Insurance CROs flag cybersecurity as top risk while AI and data investment surge, EY/IIF survey finds
Publish Date: 2026-04-24 12:02:00
Source Domain: www.reinsurancene.ws
A majority of insurance chief risk officers (CROs) expect cybersecurity to require the most attention over the next 12 months, while a significant proportion also place third-party and vendor cyber risk among their top five concerns, according to findings from EY, a professional services firm.
The firm reports that many CROs are prioritising generative AI-enabled risk management capabilities, with chatbot and large language model integration emerging as the most common application.
At the same time, most organisations anticipate reducing manual roles within risk functions and increasing investment in data, analytics and AI skills.
The findings are drawn from EY’s third annual Global Insurance Risk Management Survey, conducted in collaboration with the Institute of International Finance (IIF).
The report is authored by Stu Doyle, EY Americas Insurance Nonfinancial Risk Leader, and Jonathan Zhao, EY Global Insurance Leader and EY Hong Kong Financial Services Managing Partner, and reflects responses from CROs across regions, business lines and organisational sizes.
According to EY, the results point to a risk environment defined by increasing speed, complexity and interconnection. Geopolitical developments, technological change, climate pressures and evolving regulation are combining to create risks that emerge more abruptly and spread more widely across organisations.
EY reports that cyber risk, operational resilience, artificial intelligence and third-party dependencies have become central enterprise concerns. The survey indicates, according to EY, that insurers are shifting their focus from managing traditional risks towards anticipating how disruption and innovation could reshape their business models and operations.
In response to escalating cyber threats, EY finds that insurers are bringing together cyber risk, third-party risk and operational resilience into more integrated frameworks. This includes expanding continuous monitoring, strengthening governance…
