A 2026 Nationwide survey reveals a critical gap between the rapid adoption of artificial intelligence in the workplace and the cybersecurity measures businesses have in place to manage the resulting risks. According to the findings, six in 10 business owners say employees are using public AI chatbots or writing tools for work-related tasks, yet only 36% report having written policies governing employee AI use, and just 37% provide training on responsible use. This disconnect leaves companies vulnerable to a new wave of cyber threats that exploit both the technology and the people using it.
The risks are not merely theoretical. Nearly one-third (31%) of small and mid-market business owners surveyed said their company had been targeted by a scam or fraud attempt using generative AI within the previous 12 months. These attempts can range from convincing phishing emails to deepfake audio or video impersonations, making it increasingly difficult for employees to distinguish legitimate communications from malicious ones.
Inter Insurance Agency says the findings are a reminder that the rapid adoption of new technology can create new exposures for businesses of virtually every size. "AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them," said Tim Derham of Inter Insurance Agency. "An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward."
Preparation after an attack is another weak point. Nationwide's survey found that only 35% of business owners have an up-to-date incident response plan. More than a third (35%) also believe employees are using unauthorized AI tools for work, a practice that can expose sensitive data to third-party platforms without oversight. These gaps suggest that many organizations are not fully aware of how AI is being used within their operations or how to respond when something goes wrong.
Cyber insurance can be an important component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with events such as data breaches, cyberattacks, business interruption, recovery efforts and certain liabilities resulting from a cyber incident. However, insurance is only one part of preparation. Inter Insurance Agency encourages businesses to establish clear policies regarding the use of AI tools, train employees to recognize phishing and impersonation attempts, control access to sensitive information and maintain an incident-response plan. Businesses should also periodically review their cyber insurance as their operations and technology use change.
"The way companies work is changing extremely quickly," Derham added. "Your risk management and insurance shouldn't be based on what your business looked like three or four years ago."
The Nationwide research was conducted by Edelman Intelligence through an online survey fielded July 10-26, 2026. The findings underscore the need for businesses to treat AI-related risks as a core part of their cybersecurity and insurance planning, rather than an afterthought.
