KYND adds AI detection to cyber risk tools for insurers

KYND's new AI discovery capability lets underwriters independently map AI exposure across an insured organisation's digital footprint.

By Disrupts Editorial Team Tue, 13 October 2026 AI level 2 of 5

AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean

A modern control room features a large video wall and multiple curved workstations, each with several monitors displaying bright teal network patterns, along with keyboards, mice, and office chairs.

Cyber risk intelligence provider KYND has launched an AI detection capability that enables insurance underwriters to identify the AI technologies present across an organisation's external digital infrastructure, without relying solely on self-disclosure by the insured. The tool scans from a single domain, producing an independently observed technology map that sits alongside, and can challenge, information gathered through proposal forms and underwriting conversations.

The move arrives at an uncomfortable juncture for the cyber insurance market. Underwriters are already expected to price AI-related exposures, yet the pace at which businesses are embedding AI tools into their operations is outrunning both internal governance and the traditional underwriting interview. KYND's own white paper, The Wild West of AI Risk, argued that undisclosed AI adoption is quietly building concentration risk across insurers' portfolios, a dynamic the industry has only recently begun to name.

Shadow AI and the underwriting blind spot

The structural problem KYND is targeting has a name in the security industry: shadow AI, where tools are deployed inside an organisation without formal sign-off or oversight. According to IBM research cited by KYND, one in five organisations reported a breach last year attributable to shadow AI, and those with high levels of unsanctioned AI use incurred an average of $670,000 in additional breach costs compared with peers that had it under control. For an underwriter pricing a cyber policy, an applicant's inability to accurately report its own AI stack is not a niche edge case, it is rapidly becoming the default condition.

KYND's new capability identifies AI applications visible across an organisation's external infrastructure: AI assistants and chatbots, generative AI tools embedded in marketing and commerce platforms, and the AI crawlers that the organisation's infrastructure knowingly permits. Melanie Hayes, co-founder of KYND, framed the value proposition in terms of conversation quality rather than surveillance: "Giving underwriters independently observed information means the conversation can start with greater visibility of what is detectable on the risk, helping underwriters ask more informed questions and build a clearer picture of the exposure."

Convergence: where cyber insurance meets AI governance

The broader significance for capital allocators and cross-sector risk professionals is the direction of travel this signals. Cyber insurance has historically priced technology risk based on what companies say about themselves. AI is making that model structurally inadequate, not because companies are dishonest, but because AI adoption is genuinely moving faster than any organisation's capacity to catalogue it.

This creates a convergence point between the cybersecurity sector and the insurance market that is still early in its pricing discovery. Reinsurers, who absorb tail risk across entire portfolios of cyber policies, face a compounded version of this problem: concentration exposure to a single AI vendor or model type could be invisible at the cedant level but material at the book level. KYND explicitly addresses this with a portfolio-layer view, giving reinsurance teams the ability to examine where common AI technologies and dependencies are appearing across multiple insured organisations simultaneously.

The capital implications extend further. As AI liability frameworks develop, the EU AI Act's risk-tiering regime being the most structured example currently in force, insurers will need to demonstrate that their underwriting processes can distinguish between genuinely governed AI deployments and shadow-AI-laden ones. Tools that provide independent observability of an organisation's AI stack will be a prerequisite for credible pricing in that regulatory environment, not a differentiator. KYND is positioning early in what is likely to become a contested and well-funded category, sitting at the intersection of AI governance, cyber risk quantification, and insurance infrastructure.