The Next Generation of Cyber Risk: Is Your Advice Keeping Up?

Ransomware still dominates most cyber risk conversations, and for good reason. 

But artificial intelligence, deepfakes and increasingly connected businesses are reshaping the threat landscape in Canada, and broker advice needs to keep pace. 

“What we’re starting to see, and what we expect to keep seeing, are AI-enabled attacks, more convincing social engineering and growing supply chain exposure,” says Leanne Taylor, Senior Manager, Tech & Cyber at Sovereign Insurance. 

Attacks are getting faster and more targeted, and increasingly aimed at the people and partners businesses rely on, rather than their technology alone. 

AI changes the rules 

Cybercrime activities that used to take real time and technical skill can now happen in seconds, at a scale never seen before, Taylor explains.  

Threat actors are personalizing phishing messages and automating reconnaissance, shrinking the gap between finding a weakness and exploiting it. 

The same AI tools creating new defensive capabilities are also creating new exposure inside the businesses adopting them.  

Taylor names three specific exposures commercial clients should watch: prompt injection, where a threat actor overrides an AI agent’s instructions; data poisoning, where manipulated data corrupts an AI system’s training; and shadow AI, where employees run unapproved tools and feed them sensitive information. 

“Employees using AI tools outside of what’s approved by their company, and putting sensitive information into those tools, is a huge risk,” she adds. 

People and partners are targets
 
Cyber attackers are increasingly targeting trust rather than defences, says Taylor. 

Voice cloning and deepfake video make it possible to convincingly impersonate an executive, and a fraudulent request can now arrive by email or video, using channels employees have been trained for years to rely on.
 
“People are targeted because they have access and the trust of others around them,” Taylor says. “It’s often easier to persuade someone to authorize a payment than it is to defeat a well-configured technical control.” 

Cybersecurity training helps, but simple verification habits often stave off such attacks. “If a request is unusual, urgent or sensitive, pause before acting,” she says. “Verify through an independent, trusted method, and only then proceed.” 

Outside vendors are often an overlooked exposure that can compromise a client’s supply chain, Taylor adds.  
“A client can have strong internal controls and still experience a major interruption because a critical provider is unavailable or compromised,” she says. 

When several parts of a business depend on the same cloud platform or software provider, one event can disrupt all of them at once, with effects that reach far beyond the company that was targeted, including lost revenue and reputational damage. 

“Organizations need to move from a prevention-only mindset to a resilience-focused approach,” Taylor says. Multi-factor authentication and regular patching remain baseline protections, paired with governance and an incident response plan.  

“A plan should not simply exist in a document,” she says. “The organization should test it and make sure decision makers understand their roles.”  

Brokers can also ask clients whether their backups are isolated and tested, and if there’s a workaround if a critical vendor goes down, she adds.

The broker opportunity 

Looking ahead, next-gen cyber threats give brokers the opportunity to move the conversation from policy placement to business resilience, says Taylor. 

Instead of starting with limits and deductibles, brokers can ask what systems are essential to a client’s operations and how they verify payment changes. Those questions translate technical exposure into business consequences clients already understand, like delayed production or interrupted service. 

“Brokers don’t need to become cybersecurity engineers,” Taylor says. “Their job is connecting a client’s operational exposure to their risk management and insurance strategy.” 

Supply chain dependency deserves a direct look at coverage. Sovereign advises brokers to check whether a policy addresses contingent business interruption and whether key providers fall within its definitions. 

That means treating the coverage conversation as continuous, instead of a renewal exercise.  

“Cyber risk changes the moment a client adopts a new platform or acquires a new business,” she says. “Regular conversations let the policy evolve with the business.” 

While technology will keep changing, Taylor says organizations that understand their dependencies and prepare for recovery before an incident happens will be best positioned to respond when it does. That’s exactly where brokers’ trusted advisor role begins.