In the 1680s, a coffee house on Tower Street in London became the place ship owners went to find someone who'd bet on their cargo arriving.
That coffee house was Lloyd's. It became the insurance market that still bears the name. Insurance didn't create shipping. It showed up when shipping got common enough, and dangerous enough, that people needed to share the risk.
That's the pattern. First the risk becomes routine. Then the market prices it.
What's the pattern?
Cyber insurance ran the same script. Almost nobody had it in 2005. By the mid-2010s, after a decade of breaches, it was a normal line item. Then ransomware exploded, losses spiked, and insurers reacted the way they always do: raised prices, tightened terms, and started demanding proof that you'd done the basics. Multifactor authentication became a condition of coverage.
Deepfakes are now at the 2015 stage of that curve. The Arup case in early 2024, where a finance employee wired about $25 million after a video call full of fake colleagues, was the moment it stopped being a novelty. Insurers noticed. Some policies now name deepfake-enabled fraud. Many still exclude it, or fold it into social engineering coverage with low limits.
Here's what I expect. Within a few years, the question insurers ask won't be whether you have deepfake detection software. It'll be whether your people are trained to verify. Just as they now ask about multifactor authentication. The human pause will become a condition of coverage.
What should leaders do now?
So, three things.
Read your policy for the words "social engineering" and "voluntary transfer." That's where deepfake losses land, and where the limits are usually smallest.
Document your verification rule. A written policy that any request to move money is confirmed on a second channel is both your best defense and your best evidence.
And train it, then log the training. Insurers underwrite what they can see. A record of people practicing the pause is worth more than any detector.
Lloyd's started in a coffee house because ships kept sinking. This market is starting because faces can be faked. The response is the same: share the risk, and prove you did the basics.
Does your policy cover the day someone with your CFO's face asks for a wire?
Related: Is perception the new battlefield?
More like this on LinkedIn. Follow @samradofficial
