Your Underwriter Can Now Find the AI You Didn't Put on the Application
Picture the renewal application on a CFO's desk last year. The AI question got answered the way most of them do: somebody asked IT, IT listed what IT bought, and the form went out signed. Nobody hid anything. Nobody thought to ask marketing about the chatbot on the website.
That form was the whole record. Until now.
Cyber risk intelligence firm KYND has introduced an AI detection capability that shows underwriters which AI technologies are running across a company's online footprint before they commit to the risk. It needs a single domain and nothing from the business. It flags AI chatbots and assistants, generative AI tools, AI built into marketing and commerce platforms, and AI crawlers a company's systems allow. The launch follows KYND's recent white paper, "The Wild West of AI Risk," which warned that companies are adopting AI faster than they report it.
The numbers behind why this matters are not small. KYND cites IBM data showing one in five organizations suffered a breach last year tied to shadow AI, meaning AI used without formal sign-off or oversight. Companies with extensive shadow AI faced breach costs averaging $670,000 more than those with little or none.
Read that number again. $670,000 is not a rounding error on a renewal. It's the cost of not knowing what's actually running inside your own operation.
KYND co-founder Melanie Hayes put the shift plainly: "Proposal forms and underwriting conversations remain essential, but AI use is changing rapidly." Here's the reversal every risk manager needs to sit with. AI left off the application was never safe. It just hadn't been found yet. The only open question was who would find it first: you, on your own schedule, or your carrier, with a scan, right before deciding whether your next claim gets paid.
The three-question broker script that's been the spine of this coverage area all year still holds. Has your carrier filed an AI exclusion endorsement in your states? Does your policy actually respond to a claim arising from an AI failure? Have you reviewed vendor contracts for indemnification language that leaves you holding the loss? Add a fourth this renewal cycle: does what you disclosed about your own AI use match what an independent scan of your own systems would turn up?
That mismatch, if it exists, is no longer a private problem. It's visible to the one party whose decision matters most when something goes wrong.
Run your own AI footprint audit this month, before renewal, not after a declined claim. Find out what a scan would find. Then make sure what your carrier knows matches what you're actually running.
Read the full research behind this story, plus this week's senior housing and governance flagships, in the LITT Briefing on Substack.