A robot maker needs visibility across every unit it has shipped, at every customer site,” he said.
A warehouse running 500 robots cares more about safety and uptime. It needs to know fast whether the cause is “a cyberattack, misuse, a quality issue, or an operational anomaly,” Levy said, “because each one calls for a different response.”
Upstream points to May Mobility, which it says has delivered more than 550,000 autonomous rides in the US and Japan. May Mobility uses Upstream to spot unauthorized commands in near real time, the company says.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
What Fleet Monitoring Cannot See
“Normal” varies by machine, Upstream says. A vehicle in northern Sweden runs at a different temperature baseline than one in Riyadh. A robot in cold storage behaves differently from the same model on a factory floor.
I asked what Upstream cannot see, since it relies on what machines already report, and early fleets often report little. Levy said physical AI companies “understand the need to send as much telemetry to the cloud as possible.”
Fleet-wide analysis is the advantage, he said. “A single machine’s behavior in isolation can hide an anomaly that only becomes a visible pattern once it’s correlated across thousands of similar assets.”
His answer describes what Upstream does with the data a fleet sends. It does not say what happens when a fleet sends little. For an insurer sorting a claim, that gap may decide which policy pays.
FAQ – Physical AI
What is physical AI?
AI that senses, reasons and acts in the physical world, such as robots, drones, humanoids and autonomous vehicles.
When a hacked robot causes damage, which policy pays?
It depends on the cause. Upstream CEO Yoav Levy says a hack, faulty software and a misconfiguration can cause the same damage but point to different parties and policies.
Do cyber policies cover physical injury?
Often not fully. WTW says bodily injury cover under cyber policies is customarily limited to mental anguish and emotional distress.
What does the Cyber Resilience Act require?
Since 11 September 2026, manufacturers must give early warning of actively exploited vulnerabilities within 24 hours, with full notification within 72 hours.
What is a live digital twin?
Upstream’s term for a continuously updated profile of how each connected machine normally behaves, built from data the machine already sends.
Do insurers use Upstream’s data?
MSI Insurance and Nationwide are investors. Upstream would not say whether either uses its data in underwriting.
Related Cyber Insurance Posts
- Three In Four Exposed n8n Servers Run A Release With A Critical Flaw
- Upstream Report Flags Remote Attack Growth As HSB Adds Fleet Cyber Coverage(Opens in a new browser tab)
- CFC Adds Property Damage Coverage to $30M Cyber Insurance Product(Opens in a new browser tab)
- “Physical” Cyber Attacks to Vex Insured and Insurers (Opens in a new browser tab)
- Cyber Warfare Escalates Worldwide As AI Turns Digital Conflict Into Constant Pressure(Opens in a new browser tab)