Travelers, Nationwide Studies Highlight AI-Driven Cyber Liability Challenges

• By: Will Jones
• October 7, 2026

Artificial intelligence (AI) is creating opportunities for businesses while giving cybercriminals new ways to exploit them. Two recent studies from Travelers and Nationwide examine both sides of that story, showing that businesses are increasingly alert to cyber threats but often lack the policies, employee training and incident response plans needed to keep pace with AI’s rapid adoption.

According to the 2026 Travelers Risk Index, cyber threats rank as the top overall business concern for the fifth time in eight years. 

The study found that companies are more knowledgeable about cyber threats, more confident and taking more preventive steps than a year ago. Yet, vulnerabilities remain, especially as AI becomes embedded in everyday operations.

“Businesses view cyber threats as a serious concern, and they’re getting smarter and more prepared—investing in controls, building confidence and turning to their insurance carrier for guidance,” said John Menefee, vice president and enterprise cyber lead at Travelers.

“At the same time, the rapid rise of AI is creating opportunities for attackers just as companies are making progress on basic defenses,” Menefee said. “The message is clear: Organizations of all sizes should treat cyber threats, especially AI-related cyber risk, as a core business issue and take steps to strengthen defenses.”

Nearly 6 in 10 respondents (58%) from the annual nationwide survey said they worry some or a great deal about cyber threats, ahead of economic and geopolitical concerns.

The top five overall concerns were: cyber threats (58%); broad economic uncertainty (55%), last year’s top concern; medical cost inflation (53%); the impact of the global economy on a company (49%) and global/political conflict, terrorism and social unrest (48%).

The pace at which companies adopt strong cyber defenses is part of the challenge. Nearly 9 in 10 survey participants (89%) reported using AI day to day within their workforce—yet fewer than 6 in 10 (59%) have formal practices in place to govern AI use.

“This 30-point gap really stands out, and it cuts both ways,” Menefee said. “Companies are focused on what cybercriminals are doing with AI, and that concern is justified. However, companies should be equally focused on the risks created by their own AI use when the right practices and policies aren’t in place.”

Further, businesses are embracing AI faster than they are putting formal rules around its use, according to a Nationwide survey of small and mid-market business owners, which points to a growing gap between how quickly businesses are adopting AI and the safeguards they have in place to manage its use.

The Nationwide survey found that 6 in 10 business owners say employees use public AI chatbots or writing tools for work-related tasks, while just 36% have written policies governing employee AI use and 37% provide training on responsible use.

More than a third (35%) believe employees use unauthorized AI tools for work, potentially leaving business owners with less visibility into how the technology is used across their companies. Only 27% of business owners say their businesses have rules governing what company or customer information can be entered into AI tools, while just 25% have procedures to verify AI-generated information before using it for business decisions.

“AI is already becoming part of how many businesses work, but the policies around its use haven’t necessarily caught up,” said Bobbie Goldie, vice president of commercial cyber at Nationwide. “Business owners need to know which tools employees are using and set clear expectations around what information can be shared and how AI-generated work should be reviewed.”

The same technology businesses are adopting internally is also being used by cybercriminals to target them from outside. Nearly one-third (31%) of small and mid-market business owners say their company has been targeted by a scam or fraud attempt using generative AI within the past 12 months.

More than half of independent insurance agents (52%) say they have observed an increase in claims related to generative-AI scams or fraud attempts over the same period. As AI changes both how businesses operate and the cyber threats they face, many still have work to do to prepare—only 35% of owners say they have an up-to-date incident response plan.

“Small and mid-market businesses are often balancing cyber preparedness with a long list of other business priorities,” said Goldie. “That makes it especially important to understand where the business may be exposed, make sure employees know what to do and have a plan in place before an incident occurs. Business owners should also talk with their insurance professional about how their risks are changing and whether their protections are keeping pace.”

Will Jones is IA editor-in-chief.