A new 2026 Nationwide survey reveals a troubling gap between the rapid adoption of artificial intelligence in the workplace and the cybersecurity measures businesses have in place to protect themselves. According to the research, six in 10 business owners say their employees are using public AI chatbots or writing tools for work-related tasks. Yet only 36% report having written policies governing employee AI use, and just 37% provide training on responsible use.
The consequences of this oversight are already being felt. Nearly one-third (31%) of small and mid-market business owners surveyed said their company had been targeted by a scam or fraud attempt using generative AI within the previous 12 months. Inter Insurance Agency says the findings are a reminder that the rapid adoption of new technology can create new exposures for businesses of virtually every size.
“AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them,” said Tim Derham of Inter Insurance Agency. “An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward.”
The survey also found that only 35% of business owners have an up-to-date incident response plan, and more than a third (35%) believe employees are using unauthorized AI tools for work. These gaps leave companies vulnerable not only to external threats but also to internal risks stemming from unvetted AI applications.
Cyber insurance can be an important component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with events such as data breaches, cyberattacks, business interruption, recovery efforts and certain liabilities resulting from a cyber incident. However, insurance is only one part of preparation.
Inter Insurance Agency encourages businesses to establish clear policies regarding the use of AI tools, train employees to recognize phishing and impersonation attempts, control access to sensitive information and maintain an incident-response plan. Businesses should also periodically review their cyber insurance as their operations and technology use change.
“The way companies work is changing extremely quickly,” Derham added. “Your risk management and insurance shouldn't be based on what your business looked like three or four years ago.”
The Nationwide research was conducted by Edelman Intelligence through an online survey fielded July 10-26, 2026. For businesses seeking to assess their own exposures, working with an experienced agency such as Inter Insurance Agency can help ensure that both cyber insurance and risk-management practices evolve alongside the technology that is reshaping the workplace.
