Agentic AI has fundamentally rewritten the rules of phishing and social engineering attacks. Where cybercriminals once spent upwards of 16 hours crafting a single targeted email, AI tools now allow them to deploy hyper-personalized, grammatically correct phishing campaigns at scale in just five minutes.
The impact on the cyber insurance market is already alarming: phishing and social engineering account for nearly half of all cyber claims, acting as the primary entry point for high-cost incidents like Business Email Compromise (BEC) and Funds Transfer Fraud (FTF). As legacy multi-factor authentication (MFA) – such as SMS passcodes and push notifications – falls victim to Adversary-in-the-Middle (AiTM) attacks and push fatigue, underwriters are facing an unprecedented surge in preventable identity-driven exposure.
To address this shifting landscape, the Center for Cybersecurity Policy and Law (CCPL) published a report titled, “Cyber Insurance in the Age of AI: Why Underwriters Should Care About Phishing-Resistant Authentication.” Co-authored by Davis Hake and Luke O’Grady, in collaboration with the cyber insurance industry, the paper outlines how legacy MFA is losing its effectiveness and why cyber insurers must drive the transition toward phishing-resistant MFA, including FIDO2 standards and hardware-backed passkeys.
I sat down with report co-author Davis Hake (Senior Director at CCPL and Venable) and Jeremy Grant (Managing Director at Venable and Senior Advisor to CCPL) to discuss the report’s key takeaways, why traditional insurance applications are falling short, and how hardware-backed authentication is rewriting the economics of cyber defense.
Generative AI has dramatically changed how social engineering attacks are executed. How is this shifting threat landscape directly impacting the frequency and severity of cyber insurance claims?
Davis Hake: AI has effectively eliminated the traditional trade-off between quality and scale in phishing campaigns. Attackers are using generative tools to eliminate grammatical errors, translate text seamlessly, and deploy interactive chatbots that manipulate victims in real-time. The insurance market is already feeling the burn. Recent claims data shows that phishing surged 53% in frequency and became the top point of failure in 2025, while sitting upstream of costly losses like Business Email Compromise and Funds Transfer Fraud.
In the report, you emphasize that asking “Has this organization implemented MFA?” is no longer a useful underwriting question. Why has MFA become a general control for insurers?
Jeremy Grant: A simple “yes” on an application today tells an underwriter almost nothing about an organization’s actual security posture. Legacy MFA, like SMS OTPs, email codes, or simple push notifications, relies on shareable credentials that attackers can intercept, relay, or trick users into approving via push fatigue or AiTM phishing kits. An organization can check the “MFA box” on an insurance form while remaining vulnerable to automated, AI-driven credential theft.
How does phishing-resistant MFA change the threat economics for both an insured organization and its underwriter?
Davis Hake: Phishing-resistant MFA removes human’s ability to be fooledand or stealable factors. Because FIDO2 passkeys rely on domain-bound public-key cryptography, the authenticator simply won’t complete a login on a fake domain. The paper highlights a Marsh 2023 study that showed that phishing-resistant MFA reduced the likelihood of a breach by 2.25 times more than legacy MFA. For underwriters, this means phishing-resistant MFA is a strong signal of drastically reduced risk of a breach.
The report categorizes passkeys into synced passkeys and hardware-backed passkeys. Why is this distinction crucial for enterprise risk modeling?
Jeremy Grant: While synced passkeys work great for consumers, the risk associated with most enterprise use cases requires higher assurance. Hardware-backed passkeys stored on dedicated hardware tokens, like a YubiKey, cannot be copied or synced to the cloud. They provide verifiable, cryptographic proof of physical possession and meet NIST’s highest Authenticator Assurance Level (AAL3). For high-risk roles like IT admins, finance personnel, and executives, underwriters need to know credentials are bound to a physical key that can’t leave the building or be exported.
What specific, modern questions should underwriters start asking on application forms to better measure identity risk?
Davis Hake: Instead of broad questions, underwriters should ask targeted, high-signal questions like; Which specific MFA methods are permitted? Is phishing-resistant MFA required for high-risk users? Are phishable fallback methods allowed to bypass stronger authentication? These questions also show account maturity, revealing whether there are stronger identity controls beyond any one specific technology
Beyond updating application forms, how can cyber insurers actively help policyholders upgrade their identity posture during the policy period?
Jeremy Grant: Underwriters don’t have to wait for a breach to happen to influence behavior. Insurers previously moved the market from passwords to legacy MFA; now they can drive the shift to phishing resistance. They can offer premium credits or improved terms for verified FIDO2 deployments, connect policyholders with integration partners, and even sponsor hardware security key pilots for privileged workforce segments.
The whitepaper also highlights an issue with claims taxonomy. How does imprecise claims data hinder the insurance industry’s ability to price cyber risk accurately?
Davis Hake: Claims are traditionally categorized by financial outcome, such as “Ransomware” or “Funds Transfer Fraud”, rather than the controls that were bypassed enabling the breach. If an incident was caused by push fatigue or an AiTM bypassing SMS, that context is lost. By capturing precise data on authentication mechanisms used, insurers can build better risk models based on what works and what doesn’t.
Looking ahead, the report notes that autonomous AI agents will soon present new governance challenges. How does establishing phishing-resistant MFA now prepare organizations for the rise of agentic AI?
Jeremy Grant: AI agents will soon execute multi-step, high-consequence workflows – like initiating large financial transactions or altering production code– without human oversight. To prevent catastrophic errors or unauthorized actions, organizations must enforce identity guardrails. The first step is to ensure access isn’t compromised by agents by implementing phishing-resistant MFA. Secondly, requiring human approval via the same phishing-resistant authentication mechanisms for high-risk AI agent actions ensures clear accountability and builds the foundation for an identity-resilient future.
