Artificial intelligence is rapidly embedding itself in daily business operations, but a new survey suggests that cybersecurity practices are not keeping pace. According to the 2026 Nationwide survey, six in 10 business owners report that employees are using public AI chatbots or writing tools for work-related tasks. However, only 36% have written policies governing employee AI use, and just 37% provide training on responsible use. The findings highlight a growing disconnect between adoption and protection.
The risks are not only internal. Nearly one-third—31%—of small and mid-market business owners surveyed said their company had been targeted by a scam or fraud attempt using generative AI within the previous 12 months. This statistic underscores how quickly criminals have weaponized accessible AI tools to impersonate trusted contacts and craft convincing phishing messages.
Inter Insurance Agency says the findings are a reminder that the rapid adoption of new technology can create new exposures for businesses of virtually every size. “AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them,” said Tim Derham of Inter Insurance Agency. “An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward.”
Nationwide’s survey found that only 35% of business owners have an up-to-date incident response plan. More than a third—35%—also believe employees are using unauthorized AI tools for work, further widening the attack surface. These gaps in preparation can leave companies vulnerable to costly disruptions and legal liabilities.
Cyber insurance can be an important component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with events such as data breaches, cyberattacks, business interruption, recovery efforts and certain liabilities resulting from a cyber incident. However, insurance is only one part of preparation.
Inter Insurance Agency encourages businesses to establish clear policies regarding the use of AI tools, train employees to recognize phishing and impersonation attempts, control access to sensitive information and maintain an incident-response plan. Businesses should also periodically review their cyber insurance as their operations and technology use change.
“The way companies work is changing extremely quickly,” Derham added. “Your risk management and insurance shouldn’t be based on what your business looked like three or four years ago.”
The Nationwide research was conducted by Edelman Intelligence through an online survey fielded July 10-26, 2026. As AI adoption accelerates, the survey results signal that businesses must act swiftly to close the gap between innovation and security—or risk becoming the next statistic.
