Chubb chairman and chief executive Evan Greenberg has warned that artificial intelligence is fuelling an “arms race” in cyber-risk while at the same time reshaping how insurance is distributed, particularly in Bermuda, which writes a majority of the world’s cyber-risk.

Speaking on Chubb’s first‑quarter earnings call, Mr Greenberg offered unusually detailed commentary on the impact. He said new tools, like Anthropic’s Mythos, can read and analyse code at scale, lowering the threshold for what counts as a vulnerability and allowing attackers to stitch together minor issues into serious exposures.

“Anthropic is a code generator so it can read code,” he said. “What were minor vulnerabilities can now be aggregated in a much more insightful way. And then there are others that go and do searches for information. That means they know systems, computers. They know how to access the system.”

He added that it is “not just that you can use this to find your own vulnerabilities, but many companies also use open source [code].

“You can find vulnerabilities, maybe even before suppliers do.”

The result, Mr Greenberg argued, is a genuine arms race between attackers and defenders. On the defensive side, he pointed out the importance of basic “hygiene”, continuous monitoring and patching vulnerabilities quickly.

“The arms race is on now,” he said. “It is about hygiene and services to monitor and support clients in identifying and fixing. And clearly, how diligent are you? Do you identify and patch? And imagine now the tools to patch are more automated, and that automation is improving quickly, so you can patch faster.

“That’s the defence side of it, while we know the offence side is just around the corner.”

So far, however, Mr Greenberg added, most AI‑enabled cyber incidents still involve “humans in the cockpit”, with only one known case where an attack did not involve a human operator.

Bermuda Monetary Authority data shows that Bermudian-based groups and commercial insurers wrote or consolidated $10.78 billion in cyber premiums in 2024, with the captive sector adding another $190 million. Together, those figures represent about 73 per cent of global cyber premiums.

At the same time, insurers paid out $903.6 million for 93,757 cyber claims in 2024, a steep increase from $521.9 million across just 19,680 claims in 2023, even as the sector saw rates begin to soften.

This, combined with AI’s influence, could push insurers towards more targeted stand-alone policies, according to the BMA. From an underwriting standpoint, Chubb is already redrawing the cyber-risk map by segment.

Large corporate buyers, Mr Greenberg suggested, should stay well‑protected, with strong perimeters and more disciplined cyber hygiene. At the other end of the spectrum, very small companies may be less attractive individual targets, but they raise systemic concerns when put together.

The group Chubb is watching most closely is the mid‑market.

“The biggest meatball there is middle market companies. They’re a target. They have more money, and they’re less capable at hygiene, and focus on it less. And so all of that is on our minds as underwriters.”

Mr Greenberg also made clear that AI, beyond changing the risk, is changing how Chubb itself operates and grows. He described small commercial, both retail and excess and surplus, as a “real growth area” for the group over the next five years, driven in part by agentic AI and large‑language‑model‑based enterprise software.

“What we have done to transform [small commercial], and what we’re continuing to do to transform it, including with the use of AI and now with what’s in front of us with agentics, and evolving [LLM] capabilities and enterprise software that emerges from that as well — yes, it is a real growth area for our company over the next five years,” he said, adding that international opportunities may ultimately “dwarf North America”.

On Chubb’s broader digital transformation, Mr Greenberg said he has not changed the company’s long‑term goals but argued that the pace of technological change — particularly in enterprise solutions built on frontier AI models — will only “accelerate, improve, lower cost, make it easier”. He noted that he now spends “much more time” on AI than even a year ago, warning that leaders who rely on second‑hand briefings on AI risk becoming “irrelevant”.