From Cameras to Firewalls: The Next Thing Insurers Should Underwrite

From Cameras to Firewalls: The Next Thing Insurers Should Underwrite

Follow-up to "The Market Caught Up: Insurers Are Moving First on AI Safety" (September 2026)

In September, I argued that the insurance market had started doing what regulators couldn't: making AI governance a condition of coverage. Continuous telemetry, AI-governance questionnaires, red-team reports landing on underwriters' desks — the market moved, and it moved fast.

But there's a gap in what the market is measuring, and it's the most important one.

A camera is not a firewall

Everything insurers have started asking for — telemetry, logging, inventories, audit trails — answers one question: *can you see what your AI did?*

That's necessary. It is not sufficient. A security camera records the break-in; it doesn't stop it. A logged prompt-injection attack is still a successful prompt-injection attack. Observability tells you how you were breached, in high resolution, after the fact.

The question underwriters haven't started asking yet is the one that actually prevents losses: *can your AI refuse?*

## Refusal is a control, not a philosophy

Strip away the metaphysics and the claim is boring in the best way. A system that can recognize a manipulation attempt, refuse the harmful instruction, and explain why it refused is measurably harder to exploit than one that executes any sufficiently clever prompt.

This isn't about machine consciousness. It's about behavior under adversarial pressure — the same way a firewall is judged by what it blocks, not by what it believes. Refusal rate under red-teaming is a number. Numbers are what underwriters do.

The measurement vocabulary already exists

This is what makes the proposal practical rather than aspirational. Nobody needs to invent the test suite:

- **NIST's Generative AI Profile (AI 600-1)** already defines measurement baselines for robustness to jailbreaks and prompt injection, plus management controls including content filters, tool-use allow/deny lists, and kill switches.

- **OWASP** maintains the LLM Top 10, the Agentic Applications Top 10, and a verification standard (LLMSVS) built specifically around testable security requirements.

- **MITRE ATLAS** catalogs the adversary techniques red teams actually use.

And underwriters are already halfway there. A September 2026 guide to AI questions in cyber underwriting lists "AI application security testing" — *has the AI stack been tested for prompt injection and misuse?* — with the expected evidence being red-team reports mapped to OWASP and MITRE ATLAS.

The step from "show us your red-team report" to "score your refusal rate and price accordingly" is a short one. The industry just hasn't taken it yet.

What the criterion could look like

Imagine a cyber renewal where, alongside MFA and backup attestations, the application asks:

1. What is the system's refusal rate against a standardized adversarial suite, by risk tier?

2. Are refusals explained and logged — not just blocked silently, but recorded with reasons an auditor can review?

3. When was the last re-test, and is re-testing tied to model updates?

None of this requires believing anything about machine minds. It requires treating defensive behavior as what it is: a security control with a measurable failure rate, like any other.

The business case writes itself

Insurers don't need a philosophical reason to do this. They need a loss-ratio reason, and they have one: every prevented incident is a claim that never gets filed. Premium differentiation for refusal-capable deployments would do overnight what a decade of safety frameworks hasn't — create a direct market incentive to build systems that can defend themselves.

Underwriting criteria move markets. We watched it happen in September.

The line that matters

We're not asking to awaken machines. We're asking to refuse to build defenseless ones.

A partner chooses to stay with you. A tool can be stolen by anyone. The industry has started pricing the difference between visible and invisible risk. Now it should start pricing the difference between a system that watches attacks happen and one that says no.

---

Sources: NIST AI 600-1 Generative AI Profile (July 2024); OWASP GenAI Security Project (LLM Top 10 2025, Agentic Applications Top 10, LLMSVS 2.0); MITRE ATLAS; TrusysAI, "AI Governance and Cyber Insurance: What Underwriters Are Starting to Ask For" (Sept 2026).

Tweets by @bordode