Industry Insight: NY Issues Cybersecurity Guidance for AI Threat Climate

New York Addresses Rising Cybersecurity Threats in Financial Services

The New York State Department of Financial Services (DFS) has issued comprehensive cybersecurity guidance targeting financial services organizations, including insurance companies, as artificial intelligence technologies create new vulnerability landscapes. This development carries significant implications for property insurance carriers, public adjusters, and the broader claims handling ecosystem.

Understanding the Heightened Threat Environment

DFS defines a "heightened cybersecurity threat environment" as periods when cybersecurity risks are significantly elevated with high likelihood of impacting information systems, nonpublic information, or operations. The guidance specifically identifies two key triggers:

• Geopolitical events that increase cyberattack risks
• Technological developments that materially change cybersecurity risks, particularly the release of frontier AI models

Acting Superintendent Kaitlin Asrow emphasized that the guidance provides "actionable steps that can be taken when the threat environment intensifies," requiring each entity to assess their unique circumstances and operations.

Key Cybersecurity Measures for Financial Services

The DFS guidance outlines several critical best practices that regulated entities should consider implementing:

Attack Surface Reduction

• Disable inactive or unnecessary ports and protocols where possible
• Implement stricter controls on multi-factor authentication enrollment and changes
• Require IT approvals for adding new MFA authenticator devices, applications, and accounts

Enhanced Threat Detection and Response

• Alert all personnel to relevant prevention, detection, and response steps
• Focus on social engineering technique awareness
• Engage with critical third-party service providers to confirm awareness and readiness
• Monitor financial transactions, including virtual currency activities, for sanctions and anti-money laundering compliance

Impact on Insurance Companies and Claims Operations

For property insurance carriers, these cybersecurity measures have direct implications for claims handling and data protection. Claims data represents some of the most sensitive information insurers handle, including:

• Personal identifying information of policyholders
• Property valuations and damage assessments
• Financial transaction records
• Third-party vendor communications

The guidance's emphasis on third-party service provider engagement is particularly relevant, as insurance companies rely heavily on external vendors for claims processing, inspection services, and data management.

Implications for Public Adjusters

Public adjusters operating in New York and working with financial services clients should understand that their cybersecurity practices may come under increased scrutiny. Key considerations include:

Data Handling Protocols

Public adjusters must ensure robust protection of client information, particularly when interfacing with insurance carriers' systems. This includes implementing strong authentication measures and secure communication channels.

Third-Party Relationships

As third-party service providers to insurance companies, public adjusters should expect enhanced cybersecurity requirements and due diligence processes from their insurance company partners.

AI and Emerging Threat Considerations

The guidance's specific mention of AI model releases as potential triggers for heightened threat environments reflects growing concerns about AI-powered cyberattacks. These may include:

• Sophisticated phishing campaigns using AI-generated content
• Automated vulnerability discovery and exploitation
• Deepfake technology for social engineering attacks

Insurance companies and public adjusters must prepare for increasingly sophisticated attack vectors that leverage artificial intelligence capabilities.

Compliance and Legal Considerations

While the DFS guidance does not establish new legal requirements, it builds upon New York's comprehensive cybersecurity regulation. Failure to implement reasonable cybersecurity measures could still result in regulatory scrutiny, particularly following a security incident.

The guidance serves as a roadmap for what regulators consider appropriate responses to heightened threat environments, potentially influencing liability assessments in the event of cyber incidents.

Practical Implementation Steps

Organizations should consider the following immediate actions:

1. Risk Assessment: Evaluate current cybersecurity posture against DFS recommendations
2. Third-Party Review: Assess cybersecurity practices of key vendors and service providers
3. Staff Training: Enhance employee awareness of social engineering and AI-powered attacks
4. Incident Response: Update response plans to address AI-enhanced threats
5. Technology Evaluation: Review and potentially upgrade security tools and protocols

Industry-Wide Impact

This guidance reflects broader industry trends toward enhanced cybersecurity vigilance in financial services. According to Aon's 2025 Global Risk Management Survey, cyber risk remains the number one concern globally, with geopolitical volatility ranking among the top 10 business risks.

Insurance companies nationwide may adopt similar measures voluntarily, even outside New York's jurisdiction, as cybersecurity best practices continue to evolve across the industry.

How Louis Law Group Can Help

At Louis Law Group, we understand the complex intersection of cybersecurity, insurance law, and claims handling. Our experienced attorneys can help insurance companies, public adjusters, and policyholders navigate the evolving regulatory landscape while protecting their interests in cyber-related disputes.

Whether you need assistance with cybersecurity compliance, data breach response, or insurance coverage disputes arising from cyber incidents, our team is ready to provide expert legal guidance. Contact Louis Law Group today at (833) 657-4812 to discuss how we can help protect your organization in this heightened threat environment.

Source: Insurance Journal - New York Issues Cybersecurity Tips for a 'Heightened Threat' Climate With AI