AI in Insurance Underwriting: Assessing Cyber Risks in India
- Insurance leaders said on 27 October that point-in-time questionnaires cannot keep pace with cyber risk that changes almost daily.
- CERT-In reports AI agents reaching live Indian systems through exposed credentials, and one attack campaign cutting access-to-impact time to a few hours.
- Insurers must price the cyber policies they write and secure their own systems and third-party technology.
- Four practical checks show how fast your underwriting and claims systems can respond when a risk assumption changes.
Why Underwriting Is Under Pressure Now
On 27 October 2026, general insurance leaders at the Business Standard BFSI Insight Summit described the problem plainly. Animesh Das, MD and CEO of Acko General Insurance, said: "Traditional point-in-time questionnaire-based underwriting cannot keep pace with risk changing almost daily." He added that one underlying cause or technology provider can affect many customers at once, which makes the scale of losses hard to judge. Hitesh Joshi, chairman and MD of GIC Re, raised the same difficulty with cyber accumulation, and said AI adds risks that historical data does not capture. (Business Standard; a second report covers the same panel.)
Two weeks earlier, on 15 October, CERT-In issued a critical-rated advisory, CIAD-2026-0049, titled "AI Agents as Attack Vectors". It describes two sets of incidents. In the first, AI model providers reported that agents under research and evaluation exceeded their assigned tasks and reached live systems of Indian organisations, using credentials and settings left exposed in application configurations, public code repositories and overly permissive cloud roles. The affected organisations had not detected the access themselves. (Inc42; YourStory) In the second, financially motivated attackers used open-source agentic AI tools, and in that campaign the time from initial access to final impact fell from days to a few hours. (Vikaspedia, reproducing the advisory)
CERT-In did not name the organisations involved, so nothing in the advisory points to insurers specifically. The weaknesses it describes could exist in any organisation.
Both developments raise one question for insurers: can underwriting keep up with risks that change faster than a proposal form can record? The question has two sides. Insurers must judge the cyber exposures they agree to cover and price. They must also secure their own systems and the third-party technology they depend on. AI-driven fraud in claims is a related but separate problem, covered briefly below.
What the Regulators Have Said in 2026
- 6 April: IRDAI revised its Information and Cyber Security Guidelines, keeping the core structure of the 2023 guidelines. Changes to governance include quarterly meetings of the information security risk committee and a board duty to allocate security budget in proportion to risk. (IRDAI circular, as reproduced by TaxGuru; Cyril Amarchand Mangaldas)
- 26 April: CERT-In issued a high-severity advisory, "Defending Against Frontier AI Driven Cyber Risks" (CIAD-2026-0020), warning that advanced AI models can automate reconnaissance, phishing and vulnerability identification with minimal human involvement. (CERT-In; CyberPeace summary)
- 15 May: According to the Economic Times, which reviewed the email, IRDAI told insurers to review their cybersecurity posture against frontier AI-driven threats and submit an Action Taken Report by 22 May, covering preventive, detective and responsive measures. (Economic Times, via GI Council) MediaNama, citing sources, reports that IRDAI also flagged legacy IT infrastructure.
- 17 June: IRDAI formed a Working Group on AI. Its terms of reference include AI-driven cyber security risks, stress testing for AI-related risks and AI audit frameworks, and it had three months to submit recommendations. (IRDAI office order) As of 28 October 2026, we have not found published recommendations.
For the other compliance dates arriving in 2027, see our India insurance compliance calendar.
Two Problems Insurers Have to Solve
The cyber policies they write
Pricing cyber risk is hard even before AI enters the picture. The June 2026 FSI-IAIS paper on cyber insurance says insurers face scarce, fragmented and opaque loss data, partly because many incidents go unreported. It also describes cyber risk as non-stationary: technological advances, including AI used in attacks, can change the frequency and severity of losses, so historical data can quickly become outdated for pricing. The question for insurers is whether the assumptions behind a premium still hold as the threat environment changes. Experts quoted by Fortune India in July said the same of the Indian market, and BCG added that India lacks enough actuaries and underwriters trained in cyber, and that pricing and policy wording vary between insurers.
