Artificial intelligence is rapidly becoming a standard tool in the workplace, but new research indicates that cybersecurity practices are not keeping pace. According to a 2026 Nationwide survey, six in 10 business owners report that employees are using public AI chatbots or writing tools for work-related tasks. However, only 36% have written policies governing employee AI use, and just 37% provide training on responsible use. This gap between adoption and governance creates significant exposures for businesses of all sizes.
The risks are not only internal. Nearly one-third (31%) of small and mid-market business owners surveyed said their company had been targeted by a scam or fraud attempt using generative AI within the previous 12 months. These attacks often leverage AI to create convincing phishing emails, impersonation attempts, or fraudulent content that appears to come from trusted sources. Inter Insurance Agency notes that the findings are a reminder that the rapid adoption of new technology can create new exposures for businesses of virtually every size.
"AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them," said Tim Derham of Inter Insurance Agency. "An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward."
Nationwide's survey found that only 35% of business owners have an up-to-date incident response plan. More than a third (35%) also believe employees are using unauthorized AI tools for work. These statistics highlight a reactive rather than proactive approach to cybersecurity, leaving companies vulnerable to financial loss, reputational damage, and operational disruption.
Cyber insurance can be an important component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with events such as data breaches, cyberattacks, business interruption, recovery efforts and certain liabilities resulting from a cyber incident. However, insurance alone is not sufficient. Inter Insurance Agency encourages businesses to establish clear policies regarding the use of AI tools, train employees to recognize phishing and impersonation attempts, control access to sensitive information and maintain an incident-response plan.
Businesses should also periodically review their cyber insurance as their operations and technology use change. "The way companies work is changing extremely quickly," Derham added. "Your risk management and insurance shouldn't be based on what your business looked like three or four years ago."
The implications of these findings are clear: as AI becomes more integrated into daily operations, the threat landscape evolves. Companies that fail to adapt their cybersecurity and insurance strategies may find themselves unprepared for the next generation of cyber threats. The survey, conducted by Edelman Intelligence through an online survey fielded July 10-26, 2026, underscores the urgent need for businesses to reassess their risk management frameworks in the age of AI.
