No offense to the members of the media, but the media tends to blow this stuff up.

That’s how Jim Williamson, president and chief executive officer of insurer and reinsurer Everest Group, Ltd., prefaced his answer to a question about managing cybersecurity risks in the age of AI during the S&P Global Ratings 42nd Annual Insurance Conference last week.

“On cyber risk, we are in the same arms race we were before AI,” Williamson believes, chiding the media for exaggerating the Mythos model story and the ability of bad guys to get into companies and exploit faults as a pace.

Related article: Mythos Proportions

Warnings from Anthropic that its Claude Mythos model was too dangerous to release to the public spawned the media articles. In an April 7 post on its website, Anthropic said the “Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely.”

“On cyber risk, we are in the same arms race we were before AI.”

Jim Williamson, Everest

“The fallout—for economies, public safety, and national security—could be severe,” the statement warning, also disclosing the launch of Project Glasswing, restricting access to a limited group of major tech, finance, and security organizations to use in cybersecurity work to identify and repair vulnerabilities in critical software infrastructure.

More recently, after Williamson spoke at the S&P conference, the U.S. government “issued an export control directive to suspend all access” to Mythos and to a more heavily secured AI model, Claude Fable, “by any foreign national, whether inside or outside the United States,” according to a June 12 statement from Anthropic. Effectively, the government order forced Anthropic to abruptly disable the models for all its customers to ensure compliance, the tech giant said.

Related articles: Anthropic Touts AI Cybersecurity Project With Big Tech Partners; Anthropic to Let Partners Share Mythos Cybersecurity Findings With Others; Fears of Unfettered Hacking Spurred by Anthropic’s Mythos AI Model Overblown; Anthropic Releases Mythos-Like Model Without Cyber Capabilities: Mythos Proportions

Two days before the government action, Williamson delivered his answer to a question about insurer cyber risk management posed by Taoufik Gharib, director and lead analyst for S&P Global Ratings, during an “Executive Perspectives” session of the S&P conference.

While the media focused on the ability of Anthropic’s AI model to exploit risk management deficiencies, “they don’t tell you in the story, or at least it’s maybe buried in the story, that that’s only true where there are no defenses in place. All of those case studies are based on a completely [defenseless] enterprise that takes no remedial action. That is not how the world works,” Williamson said, adding that Everest and its clients are “deploying excellent tools at scale.”

“And AI is one of the best defensive trends happening in the cyber defense market. So I think where we are on cyber risk is we’re in the same arms race we were before AI, which is bad guys want to exploit vulnerabilities to make money, good guys want to stop them from doing that and there’s a constant one-upmanship to get ahead of that curve one way or the other.”

“My personal view right now—and this is a very fluid situation—is the good guys are holding a lot more of the cards in this environment.”

He reasoned: “Think about what it takes to build a capability like Mythos at scale. A bad actor can leverage what others are developing, but they can’t build it on their own.”

What that means is “yes, phishing exercises will get a little easier…. But [what] everybody was afraid of when they started hearing about Mythos—that they’d wake up one day and find out that some AI capability allowed hackers to bring down Azure or something, I just think that’s way, way, way out of the tail. [There’s] a lot of infeasibility around that.”

Williamson concluded: “I think AI will do as much to improve cyber hygiene and security and opportunity as it will be a threat.”

AI Tools in ’30-Plus Petri Dishes’

As to Gharib’s question about insurers and reinsurers leveraging AI to benefit operations, Williamson said Everest’s approach “is all around improving cognition for our people” rather than improving expense ratios.

“I could fit my reinsurance team in this room, and we’re an at-scale global reinsurer. Our expense ratios are among the lowest in the industry. So, could you save costs by deploying AI tools? You could. I’m sure we will here and there. But our main focus is making each of those humans better decision-makers,” he said.

Williamson said analytics, data augmentation, AI tools to remove non-value added tasks for the work of Everest professionals help to accomplish that goal. “We are well down the path that Everest of deploying those tools both in our primary insurance business and in reinsurance, and we’re accelerating the work that we’re doing,” he said.

Brian Young, President of Fairfax Insurance Group, offered a perspective from a larger enterprise—a group of more than 30 insurance and reinsurance companies operating around the world—noting that a decentralized approach extends to AI. “Innovation within Fairfax really comes from the ground ….There isn’t a strategy at the top that’s driving AI. We have 30-plus petri dishes, experimenting with AI, coming up with use cases in different parts of the business, whether it’s claim, underwriting, administration,” he said.

Young noted that Fairfax also has an AI working group across all organizations, with broad participation from all of the companies. “It’s really a forum to share use cases, best practice and knowledge so that if we develop something in one company, we can use it in another,” he reported.

