Across industries, organizations are rapidly embedding artificial intelligence (AI) into customer service, operations, software development, risk analysis, and decision making. The result has been remarkable in productivity and efficiency. But as AI adoption accelerates, the associated risks are evolving just as quickly. Bryan Barrett, Regional Underwriting Manager, Cyber and Technology E&O at Munich Re Specialty – North America, indicates that many organizations are moving faster with AI deployment than they are with governance, oversight, and security.

“Companies are understandably eager to innovate and capitalize on the benefits of AI,” says Barrett. “The challenge is that oversight, tracking, and compliance often lag behind implementation, creating potential operational, financial, and legal exposures.”

As AI moves deeper into daily business operations, organizations face a growing governance challenge.

“The most common mistake organizations make is assuming AI is simply another software application that can be plugged into the environment,” says Barrett. “Traditional software operates by a set of rules with predictable outcomes. AI does not, which makes understanding and managing risk significantly more complex.”

Recent research suggests the AI governance gap is actually widening. IBM’s 2026 Cost of a Data Breach Report found that 68% of breached organizations lacked formal AI governance policies, while another 33% reported their policies were still under development. This reinforces the idea that AI adoption continues to outpace organizational oversight, creating growing security, operational, compliance, and reputational risks.

IBM’s report also found that 92% of organizations experiencing an AI-related breach lacked proper AI access controls, highlighting how basic governance and identity management continue to lag behind adoption. At the same time, security incidents involving shadow AI, the unauthorized use of AI tools or applications by employees without approval or oversight of the information technology (IT) department, more than doubled year over year, rising from 20% to 43% of organizations surveyed. Those incidents resulted in average breach costs of $5.39 million and were frequently associated with data loss, operational disruption, reputational damage, and even regulatory fines.

While AI is helping organizations innovate, cybercriminals are also using the technology to enhance their capabilities.

“A significant number of organizations have seen an uptick in cyberattacks that leverage AI,” says Barrett. “AI allows threat actors to attack faster, more quietly, and more efficiently than ever before.”

Attackers are increasingly using AI to automate credential-stuffing campaigns, accelerate brute-force attacks, create convincing phishing messages, and generate sophisticated deepfakes. These tools lower the barrier to entry for cybercrime while increasing the scale and effectiveness of attacks.

Research suggests attackers are accelerating AI adoption faster than defenders. IBM’s 2026 report found that more than one in four organizations experienced an AI-driven attack, representing a 56% increase over the previous year. Deepfake impersonation attacks accounted for the largest share of AI-enabled incidents at 45%, followed by AI-generated malware and AI-powered phishing campaigns. Researchers found that an AI-driven cyberattack costs an average of $1 million more compared with breaches caused by traditional attacks.

The 2026 NetDiligence Cyber Claims Study highlights similar concerns, noting that AI is accelerating the speed and scale of attacks by helping threat actors automate reconnaissance, create more convincing social engineering content, and lower the technical barriers to cybercrime. Contributors also point to the growing use of deepfakes and synthetic media to impersonate executives, employees, vendors, and other trusted parties, increasing the effectiveness of fraud and business email compromise schemes. As AI continues to compress the time between attack planning and execution, organizations may face a greater volume of incidents and increasingly sophisticated threats.

Beyond phishing and impersonation, AI systems themselves are becoming attack targets.
According to Barrett, cybercriminals are increasingly targeting AI models through techniques such as data poisoning, where malicious data is introduced to influence model outputs and behavior. “These attacks can result in organizations having to conduct extensive forensic reviews and retraining exercises to restore confidence in their systems,” he explains.

Organizations often view AI primarily through the lens of efficiency, automation, and competitive advantage. Those benefits are real. However, successful AI adoption requires a balanced approach that incorporates governance and cybersecurity from the outset.

“Risk management is essential to the foundation of AI adoption,” says Barrett. “Leaders need to take a cautious and disciplined approach when developing and implementing AI systems within their organizations.”

A strong AI governance framework should establish clear policies around deployment, usage, access management, vendor oversight, and data handling. Just as importantly, organizations should define accountability for AI-related decisions and ensure ongoing monitoring as technologies evolve.

Employee education also remains critical. Many AI-enabled attacks continue to exploit human behavior, particularly through phishing, social engineering, and fraud schemes that are appearing even more authentic than ever before with the use of these tools.

One of the most significant shifts occurring in cybersecurity is the move from reactive defense to proactive resilience.

“Organizations can no longer afford to simply react to AI-related attacks once they occur,” says Barrett. “The threats are becoming too sophisticated and too fast.”

Instead, he recommends that organizations focus on several core priorities:

• Adopting zero-trust security principles, based on access being granted only after verification.
• Investing in tools capable of identifying anomalous and AI-driven behaviors.
• Implementing robust AI governance programs.
• Providing ongoing employee education on advanced phishing and social engineering threats.

The financial stakes continue to rise. IBM’s 2026 report found the global average breach cost increased 12% to a record $4.99 million, while the average breach costs in the United States climbed to $11.5 million, more than double the global average.

At the same time, the report demonstrates that AI can be an important defensive advantage when implemented responsibly. Organizations that extensively used AI and automation within security operations reduced average breach costs by $1.93 million and shortened breach identification and containment times by 65 days compared with organizations that did not use those technologies. The bad news is only 36% of organizations reported extensive use of AI and automation across the security life cycle.

As organizations navigate this rapidly evolving risk landscape, many are looking for expert guidance. To address this need, Munich Re Specialty – North America has partnered with CyRisk to develop a new AI module for the Reflex™ Cyber Risk Management program. The new AI module is a complimentary AI risk management consulting service available to policyholders designed to help organizations understand, evaluate, and manage AI-related risks before they become costly incidents.

For veterans of cyber risk management, the conversation around AI risk often mirrors earlier discussions surrounding cloud adoption, digital transformation, and cybersecurity modernization. Organizations that approach innovation without governance often discover that risk accumulates faster than expected and can be costly. Those that integrate security, oversight, and resilience into their strategy from the beginning are better positioned to unlock AI’s benefits while managing the risk.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Munich Re Specialty. The editorial staff of Risk & Insurance had no role in its preparation.