Nationwide Survey: Businesses Are Using AI Faster Than They Are Managing Its Risks

Nationwide's 2026 survey found 60% of small and mid-market businesses use public AI tools for work, but only 36% have written AI-use policies and 37% provide responsible-use training. Generative-AI scams have targeted 31% of respondents in the past year, while only 35% maintain an up-to-date incident-response plan. The findings highlight growing cyber-risk exposure and potential demand for cybersecurity, insurance and AI-governance services.

Analysis

This is directionally supportive for cyber vendors with low-friction SMB distribution, but it is not yet evidence of a claims-loss inflection for commercial insurers. The monetizable gap is likely concentrated in managed detection/response, identity verification, email security and security-awareness platforms rather than broad endpoint vendors: SMBs generally buy bundled, outsourced solutions through MSPs. Likely beneficiaries include CRWD, PANW and GEN, while channel-focused private vendors may capture disproportionate share before public-platform revenue visibly accelerates.

For insurers, rising AI-enabled business-email-compromise and social-engineering frequency is initially a pricing and retention opportunity, but only if underwriting exclusions and sublimits reprice faster than loss severity. Public carriers with meaningful commercial cyber exposure—TRV, CB and AIG—face a two-sided setup over the next 2-4 quarters: higher written premium can support growth, but reserve development or a rise in cyber combined ratios would compress valuations. The more immediate second-order beneficiary is cyber reinsurance pricing; however, public-market exposure is diffuse through RNR and ACGL rather than a clean pure play.

Consensus may overestimate near-term security-spending conversion. Small businesses acknowledge risk but historically defer nonmandatory controls until a breach, insurer requirement, or customer procurement mandate forces action. The key 1-3 month catalyst is not survey follow-through but whether insurers begin requiring MFA, incident-response plans and approved-AI-use controls at renewal; that would turn awareness into recurring software and services demand. Over 6-18 months, AI governance may become a standard underwriting variable, favoring vendors that can generate auditable control evidence rather than generic AI-security marketing.

No standalone trade is warranted from this company-sponsored survey. Treat it as an alert for upcoming earnings commentary on SMB bookings, cyber-policy renewal rates, loss ratios and carrier underwriting changes; a broad risk-off move or evidence that AI fraud is being absorbed without claims severity would falsify the implied demand/pricing thesis.

Key Decisions for Investors

• Maintain a 1-3 month watch on CRWD and PANW rather than initiate on this datapoint; upgrade only if quarterly results show accelerating sub-enterprise/managed-service bookings or raised ARR guidance. Falsifier: flat SMB billings and continued sales-cycle elongation despite AI-security demand commentary.
• Monitor TRV, CB and AIG during upcoming earnings for cyber premium growth versus loss-ratio/reserve commentary; avoid treating higher cyber-policy demand as unambiguously bullish. A tradeable long catalyst requires price increases and exposure growth without adverse development.
• Screen RNR and ACGL for cyber reinsurance repricing disclosures at January renewals; consider relative long exposure only if rate-on-line increases exceed modeled loss-cost trends. Falsifier: cedants retain more risk or capacity expansion suppresses pricing.
• Set an alert for insurer-imposed AI-control requirements in SME renewals or major procurement standards. That event—not survey awareness—would justify a tactical long basket of CRWD/PANW/GNRC-style channel beneficiaries, sized against elevated cybersecurity multiples.