Agreeing with Williamson, he said, AI “is a fantastic tool in the hands of the employees.” Offering commentary on workforce concerns across the industry about AI replacing insurance professionals, Young said, “I would say it’s not going to have any impact. Of course, if anything, AI is making our employees work more intensely. And so over time, yes, it is an efficient tool. It improves productivity. Maybe the rate of hire is slower.” But Fairfax has made it clear to employees that jobs are not at risk, he reported.

“Innovation within Fairfax really comes from the ground ….There isn’t a strategy at the top that’s driving AI.”

Brian Young, Fairfax

From a business perspective, “Does it bang the cash register? Lower the loss ratio? Does is lower the expense ratio?” he asked rhetorically. While Fairfax hasn’t yet seen evidence of AI generating new business flows, that’s a potential outcome, Young suggested. “Using AI, you can get through more business, you can review more submissions, produce more quotes on a timely basis—and hopefully that leads to new business generation.”

Offering a broader perspective, observed, “When I look at my 38 years in the business, the business itself hasn’t really changed that much. What has changed is technology. The computer, the mobile phone, the Internet and GPS. These had a significant impact on the way that we conduct our business.”

“AI is the next generation. and I have no doubt that it will be extremely beneficial to our industry,” he said.

Williamson offered his own big picture perspective minutes earlier. “The other thing I think through is the massive opportunity it creates for our companies because we need to help insure all the development that’s happening in AI. And the only analogy that really makes sense to me is like the railroad buildout in the 19th century where you just have this massive need for capital all across the country and all around the world.”

“You need energy. You need power lines. You need to build data centers [and] manufacture chips. Supply chain impacts are massive,” Everest’s leader said, reporting that his company is “leaning into” the opportunities.

Geopolitical Risk: ‘The Great Shrugging Off’

Gharib led off the session asking the executives to talk about another set of risks—geopolitical risks—and how they are impacting the leaders’ businesses and go-forward strategies.

“I think we’re in an era … of the great shrugging off,” Williamson said. “You have all these things happening around the world—in the economy, in the political environment and it seems like the underlying economy continues to chug along pretty well. …

“Similarly, I think a lot of people in property/casualty [insurance] have shrugged off the fact that we’re probably at an all-time high, at least in our living memory, around geopolitical exposure and risk—in Middle East, Ukraine, Eastern Europe, and then clearly heightened tension in Taiwan Straits,” he said, noting that there are also a lot of elections and changes in power occurring in Latin America and Asia.

The landscape brings risks and opportunities, he said. On the risk side, for example, Everest does a ground-up assessment of concentrations of insured value in Taiwan. On the opportunity side, he said, businesses look to insurers and reinsurers to provide the capacity they need to manage risk when the environment “feels ultra tense and wound up.”

Again, he highlighted the AI boom. “There’s a geopolitical dimension to that too. The competitive aspect of AI investment [is] not getting talked about as much—the geopolitical impetus behind just this massive drive to AI infrastructure and construction,” he said, suggesting that insurers need to be open to the opportunities as well as the risks.

Young described a view of geopolitical risks that is more personal at Fairfax, which has extensive operations in Ukraine. “It hits close to home,” he said, noting that about 1,250 people live and work around Kyiv for three different operations. He reported that no workers’ lives have been lost but a handful of family members have suffered.

“The business surprisingly has performed very well. Once the conflict started in Ukraine, you saw a precipitous decline in top line—in our business and in the market. Today premium volumes have recovered to where they were prewar,” he stated.

In addition, combined ratios have remained in the low-to-mid 90s, he said. “From a business point of view, performing well. But the social impact on the people living through four years of war is significant. And from a Fairfax perspectives perspective, our biggest concern in Ukraine are people and making sure they’re safe and giving them all the support that they need to deal with the situation.”

Fairfax also has extensive operations in the Middle East and particularly in the GCC—in the Emirates, in Bahrain, Qatar, Aman, Saudi Arabia, he said, referring to territories outside of Iran being impacted by the conflict there. Again, the business hasn’t suffered, Young said, reporting strong growth for the first five months of the year. “But there is a concern. If it is a prolonged conflict, what will be the impact on the business?”

“The biggest risk, if it does continue for an extended period in a place like Dubai, is the impact on the hospitality industry,” he said, noting that many people have moved to Dubai to support that industry. “Depopulation in a place like Dubai is a mid-to-longer term risk and concern,” he said.

Prompted by Gharib, Young revealed the Fairfax premiums in Ukraine are roughly $250 million, and its GCC premiums are over $1 billion.

“Geopolitical risk is obviously something we have to deal with. Fairfax is a global operation. Managing those risks is something that we do on a day-to-day basis. It’s much more of a people issue,” he said.

Featured images: AI-generated (ChatGPT); executive photos taken by CM on-site at S&P Annual Insurance Conference