What does the rapid march of AI mean for the risk landscape faced by the cyber insurance market?
According to Envelop CEO Jonathan Spry, there is a ‘predator-prey’ dynamic at work, with AI deployed by cyber bad actors at the same time as it is rapidly adding to cybersecurity capabilities.
The risk arises where potential dislocation emerges and cyber criminals exploit the technology more effectively.
Speaking to Behind the Headlines, the executive also explains how Envelop is deploying technology to bolster its forward looking analytics capabilities, and lays out the company’s diversification strategy.
This episode’s news discussion features Insurance Insider’s Rachel Dalton on the fallout of Hurricane Isaias.
This transcript was generated using AI and may contain errors. Please check against the audio before quoting.
Sam Casey: Hello and thank you for tuning in again to Behind the Headlines. I’m your host, Sam Casey of Insurance Insider. In today’s episode, we look at some incredibly timely subjects, both for the insurance industry and the wider global business community. My guest is Envelop’s Jonathan Spry, and in our discussion we explore artificial intelligence and what it means for the cyber threat landscape. We also talk about how the technology can be used to improve data and analytics functions. Plus, we get an update on Envelop’s diversification strategy. Jonathan told me there is a predator-prey dynamic when it comes to AI and cybersecurity.
Jonathan Spry: It’s real, it’s having an impact and there are claims driven by it. What we’re also seeing, in the nature of predator and prey, is that the same tools are being used as defensive mechanisms with some success. So we’re seeing cybersecurity become far more proactive and less reactive. There’s a huge ability to scale patching and identifying vulnerabilities, and potentially even attacking the attacker, by using AI to scale defensive capability.
Sam Casey: Before that, it’s been a near-silent hurricane season, but this week we finally saw a US storm make landfall. Rachel Dalton of Insurance Insider is here to tell me more. Rachel, good to speak to you again.
Rachel Dalton: Thanks for having me, Sam.
Sam Casey: It’s the time of year when we all become amateur weather forecasters watching the hurricane season, which had been eerily quiet until this week, when Hurricane Isaias made landfall in Florida. What sort of scale of loss is this looking like as a catastrophe event?
Rachel Dalton: Late on Tuesday we had an official insured loss estimate from Verisk, which puts Isaias at between $1bn and $2bn. But we’d already heard from sources that the loss would be small, no more than $3bn at the outside. There’s no energy infrastructure in its path and it’s not a very densely populated area. So, as one of our sources put it, a $1bn-$2bn loss is walking around money, or pocket money, particularly for a US storm.
Sam Casey: And with a claim of that size, who ends up picking it up? Is it going to affect reinsurers or is it more of an insurance loss?
Rachel Dalton: Our sources were pretty clear that this will be broadly a primary market loss, and not a very big one at that. There may be some small reinsurance involvement, but only on the very few low-attaching programmes left in the market, the so-called “racy” deals that attract very high rates on line. So if any reinsurers are paying out on it, they’re unlikely to be too disappointed.
Sam Casey: So presumably, given this isn’t the kind of market-moving event that’s going to shake up the softening market, it won’t have a big impact.
Rachel Dalton: That’s right. One insurer called Isaias a speed bump, and I think that’s a really good analogy. This is a tiny loss. It’s not expected to make any difference to the D&F or property treaty market at 1/1.
Sam Casey: As I said, this has been a very quiet cat year. How unusual is it? I think this is almost the first landfalling hurricane we’ve had.
Rachel Dalton: This is the first landfalling hurricane we’ve had in two years, since Hurricane Milton in October 2024. So it’s really quiet, and as you say, quite eerie. Swiss Re put out figures at mid-year showing cat losses in H1 this year were less than half of those in H1 2025, and below the 10-year average as well. In H2, thanks to another very quiet North Atlantic season, there haven’t been many more cat losses. If you add together Hurricane Polo in Mexico, the nor’easter in September, the European severe convective storms and the Spokane fire, you still only get to about $7.5bn. That’s not an exhaustive list, but it’s looking like a pretty quiet cat year overall.
Sam Casey: Which probably only adds to the good results and the competition in the market.
Rachel Dalton: Absolutely. More of the same.
Sam Casey: Super. Rachel, thanks for sharing your thoughts.
Rachel Dalton: Thanks very much.
Sam Casey: Envelop is a specialist reinsurance business that has built considerable expertise in the cyber market. Due to become a full Lloyd’s syndicate next year, the business is starting out on a diversification strategy. To discuss this further, I’m joined by Envelop CEO Jonathan Spry. Jonathan, thanks for coming and speaking to me today.
Jonathan Spry: Great to be here, Sam.
Sam Casey: To start off, perhaps you could introduce Envelop to listeners who aren’t as familiar with it. I know you’re a cyber reinsurance business, but there’s a lot more to it than that. You’ve also got a capital markets platform and a tech proposition, and there’s a wider diversification journey going on as well.
Jonathan Spry: We’re celebrating 10 years of Envelop this December, so we’re very pleased about that. Our origins were as a technology company built on the principles of machine learning and advanced engineering. We quickly decided we wanted to earn our living through underwriting, and that cyber was the first opportunity we wanted to go after. Our go-to-market strategy was to take an agency-type approach to underwriting cyber, but we felt our analytics and machine learning were particularly well suited to portfolio risk analysis. Partly for that reason, and because of our interest in capital allocation and portfolio optimisation, we decided reinsurance was the place to start. We’ve stuck quite rigidly to cyber reinsurance for 10 years and have done little else. But 2026 has been a really important year for us. We recently hired a full cyber team across London and Bermuda, and this year we’ve added a casualty treaty underwriting team. Because we have approval for a full Lloyd’s syndicate from 1 January 2027, we can add complementary products in cyber and casualty and spend more time thinking about the crossover between them and what’s happening in the world of liability. That includes AI, of course. We’re not going to get very far in this podcast without talking about everybody’s favourite subject. So in short, Envelop’s history over 10 years is that of a technology company that decided to earn its keep through underwriting, focused on cyber and digital risk. Now we’re broadening our focus a little to include a wider suite of liability risks.
Sam Casey: Was diversifying your underwriting always something you’d planned? Or did you reach a point where it just made sense, because you had the analytics and the ability to add value in other parts of the market?
Jonathan Spry: I guess it’s both. We’ve certainly been thinking about it for a long time. We’re somewhat agnostic to class of business, because policy wordings don’t necessarily map exactly to our view of risk. We’re very interested in digital risk, but also in more complex risk that might have a human angle to it. So human-driven risk and the intangible world, but also all the infrastructure going into building the AI economy of the future, which has some tangible elements. We see risk on a forward-looking basis as quite different from historic risk, which perhaps got pigeonholed into different classes of business more easily. So we’ve always been on a journey of trying to understand how risk evolves, get our heads around the complexities and use the best analytics to build a predictive view of what the future may look like. We think that works at a portfolio level, which is why we’ve stuck with portfolio underwriting, diversified books of business and particularly reinsurance. So when we get the chance to expand, as we have, there’s probably a bit of tactical, opportunistic behaviour there. But it’s opportunistic within a long-held strategy, which is to think about the future of risk and address it.
Sam Casey: As you mentioned, we can’t get very far in today’s world without touching on AI. Sometimes it’s hard to know where to start, but for a business that puts analytics right at the centre of what it does, it seems there are real opportunities to use AI to increase the sophistication, efficiency and scale of that work. Is that something you think about a lot as you move into this next stage?
Jonathan Spry: Absolutely. It’s been slightly strange for us, because our origins in AI go back even beyond the 10 years we’ve been around. They build on work some of the initial team had been doing in defence and aerospace, particularly in the US. So for us AI isn’t new. It just means something a little different, maybe a bit broader than the current use of the term, which leans more towards generative AI, agentic AI and the path towards artificial general intelligence. For us, all of this is part of a less surprising process that’s been building for a very long time: a data-driven world, data becoming more important and the ability to overcome some of the biases and flaws in human decision making. It doesn’t come as a shock to us.
Sam Casey: For less tech-savvy people like me, it’s easy to think AI was just born overnight with ChatGPT in 2022. But as you say, that’s the latest stage of technological change that’s been happening for a long time.
Jonathan Spry: What you can see above the surface is one thing. The iceberg beneath the surface is another. In fairness to the insurance industry, I believe it is getting its head around the size of this change. It’s a paradigm shift, if you like. We believe we’re at the forefront of some of that thinking, and we’re delighted to work with many others, particularly our strategic partners who are sharing that journey with us. There’s just so much more to do. We’re justifiably concerned about AI as a risk, whether that’s AI liability, risk linked to AI infrastructure or cyber risk, which we’ve been reinsuring for years. Of course, there are AI-linked attacks and AI threat actors and vectors, which are concerning. But we see AI as something that has to be looked at through a cost-benefit lens. There’s lots of defensive benefit, lots of economic benefit and huge opportunity for the insurance industry. But we rightly have to balance that against the threats AI poses and the weaknesses it exposes in our business models.
Sam Casey: If I look at cyber and longer-tail casualty classes, they rely very much on spotting trends early and potentially predicting them using data. Do you think those longer-tail classes in particular are ripe for AI to make a real difference on the analysis front?
Jonathan Spry: Yes, and I’d argue they already are. I don’t think we’d get much pushback on that. There’s long been a belief that stochastic modelling and inference have value in predictive analytics. What we’re doing now is moving towards more sophisticated techniques like causal inference, with more data, better data and structured data. There’s also been a huge increase in compute, whether for training or inference, which massively speeds up and expands our ability to run regression analysis. If nothing else, that’s moving the needle on predictive analytics. It means we can understand far more scenarios, crunch more data and build a much more refined picture of the possible futures we see. That’s hugely beneficial to underwriters, because it’s breaking new ground in what’s possible for a forward-looking view of risk rather than just a backward-looking one.
Sam Casey: Is it a big area of investment for the business? Do you have people or teams dedicated to thinking about this?
Jonathan Spry: Our analytics team sits under the banner of Envelop Labs. It brings together machine learning, engineering, software, threat intelligence and analytics, and it’s our largest team. More than 50% of our people sit within it. Probably more importantly, the rest of us are heavily immersed in that world too. Our underwriters work cheek by jowl with the analysts every day, using these analytical tools to manage and allocate capital and optimise the portfolio. There’s still definitely a role for human underwriting, but the two work really well together. People call it augmented underwriting. That’s very much how we see it, and it’s what we’re putting into practice every day.
Sam Casey: If we flip it on its head a bit, how do you think about AI when it comes to risk and liability? We read a lot in the mainstream media about AI agents going rogue. To what extent is that a cyber risk from an insurance perspective, or a casualty one? What are your thoughts on that?
Jonathan Spry: There’s no doubt AI is adding to the considerations around the risk profile of cyber insurance and reinsurance, and of broader liability policies, perhaps even the tangible world of insurance too. There’s clearly a predator-prey dynamic. On one side there’s intentional, malicious behaviour, where bad actors are ruthlessly exploiting agentic AI or other weaknesses in AI models. On the other, there are unintentional, non-malicious but still harmful actions taken directly by agentic AI, and we’ve seen that a few times now. We don’t see that dynamic going away. It’s real, it’s having an impact and there are claims driven by it. What we’re also seeing, in the nature of predator and prey, is that the same tools are being used as defensive mechanisms with some success. So we’re seeing cybersecurity become far more proactive and less reactive. There’s a huge ability to scale patching and identifying vulnerabilities, and potentially even attacking the attacker, by using AI to scale defensive capability. The cause for concern is probably any gap between the two, with threat actors scaling their AI faster than defenders. Even a gap of a couple of months can prove problematic. We’ve seen events this year that I think will be easier to defend against in future, but they have caused some problems. We’re reading about it in the press every day. Politicians are expressing concern and linking it to infrastructure and healthcare, which are very much in focus at the moment, although those can have different consequences for the insurance industry. So it’s a very dynamic, fast-moving environment to be underwriting in. Nothing we’ve seen concerns us to the point where we’d stop underwriting at current levels of pricing and rate adequacy. But we expect the risk landscape to drive more disciplined behaviour from underwriters, whether in cyber or the broader liability space. In insurance and reinsurance, and particularly in the US, we can’t separate changes in the risk landscape from the realities of pricing and underwriting. We do feel confident the industry will act in a disciplined way and won’t be found wanting when it comes to all this additional AI risk.
