A new 2026 Nationwide survey reveals that nearly one-third of small and mid-market business owners have been targeted by a scam or fraud attempt using generative AI in the past year. The findings underscore a critical disconnect: while AI tools become ubiquitous in the workplace, cybersecurity practices and policies are not keeping pace, leaving businesses exposed to evolving threats.
The survey found that six in ten business owners say employees are using public AI chatbots or writing tools for work-related tasks. Yet only 36% have written policies governing employee AI use, and just 37% provide training on responsible use. This lack of oversight creates significant risk, as employees may inadvertently share sensitive information or fall victim to AI-generated phishing and impersonation attempts. More than a third of business owners (35%) believe employees are using unauthorized AI tools for work, further compounding the danger.
The threat is not just internal. Nearly one-third (31%) of surveyed businesses reported being targeted by AI-enabled scams in the previous 12 months. These attacks can be highly convincing, often mimicking trusted contacts or brands. "AI has become incredibly accessible, both to legitimate businesses and to the people trying to exploit them," said Tim Derham of Inter Insurance Agency. "An employee can receive an email, phone call or even convincing content that appears to come from someone they trust. Businesses need to think about what happens before an attack, but also what happens afterward."
Compounding the issue, only 35% of business owners have an up-to-date incident response plan. Without a clear plan, businesses may struggle to contain a breach, notify affected parties, and recover operations swiftly. Cyber insurance can be an important component of a broader risk-management strategy. Depending on the policy, coverage may help address expenses associated with data breaches, cyberattacks, business interruption, recovery efforts, and certain liabilities resulting from a cyber incident.
However, insurance alone is not enough. Inter Insurance Agency encourages businesses to establish clear policies regarding AI use, train employees to recognize phishing and impersonation attempts, control access to sensitive information, and maintain an incident-response plan. Regularly reviewing cyber insurance as operations and technology change is also essential. "The way companies work is changing extremely quickly," Derham added. "Your risk management and insurance shouldn't be based on what your business looked like three or four years ago."
The implications are clear: as AI adoption accelerates, businesses must proactively address the associated risks. The survey, conducted by Edelman Intelligence from July 10-26, 2026, highlights that without updated policies, training, and insurance, companies of all sizes remain vulnerable to increasingly sophisticated AI-driven fraud. Taking action now can help mitigate potential financial and reputational damage.
