Leadership in Digital Risk Management for 30 Years
After more than 30 years of leadership in digital risk management, Cyber Risk Insights Limited provides actionable insight on digital risk, viewed through the lens of insurer and insured balance-sheet exposure and risk capital — applied across the full range of where that risk now lives. From the balance-sheet exposures insurers are pricing today, to the exposures the next decade of quantum-capable computing and autonomous AI will create.
Digital risk is bigger than cyber risk, and treating the two as synonymous is itself becoming a source of exposure. Cyber risk — data, systems, unauthorised access — is one facet of a wider phenomenon: the accumulating, interconnected exposure created as encryption regimes reach their expiry date, AI systems begin acting rather than merely advising, physical infrastructure inherits software's fragility, and intelligent machines move into the physical world. The five areas explored below are where that phenomenon is concentrating most visibly today, but the dynamic connecting them is the same: digital capability is advancing faster than the frameworks built to govern, finance, and insure it.
This matters differently, but comparably, for IT-centric and OT-dependent enterprises. For the former, exposure concentrates in data, identity, and decision-making, where an AI-driven error or a harvested credential surfaces as loss. For the latter, the same dynamics surface as physical consequence: a compromised control system, a robot acting faster than its safety layer can be trusted to catch.
Three consequences follow, each still being worked out in real time. Regulatory exposure is the most immediate: obligations such as the EU AI Act's requirement for genuinely effective human oversight assume a human can meaningfully intervene, an assumption that strains once decisions occur at machine speed, and points toward a real open question — how oversight itself evolves toward continuous, meta-level approval and dynamic compliance testing, rather than static sign-off.
Risk capital provisioning is the second, and nowhere is it starker than data centre financing: construction-phase risk sits with sponsors and lenders, operational risk transfers as facilities are refinanced into infrastructure capital, and digital risk — quantum exposure, AI liability, cyber-physical damage — must be re-underwritten at each transition, often by parties with very different risk appetites to those who financed the build.
The third is insurance itself, being asked to do more, differently. Beyond conventional cover, digital risk is accelerating interest in reinsurance capacity, alternative risk capital, captives, and retained risk groups — structures that let genuinely novel, correlated exposure be pooled, transferred, or retained deliberately, rather than left to default into whichever policy happens to respond.
Explore how this plays out across five areas:
Post-Quantum Transition
Agentic AI & Silent AI
Cyber-Physical Damage (CYPD)
Robotics & Physical AI Governance
Risk Capital Provisioning in Data Centre Build Lifecycle