Continuous underwriting: are annual cyber risk reviews obsolete?

TL;DR: Static annual cyber assessments are no longer fit for purpose because risk changes continuously, and active AI agents can move underwriting from read-only analysis to real-time workflow support, according to Cowbell. The governance challenge is not speed alone but keeping human approval, auditability, and accountability intact as automation becomes more operational.

Editorial analysis by NHI Mgmt Group, based on content published by Cowbell: “Continuous Underwriting: Why “Once a Year” is Broken”.

Key questions

Q: How should insurers govern AI agents that access policy and claims data?

A: Insurers should govern AI agents as non-human identities with explicit scope, short-lived permissions, and auditable action trails.

Q: Why do annual cyber assessments fail to reflect real risk?

A: Because cyber risk changes faster than a yearly review cycle can capture.

Q: What are the warning signs that underwriting has become too static?

A: The clearest signs are repeated renewal surprises, late discovery of vulnerabilities, inconsistent evidence quality, and underwriters relying on old questionnaires to explain current exposure.

Practitioner guidance

• Implement continuous evidence collection Move from annual point-in-time questionnaires to recurring evidence capture on exposures, vulnerability signals, identity changes, and control status so underwriting inputs stay current.
• Separate AI drafting from approval rights Allow agents to prepare missing-data requests, coverage notes, and remediation suggestions, but keep pricing and policy decisions behind explicit human approval gates.
• Log every recommendation and decision Record which agent produced each draft, what evidence informed it, who approved or rejected it, and when the decision changed so the workflow remains auditable.

Bottom line: Static annual cyber assessments miss material changes that happen between review cycles, which makes them a poor fit for fast-moving environments.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →