🔍 Intelligence Synthesis JP/EN
Ethics · Regulation · Technology — Pharma Practice Notes

Special ── 2026-10-25

30% of UK Insurers Fear AI Cyber Attacks Most

KPMG UK survey: 30% of insurance leaders name AI attacks as top readiness gap

What changes

In KPMG's survey, 60% of UK insurance leaders say cyber resilience should be strengthened over the next 12 months. Another 45% point to AI governance and oversight.

The concern reaches beyond insurers to their suppliers, partners and customers. Huw Evans of KPMG says resilience cannot be built firm by firm.

For executives and policymakers, this means sharing information with peers and government, not only upgrading internal defences. The survey names limited industry co-operation, driven by competitive sensitivities, as the biggest barrier.

Why it matters

According to KPMG's UK survey, 30% of insurance leaders say AI-enabled cyber attacks are the emerging risk the industry is least prepared for. That ranks ahead of climate-related catastrophes and technology system failures and outages.

KPMG says AI frontier models, meaning the most advanced AI models, are increasingly exposing vulnerabilities in IT systems. It says this challenges the operational resilience of major financial institutions and their suppliers, partners and customers.

Operational resilience is the ability to keep operating and recover after an attack or failure. Evans expects the need for co-operation to grow as the risks materialise.

What the report says

In KPMG's survey, 30% of insurance leaders named AI-enabled cyber attacks as the emerging risk the industry is least prepared for. Looking ahead 12 months, 60% said cyber resilience should be strengthened and 45% pointed to AI governance and oversight.

AI is also seen as part of the answer. 30% of leaders identified it as the emerging technology offering the greatest opportunity to strengthen UK resilience.

At national level, 28% said cyber security should be the UK's top priority for resilience over the next year, against 17% for defence resilience. 39% said cyber resilience needs the most collaboration between insurers, government and tech companies, versus 18% for protecting national infrastructure.

On the biggest barrier to greater protection against systemic cyber risks, 32% pointed to limited industry co-operation because of competitive sensitivities. 15% cited accumulation of systemic risk or regulation. Systemic risk here means risk that spreads to many firms at once.

Who and what scope

The report comes from KPMG in the UK, part of a global network of professional services firms offering audit, tax and advisory services.

The survey covers 109 UK adults at director level and above in insurance firms. It reflects the views of UK insurance leaders only.

Why this report

KPMG's question is how the rapid development of AI frontier models is pressuring insurers' operational resilience against fast-evolving cyber attacks.

It also asks where the industry should focus: cyber resilience, AI governance, or collaboration with government and technology providers. KPMG frames this within a wider geopolitical picture in which cyber risk increasingly sits.

How they studied it

According to KPMG, the research was online quantitative research carried out by Opinium on KPMG's behalf. Fieldwork ran from 7 to 12 September 2026.

Respondents were 109 UK adults at director level and above in insurance firms.

KPMG's release does not give the full questionnaire or how respondents were selected. The figures capture leaders' perceptions, not measured losses from attacks.

Key points

  1. In KPMG's UK survey, 30% of insurance leaders named AI-enabled attacks the emerging risk the industry is least prepared for
  2. For the next 12 months, 60% prioritised cyber resilience and 45% AI governance and oversight
  3. The biggest barrier, cited by 32%, is limited industry co-operation due to competitive sensitivities

Conclusion

KPMG's survey shows UK insurance leaders are acutely aware of their gap in preparing for AI-enabled attacks. At the same time, 30% see AI as the technology with the greatest opportunity to strengthen resilience.

KPMG calls on insurers, government and technology providers to share more information on where vulnerabilities and dependencies sit. The findings rest on 109 respondents and may not apply to other regions or sectors.

Quotes and sources

“Almost a third (30%) of insurance leaders say AI-enabled attacks are the emerging risk the industry is least prepared for”
── KPMG, 2026-10-23
“Six in ten (60%) say cyber resilience should be strengthened over the next 12 months, while 45% point to AI governance and oversight.”
── KPMG, 2026-10-23
“almost a third (32%) point to limited industry co-operation because of competitive sensitivities”
── KPMG, 2026-10-23
“this interconnectivity means resilience cannot be built firm by firm.”
── KPMG, 2026-10-23

Source articles

Written by AI (Claude) from the report and its coverage, then checked by Jev (TypeSafe's judgement model), a Gemini fact-check and a verbatim check of every quote.