For years, cyber insurance questionnaires were built around a familiar checklist.
- How frequently do you patch?
- Do you have an EDR?
- Do you require MFA?
- Are critical systems backed up offline?
- Do you conduct security awareness training?
These controls remain important. But they are no longer sufficient to answer the question insurers increasingly care about:
How quickly can your organization respond when a new vulnerability hits?
As AI accelerates vulnerability discovery, exploit development, reconnaissance and attack execution, cyber insurers are beginning to shift their attention from the presence of controls to the operational agility around them.
They want to know how quickly an organization can determine whether a newly disclosed vulnerability affects it, identify which systems are genuinely exposed, locate the responsible owner, implement an appropriate remediation or mitigating control, and prove that the risk has been removed.
In other words, cyber insurers are beginning to underwrite time.
AI is chipping away at the defender’s window to react
The main concern is not that AI has created a new category of cyber risk, but rather that it can dramatically accelerate risks that organizations already struggle to manage.
Frontier models are becoming increasingly capable of reviewing code, identifying subtle weaknesses, combining seemingly minor vulnerabilities into viable attack paths, and automating portions of the exploitation process.
Testing conducted through Anthropic’s Project Glasswing demonstrated how its Mythos model could identify individual vulnerabilities and connect them into more consequential attack chains. Visa, which participated in the project, concluded that the primary security bottleneck was shifting from finding vulnerabilities to validating, prioritizing, and fixing them quickly enough.
The UK’s National Cyber Security Centre (NCSC) reported that, over an 18-month period, the best-performing AI model completed nearly six times as many steps in a realistic, simulated enterprise attack. The cost of running a full attempt had fallen to approximately £65, lowering the level of expertise and resources required to conduct sophisticated operations.
In June 2026, cyber authorities from the Five Eyes warned that assumptions about cyber risk could become outdated in “months, not years.” Their message to business leaders was direct: resilience will depend on acting quickly and integrating cybersecurity into core business strategy, rather than simply accumulating more defensive tools.
That acceleration changes the economics of cyber insurance.
From point-in-time controls to continuous exposure management
Historically, insurers could use a set of established safeguards as proxies for cyber maturity. An organization with MFA, EDR, backups, segmentation and a documented incident response plan was generally considered better prepared than one without them.
That logic still holds, but only up to a point.
A company may have all of these controls and still require days or weeks to answer basic operational questions when a critical vulnerability emerges:
- Are we affected?
- Which assets are exposed?
- Is the vulnerability reachable or exploitable in our environment?
- Which business services could be disrupted?
- Who owns the affected systems?
- Are compensating controls already reducing the risk?
- Has remediation actually closed the attack path?
The Wall Street Journal reported in July 2026 that insurers are asking more detailed questions about how quickly policyholders can assess vulnerabilities, deploy patches, isolate affected systems, and recover from incidents. While the competitive insurance market has kept premiums broadly stable for now, carriers increasingly expect evidence that organizations understand and can manage AI-related security and privacy risks.
This represents an important shift.
A policyholder will no longer be judged whether it has a vulnerability management process or scanner, but increasingly by how the vulnerability management program performs under pressure.
A written patching policy is not the same as being able to remediate in a timely manner an actively exploited vulnerability on an internet-facing system. An incident response plan is not the same as demonstrating how quickly credentials can be revoked, workloads isolated and critical services restored. A closed ticket is not proof that an exposure has actually been removed.
The differentiator is becoming verified, evidence-backed action, at the speed of AI.
Mean Time to Adapt
Visa has given this concept a useful name: Mean Time to Adapt, or MTTA.
MTTA measures the time from the discovery of a weakness to a validated fix in production, supported by evidence. Visa evaluates it through factors including inventory freshness, the number of exploitable paths remaining after a release, and the time required to prove that a remediation works.
This is a more meaningful measure of resilience than the number of vulnerabilities identified or tickets closed.
Consider two organizations facing the same newly disclosed vulnerability.
