Travelers Risk Index: Cyber Rises to Top Business Concern as AI Expands Attack Surface

Travelers' latest Risk Index finds cyber risk is the top concern for U.S. businesses, driven in large part by rapid, often ungoverned adoption of artificial intelligence. The survey of 1,202 U.S. business insurance decision makers shows widespread AI use, growing fear that AI will be weaponized by attackers, and a mixed picture on preparedness: more companies are buying cyber insurance and investing in basic defenses, yet formal AI policies and simulation-based readiness remain incomplete.

• 58% of respondents said they worry a great deal or some about cyber risks, placing cyber ahead of economic and geopolitical worries. This is the fifth time cyber ranks number one in eight years of the index.
• 89% report AI is used in day-to-day operations. Despite that, just 59% have developed business practices governing employee use of AI.
• 55% said they were concerned about a security breach or cyber event involving AI, with specific worries about AI-enabled exploitation of system vulnerabilities, phishing and social-engineering schemes, and retention of company data to train AI models.

• Insurance: 70% of surveyed firms report purchasing cyber insurance—an index high since 2018. Respondents expressed trust in insurers for cybersecurity expertise: 92% view carriers as a source of guidance.
• Controls: Companies report increased spending on firewalls, data backups, multifactor authentication, employee background checks, and improved onboarding and offboarding procedures.

• Governance: With nearly nine in ten using AI daily but only six in ten having usage policies, governance is uneven.
• Readiness exercises: The index shows room for improvement in running cyberattack simulations and testing incident-response plans. Firms may be strengthening perimeter controls while under-investing in practice and tabletop exercises that prove whether plans will work under real pressure.

John Menefee, vice president and enterprise cyber lead at Travelers, says businesses are "getting smarter and more prepared—investing in controls, building confidence and turning to their insurance carrier for guidance." He adds that the rapid rise of AI "is creating opportunities for attackers just as companies are making progress on basic defenses," and he urges organizations to treat AI-related cyber risk as a core business issue and strengthen defenses.

Practical implications for business leaders

• Review AI governance now: If your organization uses AI in daily operations, confirm there are documented rules for how employees may use models and company data.
• Rebalance investments: Continue funding technical controls (firewalls, MFA, backups) but allocate time and budget to run regular tabletop exercises and full-scale incident simulations.

The Travelers index shows businesses recognize cyber risk as a leading threat and are responding with insurance purchases and defensive spending. However, the speed of AI adoption outstrips governance and practical readiness. Organizations should close that gap by formalizing AI policies and exercising incident response under AI-driven scenarios.