Sam Casey: It sounds like things are moving so quickly on the technology front that it’s almost incumbent on insurers to make sure they don’t fall behind and that they’re assessing and adapting just as quickly. You talked about discipline in the market and whether this will fuel it. What’s your current view on how the cyber reinsurance portfolio is performing in terms of rate adequacy? We’re heading into renewal season. I don’t know if you’ve got any pearls of wisdom on how you expect things to develop, or whether it’s still a bit early.
Jonathan Spry: A little early. I was hoping you might tell me, Sam. There’s certainly not a clear picture yet for 1/1. In the US, we do see rate adequacy being called into question this year. We’re seeing some improvement in rate on the underlying primary books. Maybe not a huge improvement, but the direction of travel is what we’d like and expect to see. You could view that as early signs of a correction, though that probably means flattening in places and maybe some increases elsewhere. I think that’s quite a US-driven trend, given how rate adequacy is calculated there. Elsewhere in the world it’s less obvious that we’re in a correction phase, but those markets are coming from a much better place on rate adequacy. So it’s a different dynamic, probably a lagging indicator. We’d expect the international market to follow rate correction once it’s more evident in the US, but probably not lead it. I also think some of the more experienced brokers, who have built expertise through the cycle, are guiding clients to think long term about whether now is the right time to keep pushing reinsurers. People are thinking through the cycle a bit more now, about the importance of the protection and the relationships. We, and I’m sure others, have had reinsurance relationships with US clients for seven or eight years or more that feel more like strategic partnerships, with high levels of data disclosure and very high-calibre discussions about rate adequacy and the changing risk landscape. I think most people now realise that pushing rates further down isn’t going to benefit anybody. The risk landscape has shifted gradually. It wasn’t a single event, but there’s been incremental attritional loss. That’s forcing everyone’s attention back to the right question on rate, and I think sense will prevail and we’ll get to a better place at 1/1.
Sam Casey: You mentioned Envelop celebrating its 10th anniversary. Looking to the future, you’ll be launching the full syndicate in 2027 and adding new classes of business. Thinking five or ten years ahead, how do you see or hope the shape and flavour of the business will look?
Jonathan Spry: We believe in diversification. It’s real. But the reason we’ve stayed fairly monoline, and we’re certainly not monoline now but historically we were, is that we believe it’s really important to stick to what you’re good at. In our view, the market tends to separate more clearly into leaders and followers over time, and I think that’s what’s happening. So while diversification is important, mostly we prioritise results and leadership within a niche, and our capital providers can then diversify around that. I think with time we can achieve both. We can pick a few areas where we outperform at portfolio level. It’s really important for us not to chase business in every direction. We want to be leaders in any market we’re in. For us, that probably means sticking with portfolio-level classes of business driven by data, where we can make a difference. Complex emerging risk is probably easier for us to outperform in than anything very conventional. But there will be more diversification within that as we grow. We’re very keen to show we can lead but also follow in a much more efficient, data-driven way. Whether that’s following to slightly outperform the index, so alpha, or a beta play of tracking the market as a whole very efficiently, I think Envelop has a role to play in both. That’s what you can expect to see more of from us in our underwriting, in both London and Bermuda, in the coming months and years.
Sam Casey: Brilliant. Jonathan, I’ve really enjoyed our discussion today. It just leaves me to say thank you very much for coming on the show.
Jonathan Spry: I’m delighted to have been here, Sam. It was great to chat to you, and I look forward to catching up again soon.
Sam Casey: Thanks for tuning in again to Behind the Headlines, and see you again in two weeks’ time.
