A new 2026 Nationwide survey highlights a significant gap between the rapid adoption of artificial intelligence in the workplace and the implementation of cybersecurity measures to protect against AI-enabled threats. According to the survey, six in 10 business owners report that employees are using public AI chatbots or writing tools for work-related tasks, yet only 36% have written policies governing employee AI use, and just 37% provide training on responsible use. This disconnect is already having consequences: nearly one-third (31%) of small and mid-market business owners say their company was targeted by a scam or fraud attempt using generative AI within the previous 12 months.
The findings underscore that AI is not just a productivity tool but also a new vector for cybercriminals. Generative AI can be used to craft highly convincing phishing emails, impersonate trusted contacts, and generate fraudulent content at scale. With more than a third of business owners (35%) believing employees are using unauthorized AI tools for work, the risk of data leaks and security breaches grows. Compounding the issue, only 35% of business owners have an up-to-date incident response plan, leaving many unprepared to handle an attack effectively.
Inter Insurance Agency notes that these results serve as a wake-up call for businesses of all sizes. "AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them," said Tim Derham of Inter Insurance Agency. "An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward."
Cyber insurance can be a critical component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with data breaches, cyberattacks, business interruption, recovery efforts, and certain liabilities resulting from a cyber incident. However, insurance alone is not enough. Inter Insurance Agency encourages businesses to establish clear policies regarding AI use, train employees to recognize phishing and impersonation attempts, control access to sensitive information, and maintain an incident-response plan. Regular reviews of cyber insurance coverage are also advised as operations and technology evolve.
"The way companies work is changing extremely quickly," Derham added. "Your risk management and insurance shouldn't be based on what your business looked like three or four years ago."
The survey, conducted by Edelman Intelligence from July 10-26, 2026, via an online questionnaire, reflects the urgent need for businesses to adapt their cybersecurity practices to the AI era. As AI becomes more integrated into daily operations, the line between innovation and exposure blurs, making proactive risk management essential. Businesses that fail to implement policies, training, and robust insurance coverage may find themselves increasingly vulnerable to sophisticated AI-driven attacks. The implications are clear: the speed of AI adoption must be matched by an equal commitment to security and preparedness.
