The first known cyber insurance policy was issued in 1997 through AIG — a $15 million coverage limit for internet-related risks at a time when many executives still weren't sure the internet would last. Nearly three decades later, cyber is one of the fastest-moving, most competitive lines in all of insurance.

The threat landscape has never been more complex. AI hasn't just raised the volume of attacks — it's sharpened them. Phishing emails that once announced themselves with broken English and implausible promises have given way to hyper-personalized, eerily convincing communications. Deepfakes are blurring the line between real and fabricated in ways that insurance policies haven't fully caught up with. And invoice fraud — one of the oldest scams in the book — is quietly surging, powered by social engineering that exploits LinkedIn connections, email thread histories, and the reluctance of junior employees to question a message that appears to come from the CEO.

For the latest on where cyber stands and insight on where it’s going, we turned this month to Liz Kim, president of US operations at BOXX Insurance, whose nearly 30 years in the industry span law, claims leadership, underwriting, product development, reinsurance brokering, and now carrier strategy.

Her core message: The battle between attackers and defenders never really ends, it just shifts terrain. Ransomware gives way to extortion, which gives way to business email compromise, which gives way to whatever comes next. The only durable advantage is staying ahead of the bad guys — through education, technology, and underwriting discipline.

Read the full interview to find out why invoice manipulation deserves more attention than it's getting, what AI is actually changing in cyber insurance, and how third-party vendor relationships have quietly become the industry's biggest claims problem.

Paul Carroll

To start us off, what is your overall outlook for the cyber insurance industry?

Liz Kim

If only we could predict where it's going to go, right? I've been in the cyber insurance industry for many years and I've worked across a lot of different roles. I've been in it as a lawyer, as head of claims for a major insurer, in underwriting, in product development, and as a broker. We’re in a soft market now, but, as with all insurance, the cyber market is cyclical.

I think cyber is more cyclical than other lines, for a couple of reasons. First, although there are plenty of disaster scenarios that people talk about in the industry — things like a worldwide AWS outage — we haven't yet really had a true disaster, which would tighten capacity and increase prices. Second, we have new entrants coming into cyber all the time. Because of that constant influx, a lot of their value proposition comes down to nothing more than having the lowest prices. That dynamic drives pricing down more than you'd typically see in other lines of business.

That said, companies that maintain underwriting discipline and pair their insurance with meaningful services or technology solutions to reduce digital risks are better positioned to hold pricing than those that are purely insurance plays.

My overall outlook? It's always positive — because if it wasn't, I wouldn't still be in cyber after all these years. With the kinds of innovations we're seeing across the industry, it's always going to be an area that drives the market forward.