Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Insurers are subject to AI governance rules and they are also the party asking other organizations AI governance questions as a condition of coverage. More than twenty states have adopted the model bulletin that turns AI oversight into an operational requirement for carriers, and those same carriers now send AI questionnaires to their corporate insureds. ‍ The sector facing both is well covered. What follows from it is not, and it produces something an insured can use. ‍

An AI product sold in Europe is described as facing two incident reporting duties. One under product security rules and one under AI rules, with different triggers and different deadlines. ‍ Only one of them is running. Article 14 of the Cyber Resilience Act has applied since 11 September 2026. The AI duty moved, and coverage published in the last few weeks still describes it as live. ‍

Somebody in operations builds an automation inside a sanctioned platform to solve a problem in their own workflow. It works, other people come to depend on its output, and eighteen months later that person leaves. ‍ The platform still lists the automation. Nobody inherits it, because it was never anybody's asset to begin with, and the offboarding checklist has no line for a thing that was never recorded as belonging to the person departing. ‍

An annual exposure figure for a retailer treats the year as uniform. Divide expected loss across twelve months, apply a duration, produce a number. The instinct that this understates a peak-season outage is correct and the usual reason given for it is wrong. ‍ The concentration is not where people assume, and the mechanism that makes a December outage expensive is not volume. It is that the demand has a deadline. ‍

Analyzing vendor evidence is a massive undertaking, which is why more third-party risk management (TPRM) tools now offer AI capabilities that let teams upload evidence and get a faster read on a security assessment. When these capabilities come up in a vendor evaluation, the conversation almost always narrows to one question: how accurate are the AI results? A tool can answer every individual question correctly and still leave you exposed.

Apple's 2025 App Store Transparency Report states that the company blocked over $2.2 billion in fraudulent transactions and removed roughly 59,000 apps for bait-and-switch tactics: publishing one thing to gain approval, then swapping in something else once the app goes live. The year before, fraud accounted for 38,315 of Apple's 82,509 total app removals, roughly 46%, making it the second-largest removal category that year. Google's numbers point in the same direction.

A cyber insurance application is treated as a form to complete. Somebody gathers the answers, checks the boxes, submits it and waits for terms. ‍ Read the other way, the questions are a ranked list of what a market with claims data across thousands of organizations believes predicts loss. The list was assembled by parties who pay when they get it wrong, which makes it a more disciplined signal than most control frameworks and it arrives for free. ‍

When Anthropic introduced Mythos Preview, the story practically wrote itself. Here was a frontier AI model taking work that once required researchers and threat actors a lot of time and compressing it into hours. Mythos demonstrated the ability to find and exploit vulnerabilities across major operating systems and browsers. In controlled testing, it produced a working Firefox code-execution exploit in less than an hour and developed eight in roughly 12 hours.