By Kareena Bavisi
I set out to understand why companies still don’t think they’re covered. What I found afterward, digging into the data, was a pattern insurance has lived through before: a control moves from optional to mandatory fast, and the companies caught without it pay for it.
Here’s a number that should worry any CISO building an AI governance program right now: 74% of professionals who evaluate, deploy, secure, or govern AI at their organizations believe they could pass an AI compliance audit today. Only 27% describe their governance program as fully mature. That’s according to Schellman’s State of AI Governance Report 2026, a survey of 525 U.S.-based practitioners, and it’s close to an exact echo of a number I’d already been sitting with: in Munich Re’s 2026 Global Cyber Risk and Insurance Survey, 89% of C-level respondents say they don’t consider their company adequately protected against cyberattacks, up from 81% in 2021, 83% in 2022, and 87% in 2024. Two different surveys, two different questions, the same shape: confidence and reality keep drifting apart, and whatever’s being done about it isn’t closing the gap.
Bob Parisi, Head of Cyber Solutions for North America at Munich Re, has spent nearly three decades underwriting cyber risk. I asked him why. His answer wasn’t about a missing product. It was about two groups of people who don’t speak the same language.
A literacy problem, not a product problem
“Dealing with financial risk transfer is not something a CISO deals with every day,” he told me. The reverse is just as true: underwriters are pricing a technical risk they don’t observe directly, working from what a company represents about itself once a year, usually through a broker-scheduled call. “ We typically engage with them once a year when they fill out the application,” he said. Where that changes, he told me, is in companies where the CISO, CFO, and chief privacy officer are already talking to each other internally, those are the ones that end up buying coverage closer to their real exposure.
His own company’s data backs that up. Asked what’s holding back better cyber defense, Munich Re’s survey found the top two answers were both about people, not tools: “low security awareness among employees” (40%) and a lack of skilled personnel (31%), both ahead of budget. The disconnect Parisi described anecdotally is the top-ranked problem in his own company’s data.
That disconnect is what got me thinking about how to close it, and it’s why companies like the Cyber Insurance Academy exist. The talent gap behind it is well documented: insurers report more than 400,000 open positions across lines of coverage, cyber underwriting pay runs well above a typical broker’s, and the shortage persists anyway, because, as Gallagher’s Joey Sylvester has put it, “there are a very limited number of individuals specializing in this class of business” who can keep up with both the insurance market and the cybersecurity industry at once. That’s the same disconnect Munich Re’s own survey flagged as the top two defense challenges: low security awareness and a shortage of skilled people, not budget. Closing it takes skilled people who’ve actually sat through the training, courses like the CCIS, built to give security and insurance professionals enough of each other’s language that the once-a-year application conversation reflects real exposure, instead of two sides talking past each other.
What MFA can tell us about where AI governance is headed
This is where I think the Schellman number matters more than it looks on its own. AI governance right now sits roughly where multi-factor authentication sat two or three years ago, something insurers were starting to care about, but not yet something they’d decline a policy over. That’s changed fast. Brokers who place cyber coverage say MFA has gone from a minor underwriting factor to close to a hard requirement in the span of about two years. Insurers that once quoted risks without MFA, sometimes with a small premium loading, have largely stopped offering that option. Integrity’s Colin Fox says only a handful of insurers will still write a policy without it, describing it as “quite a rarity these days” in comments to Insurance Business UK.
AI, in Parisi’s words, is “first and foremost” in what Munich Re is watching right now. “It takes up a lot of the oxygen in the room in any discussion around cyber risk,” he told me. That’s not a formal policy change, but pricing is where MFA’s history is instructive. The pattern with MFA wasn’t that insurers added a new exclusion, it was that a control quietly moved from a nice-to-have to a baseline expectation, and companies that couldn’t demonstrate it found their options narrowing. Endpoint detection and response looks to be following the same track; brokers describe it as already close to mandatory for companies seeking higher coverage limits.
AI governance looks like it’s on the same curve, just earlier. 71% of C-level respondents in Munich Re’s survey now call AI significantly relevant to their business, up from 62% two years ago, overtaking cloud computing as the most-flagged technology. That’s the kind of inflection point MFA passed through before it hardened into a requirement.
What underwriters are actually scoring
No single AI tool moves the needle on its own. Deploying a specific product doesn’t earn a company a flat discount on premium. What underwriters are actually pricing, Parisi explained, is maturity, whether a company can show it’s using AI deliberately rather than just enthusiastically, and he pointed to three signals in particular.
- Overexuberance. A security team that has rushed to deploy AI everywhere without building the process to manage it first.
- Denial. A company that insists it isn’t using AI at all. Parisi’s read is that it’s there whether leadership acknowledges it or not.
- Disciplined adoption. A company that treats AI as genuinely new, testing it deliberately and rolling it into production only once it’s confident the rollout strengthens the organization rather than exposing it.
“Knowledge is power,” he told me. “Anything that helps a company better understand its risk, and articulate how it’s managing and mitigating that risk, will be viewed very positively by our underwriters.” That kind of structured, documented governance work, something a company can actually point to, is exactly what reads as a green flag to him. AI governance, in particular, is shaping up as its own discipline, distinct from general security literacy, and the organizations building that competency deliberately, rather than picking it up as they go, are the ones standing out.
That same logic, structured proof of risk maturity that underwriters can actually price, is my own case for why EC-Council’s CRAGE certification and its underlying Adopt, Defend and Govern (ADG) framework exist. ADG, developed with input from 23 advisory members across the industry, and CRAGE under it train practitioners to produce exactly the kind of documented risk articulation that reads as a green flag to an underwriter, translating AI governance maturity into terms a cyber insurer can price.
Schellman’s own numbers back this up from a different angle: companies with mature AI governance programs have AI agents running in production at more than three times the rate of companies with developing programs, 78% versus 22%. The gap isn’t just about compliance paperwork. Mature governance correlates with companies that are actually further along in deploying the technology with confidence.
The bottom line
Parisi’s advice from the underwriting side was simple: stop treating the insurer conversation as a compliance form, and start treating it like a board conversation. “Think of the cyber insurers as if you were talking to your board of directors, because that’s really the perspective we’re looking at this from,” he told me. “We don’t want to know which edition of the software you’re using. We want to know you have the right processes and protocols for making sure that software is updated and deployed, and an understanding of what the potential financial loss is if it goes wrong.”
Put the two patterns side by side, and AI governance is not going to stay optional. MFA went from a footnote to a wall in about two years once insurers decided it was a real predictor of loss, and the Schellman numbers suggest the market is already sorting companies into those who can prove maturity and those who can’t. The 89% of executives who don’t feel protected today have a narrowing window to close that gap before it closes on them, and closing it looks a lot like what this piece has been circling the whole way through: literacy on one side of the table, documented maturity on the other.
Kareena Bavisi
Chief of Staff at EC-Council