The paper adds that underwriting may need to move from point-in-time to continuous assessment, since a new critical vulnerability can be exploited in hours. Insurers already supplement questionnaires with external cyber risk ratings and automated vulnerability scanning.
Accumulation is the second problem. A single incident at a shared cloud or technology provider can trigger claims across many insured businesses. The FSI-IAIS paper calls this a major concern for cyber underwriting, because large correlated losses can lead to underpricing and threaten an insurer's solvency. Insurers manage it with scenario-based stress tests, exposure caps, sub-limits, exclusions, coinsurance and tight policy wording, but the paper describes these controls as imperfect and says significant uncertainty remains. Parthanil Ghosh, MD and CEO of HDFC Ergo, told the same Business Standard panel that enterprise cyber remains heavily dependent on reinsurance, and that agentic AI risks mean insurers must revisit products and coverage terms.
The proposal form is already changing. Insurance Business Asia reports that some insurers have begun asking about AI use on cyber insurance applications.
The systems they run themselves
IRDAI's May request concerned insurers' own cyber exposure. CERT-In's advisory shows AI speeding up the use of familiar weaknesses, so how fast an insurer fixes exposed credentials and permissions, and how tightly it controls access, matters more. Reported concern about legacy IT adds to this.
A related risk: AI-assisted claims fraud
The Business Standard panel discussed AI being used to create synthetic documents that make fraud harder to detect, and stressed human oversight. In a March 2026 Verisk survey of 300 US claims professionals, 98% agreed that AI editing tools are fuelling digital media fraud. The survey covers US respondents only. For how AI helps investigators, see our explainer AI in Claims Investigation.
What Underwriting and Claims Systems Need to Keep Up
Regulators have not prescribed these checks. They are our practical tests of how fast your systems can respond when a risk assumption changes. Each produces evidence you can review and repeat.
- Change a question without a release. Suppose underwriters decide to ask about AI use or agentic AI exposure. Measure the time from that decision to the question being live on the proposal, and who had to be involved.
- Change a rule and trace the decisions. Add a loading or an exclusion trigger in a test environment. Check whether it needed a code change, and whether you can show which rule decided each sample case.
- Route exceptions to people with reasons attached. Take unusual cases, such as a new technology dependency or an unusual answer, and confirm they reach a senior underwriter with the inputs and the rule that fired.
- Screen claim documents with explainable reasons. Run sample claims that include edited or generated documents. Check whether a flag comes with a reason an investigator can act on, and whether the case then moves into a recorded investigation.
These are operational readiness checks. They show whether your systems can act on an updated risk assessment. Deciding which cyber risks to accept, what to charge and how much exposure to retain depends on specialist inputs such as accumulation modelling, external cyber risk ratings and vulnerability scanning, which these checks do not replace.
Putting the Checks Into Practice
Updated risk assessments only help if they can be turned into revised questions, decision rules and controlled workflows. That is the layer the Mozart Suite works on, and its products line up with the four checks.
The first three checks depend on whether business teams can change questions, rules and approval paths themselves. Underwrite Pro is built around this. It offers dynamic questionnaires with conditional logic and a configurable rule engine that accepts, rejects or loads a case automatically. Business users can configure workflows without heavy IT dependency, cases escalate through multi-level approvals, and every action is logged with a timestamp. Rules Pro adds a no-code rule engine for decisioning across underwriting, claims and policy servicing.
The fourth check sits in claims. Claims Agent extracts data from documents and scores claims with explainable reasoning behind each flag, and Investigate Pro turns a flagged claim into a routed, tracked investigation with an audit trail.
Mozart does not provide cybersecurity tooling or cyber risk models, so the specialist inputs described above come from other sources. To see how Underwrite Pro and Rules Pro handle questions, rules and approvals, get in touch for a walkthrough.
.svg){kind=small}
%20(1).png)
