Resilience Claims Data Shows Human Error Drove Majority of Cyber Losses in First Half of 2026

More than 85% of incurred losses stemmed from attacks exploiting human error, revealing urgent need
for organizations to solve foundational cyber risks before AI amplifies them

SAN FRANCISCO, July 30, 2026 /PRNewswire/ -- As organizations scramble to prepare for and defend against AI-native cyber threats, new insurance claims data from leading cyber risk solutions company Resilience suggests that as of today AI is more frequently serving as a force multiplier for attack methods that exploit the fundamentals of cybersecurity, rather than creating new, sophisticated and autonomous attacks at scale.

Resilience observed no incurred losses from AI-specific attack vectors, including prompt injection, model exploitation, or agentic AI misuse, in the first half of 2026. But in the same time frame, more than three-fourths (85.3%) of incurred losses across Resilience's portfolio stemmed from attacks that exploited common human error—specifically, in which phishing, social engineering, or transfer fraud served as the point of failure. By comparison, this same category of tactics accounted for only 17.7% of incurred losses during the same period in 2024, underscoring that AI's financial impact is currently being felt through familiar attack methods rather than entirely new ones.

"AI is rapidly reshaping cyber risk, as recent headlines have shown. But insurance claims help us understand where that risk is actually translating into financial loss," said Vishaal "V8" Hariprasad, Co-Founder and CEO of Resilience. "Our data shows that AI is already contributing to financial losses by making familiar attack methods, like phishing and social engineering, more effective than ever. While we haven't yet seen AI-native attacks emerge as their own driver of insured loss, that could of course change at any moment. As such, the organizations best prepared for the future will be the ones that treat AI as part of a broader, risk-first strategy—strengthening the controls that limit the impact of today's attacks while preparing for tomorrow's."

Additional findings across the first half of 2026 include:

• Phishing and social engineering increasingly served as attackers' primary point of entry. Independent of how attackers gained initial access, extortion driven by ransomware was the single largest cause of financial loss, accounting for 73% of incurred losses. The finding suggests that threat actors are leveraging different tactics to execute ransomware attacks, with the ultimate goal of significant business interruption or immediate payout.
• Despite accounting for 73% of incurred losses, ransomware represented just 5.8% of total claims, highlighting that while these attacks are relatively rare, they remain disproportionately costly. Increased adoption of immutable backups—from 79.9% to 85.2% year-over-year—is likely helping keep ransomware claims relatively infrequent by preparing more organizations to effectively recover from these types of attacks.
• Looking at other points of failure, vendor-related losses declined to just 2.3% of incurred losses, down from 33.5% in the first half of 2025. While recent incidents like the Canvas platform outage demonstrate that vendor disruptions remain a significant source of operational risk, Resilience data shows they do not always generate the same level of insured financial loss as major third-party breaches like Change Healthcare and CDK in previous years.

As AI continues to increase the sophistication and scale of familiar attack methods, Resilience recommends organizations move beyond traditional security awareness programs and prioritize strengthening the controls that limit the financial, quantifiable impact of inevitable human mistakes. That includes evolving phishing simulations to reflect sophisticated AI-enabled deception, implementing layered verification for high-risk transactions, continuously monitoring compromised credentials, and maintaining mature third-party risk management practices as AI increases the speed and scale of supply chain threats.

"You can't train your way out of every AI-generated phishing email or rely on human judgement when attacks themselves become entirely AI-generated," said Judson Dressler, Head of Resilience's Risk Operations Center. "Whether an attack starts with an AI agent or a regular person, what matters most is how quickly an incident is contained once it's underway. The organizations that avoid the worst financial outcomes detect threats quickly, build layered controls, verify high-risk transactions, and limit the fallout of attacks before they can become material losses."

Resilience's 2026 Midyear Cyber Risk Report combines insurance claims data from the company's portfolio with proprietary intelligence from its Risk Operations Center (ROC) to reveal which cyber threats translate into real financial loss. By pairing these real-world data sources, the report provides a unique view into how cyber risk is evolving and where organizations should focus to reduce material losses and business impact.

To read the full report, please visit https://cyberresilience.com/resource/2026-midyear-risk-report

About Resilience
Resilience helps organizations become cyber resilient to material losses by staying ahead of bad actors. Founded by experts from across the highest tiers of the US military and intelligence communities – and built by prominent leaders and innovators from the cybersecurity, technology, and insurance industries – Resilience is the world's first cyber risk company that offers risk quantification software, cybersecurity experts, and highly rated insurance in integrated solutions purpose-built for large and middle-market organizations.

Resilience is proud to be backed by leading technology investment firms, including General Catalyst, Lightspeed Venture Partners, Intact Ventures, Founders Fund, CRV, and Shield Capital. With headquarters in San Francisco, Resilience is globally dispersed, with teams in New York, Chicago, Los Angeles, Baltimore, Toronto, London, Milan, Madrid, Stockholm, Rotterdam and Dublin. Resilience offers insurance coverage through its licensed and appointed insurance agents and security services through its expert security team. The Resilience Solution is available through all broker partners to clients in the United States, the United Kingdom, Canada, and Europe.

SOURCE Resilience