AI-Washing Claims
AI-washing securities class actions now drive most US disclosure losses. What it means for D&O insurance at Israeli tech companies and AI startups in 2026.
October 18, 2026
AI-washing securities class actions now drive most US disclosure losses. What it means for D&O insurance at Israeli tech companies and AI startups in 2026.
A cyber policy responds to a network event, while a professional failure in the product, a management decision challenged in court and a payment sent after an impersonation are examined under other lines. A single incident at a software company can put all four in play within the same quarter, and each line responds according to the definitions and exclusions in its own wording. The practical question turns less on how many policies sit in the file and more on where the seam between them runs, and who carries the loss that lands precisely on that seam.
A board that approves a security budget without knowing who can reach production code today is overseeing a number instead of a risk. Five short questions are enough to lift the discussion from IT level to governance level: who holds access to production code, when the last access review was carried out, whether the incident response plan has been exercised, whether the insurance programme matches the actual risk profile, and how third-party vendors with access to environments are managed.
The cyber insurance questionnaire has stopped being an administrative form and become a technical review. An underwriter looking at a software company now asks where exactly multi-factor authentication is enforced, when a real restore from backup was last performed, who is named as incident lead, and what happens to revenue if the primary cloud provider goes down for two days.
AI coding tools deliver real productivity, and in the same breath they push security weaknesses into the development pipeline faster than legacy controls were designed to catch them. A 2024 developer survey found that roughly 97% of the enterprise developers polled were using AI tools to write code at work, so the management question moved long ago from whether to use them to how to control them.
D&O insurance protects the personal assets of a crypto exchange’s directors and officers if they are sued for alleged management failures. It is designed to cover legal defense and judgments arising from claims such as fiduciary breaches, misstatements in disclosures, or failure to comply with regulations.
The crypto/Web3 vertical spans cryptocurrency exchanges, decentralized finance platforms, custodial wallets, NFT marketplaces, tokenization platforms, DAOs, gaming projects and payment processors. These businesses combine technology, finance and digital asset custody, creating novel exposures.
A cyber incident – is a significant business and security crisis where attackers use technological means to disrupt systems, steal data, or demand ransom. These incidents include viruses, breaches, data leaks (Data Breach), denial-of-service attacks, or malicious activity on servers and networks. Internal errors, such as accidentally sending sensitive data to the wrong recipient, are also considered severe security incidents.
One of the most dangerous assumptions in cyber risk is that a small or mid-sized business is somehow below the radar. In reality, most threat actors are not looking for the biggest logo in the market. They are looking for the cheapest path in, the most convenient attack surface, and the target most likely to pay quickly or recover slowly.
Today, a business can come to a halt even when the office is intact, inventory is on hand, and employees are ready to work. In a world of digital dependency, the practical reality is simple: if core systems are unavailable, the business is unavailable. Organizations now rely on digital systems, cloud platforms, email, and online payments to sell, serve customers, manufacture, coordinate logistics, and communicate with suppliers. That is why cyber incidents again rank as the top global business risk in 2026, while business interruption remains one of the core enterprise risks facing management teams of every size.
The fintech sector has become one of the fastest-growing commercial sectors of the past decade. Payment apps, lending platforms, automated wealth management, crypto, and DeFi all present a risk profile unlike anything else in commercial insurance. Assets are largely intangible – code, data, algorithms, licenses. The environment is hostile – hackers, demanding regulators, and alert investors. And when something goes wrong – a processing failure, data breach, regulatory fine – the consequences are typically immediate and binary.
FinTech leadership teams operate in one of the most complex and regulated environments in the financial world. Executives are responsible for innovation, capital raising, regulatory compliance, and investor performance, all while navigating constant market and legal changes.