The first produces a report showing 4,000 potentially affected assets. Analysts manually reconcile scanner data against the CMDB, contact multiple infrastructure teams, debate severity, open hundreds of tickets, and wait for patch confirmation.
The second automatically correlates the vulnerability with asset exposure, reachability, exploit intelligence, business criticality, deployed security controls, and ownership data. It identifies immediately the small subset of systems that create meaningful risk, assigns the correct teams, initiates semi-autonomous remediation campaigns, and validates that the relevant attack paths have been closed.
Both organizations may claim to have mature vulnerability management programs, but from an insurer’s perspective, they represent very different levels of risk.
The systemic-risk problem
Insurers are particularly concerned about aggregation risk: a single event producing losses across hundreds or thousands of policyholders.
The cyber insurance market has already experienced this dynamic through widely used software, cloud providers, and supply-chain compromises. AI could intensify it in several ways.
A frontier model or popular AI service may become a shared point of failure. A vulnerability discovered and operationalized through automated systems could be exploited across many organizations almost simultaneously. AI-generated attack tooling could allow a small number of threat actors to target a much larger population.
For insurers, such events create the possibility of correlated claims at a scale that is difficult to model using historical data.
The result will likely be tighter scrutiny of concentration risk, supply-chain dependencies and the ability of individual policyholders to interrupt an attack before it becomes a material loss.
What security leaders should do now
Organizations should not treat this as an insurance-documentation exercise.
The same capabilities that can improve insurability are the capabilities required to withstand AI-accelerated attacks.
- Turn knowledge of your digital terrain to your advantage. Security teams need an accurate, continuously updated understanding of assets, identities, applications, vulnerabilities, configurations, controls, and external exposure. An insurer cannot rely on a response-time metric if the organization spends the first several days determining what it owns and what’s critical.
- Make prioritization contextual, reflecting actual risk. Organizations can’t patch every finding at machine speed. They need to determine which exposures are exploitable, reachable, externally accessible, connected to critical services, or inadequately protected by existing controls.
- Automate the path to remediation. Identifying the right issue is only the beginning. The organization must find the responsible owner, select the appropriate action, coordinate across security and IT systems, manage exceptions, and escalate delays.
- Validate empirically that the exposure has been closed. A ticket marked complete, a patch deployment record or an email from an administrator is not necessarily proof that risk has been reduced. Organizations need evidence that the vulnerable condition or viable attack path no longer exists.
- Maintain the evidence trail. Insurers, regulators, boards and customers may increasingly ask not only what the organization’s policies require, but how its processes have performed in real incidents and high-priority vulnerability events.
From controls to outcomes
Cyber insurance is not abandoning controls. MFA, segmentation, endpoint protection, secure backups, and fundamental security hygiene remain essential.
But controls increasingly represent the starting point, not the final measure of maturity.
In a world where vulnerabilities may be discovered, connected into attack chains and operationalized at machine speed, resilience depends on the organization’s ability to make and execute good decisions just as quickly.
The next generation of cyber-resilient enterprises will be distinguished by their ability to move continuously from detection to prioritized, coordinated and verified risk reduction – at the speed of AI.
That is the capability cyber insurers are beginning to underwrite.
Reduce your Mean Time to Adapt
Tonic helps security teams accelerate the prioritization and remediation of vulnerabilities and other findings with an Agentic Exposure Management platform. Tonic connects fragmented security and IT signals, identifies the exposures that pose the greatest risk to the organization, and automates the path from detection to verified remediation, with human oversight throughout. The result is fast, safe risk reduction at the speed of AI.
As cyber insurers place greater weight on response speed, operational resilience and evidence of control effectiveness, organizations need more than another dashboard. They need a defensible way to demonstrate how quickly they can move from vulnerability disclosure to verified remediation.
Contact us to lLearn how Tonic can help your organization reduce its Mean Time to Adapt and build measurable resilience for the age of AI-driven cyber risk.
