The insurance industry is beginning to consider policies specifically aimed at addressing business interruption and reputational damage resulting from the use of deep fake technology. This shift comes in the wake of notable incidents, including a significant case involving the U.K. engineering company Arup, which reported a staggering loss of $25 million. This loss occurred when a finance worker was deceived by an intricate deep fake impersonating top executives during a video call.
Matthew McCabe, the U.S. and Canada cyber product leader at Marsh, an insurance brokerage and risk management firm, spoke to Digital Insurance regarding the current implications of deep fakes within the realm of cyber insurance. He noted that while deep fakes have garnered increased attention, they have yet to exert a meaningful impact on cyber insurance markets. "If a threat actor comes out with a deep fake, most likely they're hunting a big target," McCabe explained. He further remarked that such attacks involve considerable effort for what typically boils down to a straightforward breach.
Despite the potential risks posed by deep fakes, McCabe indicated that financial losses linked to these scams have not yet escalated to a level that would prompt insurers to exclude them from coverage under cyber breach insurance, although the threat they pose is undeniable.
Courtney C.T. Horrigan, a partner in the insurance recovery group at Reed Smith, an international law firm, elaborated on the landscape of insurance and deep fakes. "There are crime coverages that will cover companies if their employees fall victim to a deep fake demand, the same way as if they fall victim to a crypto demand," she stated. Horrigan noted that, at present, reputational damage typically needs to be connected to an intrusion into a company's computer system to be covered under existing policies.
The insurance market is beginning to adapt, and commercial insurers are starting to offer coverage for issues related to artificial intelligence, albeit not specifically for deep fakes as yet. According to Horrigan, existing coverage for reputational damage may soon be expanded to encompass deep fake scams, drawing parallels to the way ransomware exposures have been managed in recent years.
However, the implementation of coverage against scams involving deep fakes will likely come at a premium. Insurers may require businesses to undergo new security training that encompasses the nuances of deep fake technology, similar to existing training designed to identify phishing emails. "There may be more training as to what to look at in a video or audio recording," Horrigan suggested. Additionally, policyholders are beginning to explore independent verification products aimed at identifying deep fakes, a topic that has sparked considerable interest as companies prepare for insurance renewals.
Source: Noah Wire Services