Industries
Cyber security for insurance & nbfc.
Insurers, brokers and non-banking financial companies under IRDAI and RBI digital lending rules.
What is actually going on here
Insurers hold an unusually complete picture of a person: health, finances, family, assets, sometimes driving behaviour. It is one of the richest datasets in commercial hands, and it is spread across core systems, a distribution network of agents and brokers, and an increasing number of third party platforms.
That distribution network is where most of our findings land. A portal built for agents, with weaker authentication than the customer channel because agents complained, reaching the same data. The security thinking that went into the customer app frequently did not reach it.
IRDAI expects governance and reporting, DPDP now adds consent and retention duties on top, and if you operate across markets you are reconciling several regimes at once.
Who regulates you, and what they want
Tick the ones that bind you and we will pull together the evidence each of them actually asks for. Nothing is sent anywhere.
Pick one or more above to see what they expect of you.
What goes wrong in this sector
Policyholder data exposure
Health declarations, financial details and nominee information in one record. The usual route in is a reporting interface or an analytics copy of the database with none of the production controls around it.
Agent and broker portal compromise
Shared logins, credentials that outlive the relationship, and access that is never reviewed when an agent leaves. We routinely find active accounts belonging to people who moved on years ago.
Claims fraud through business logic
Not a technical vulnerability but a design one: workflows that can be replayed, approval thresholds that can be avoided by splitting a claim, or document checks that trust client supplied metadata.
Third party administrator risk
TPAs and health service providers hold your policyholder data under your obligation. Their breach is your notification duty, and their security is usually assessed once at onboarding and never again.
How we work in this sector
- 01
Follow the data outward
We map policyholder data from core systems out through agents, brokers, TPAs and analytics copies. The copies are where it usually goes wrong.
- 02
Test the distribution channel properly
Agent and broker portals get the same testing depth as the customer channel, because attackers pick the weaker of the two and it is rarely the customer one.
- 03
Attack the workflow
Claims and underwriting logic is tested for abuse, not just for technical vulnerabilities. Splitting, replaying and racing a claim are all things we try.
- 04
Assess the third parties that matter
We assess the TPAs actually holding your data rather than sending everyone a questionnaire, so the effort lands where the exposure is.
What we actually keep finding here
Not a threat list copied from a report. These are the patterns that recur across our own engagements in this sector, with an honest note on how often. Where we do not have a precise number we say so rather than inventing one.
- Most engagements
The agent portal is weaker than the customer app
Built later, with authentication relaxed because agents complained, reaching exactly the same policyholder data. Attackers pick the weaker of the two and it is rarely the customer one.
- Almost every engagement
Agent accounts that outlive the relationship
Active logins belonging to people who moved on years ago, because the leaver process covers employees and not the distribution network.
- Often
Claims workflows that can be replayed or split
Not a technical vulnerability but a design one: approval thresholds avoided by splitting a claim, or a submission that can be repeated.
- Most engagements
TPAs assessed once at onboarding and never again
They hold your policyholder data under your obligation, and their breach is your notification duty.
Questions worth asking any provider in this sector
Including us. If a provider cannot answer these clearly, that tells you more than any capability slide will. We would rather you asked them than took our word for it.
- 1
Will the agent and broker portals get the same testing depth as the customer channel?
- 2
Will you test claims and underwriting workflows for abuse, not just for injection?
- 3
Will you assess the TPAs actually holding our data, or send everyone a questionnaire?
- 4
How will you reconcile IRDAI and DPDP obligations into one control set?
- 5
Can you deliver across our overseas operations without running a separate programme per market?
What we deliver in this sector
- IRDAI information & cyber security audit
- DL-SAR digital lending self assessment
- Policy administration platform testing
- Claims fraud and data integrity review
- Customer data privacy & DPDP readiness
- Third party and aggregator risk
- Cloud security posture assessment
- Incident response retainer
Work in this sector
Named engagements where the client has agreed to be named, and anonymised ones where they have not, which is most of them. Named references are available under NDA.
- Client withheld
Health insurer, claims workflow abuse
- Scope
- Claims submission and approval tested for logic abuse rather than only for injection.
- What we found
- Approval thresholds could be avoided by splitting a claim, and a submission could be replayed.
- Outcome
- Workflow reworked with server side threshold checks and idempotency on submission.
- Client withheld
Life insurer, distribution channel review
- Scope
- Customer app and the agent portal assessed to the same depth, which is unusual and was the point.
- What we found
- The agent portal reached the same policyholder data with materially weaker authentication.
- Outcome
- Risk based step-up authentication introduced on the agent channel without a measurable drop in usage.
- Client withheld
General insurer, TPA exposure
- Scope
- Third party administrators holding policyholder data under the insurer's obligation.
- What we found
- Active accounts belonging to agents who had left, and one TPA assessed once at onboarding four years earlier.
- Outcome
- Leaver process extended to the distribution network, and TPA reassessment put on an annual cycle.
Questions we get asked in this sector
Does DPDP change how long we can keep policy data?
Yes, and this is the obligation most insurers underestimate. Retention has to be tied to a stated purpose. Regulatory retention gives you a lawful basis for a defined period, but holding everything indefinitely because the policy administration system has no deletion routine is not defensible.
Our agents resist stronger authentication. What is realistic?
Risk based authentication usually settles this. Step up only on unusual access, high value operations or bulk data views, rather than adding friction to every login. The failure mode we see is giving up entirely because the first attempt was unpopular.
How do we handle a TPA breach?
Your notification duty stands regardless of whose systems failed, so the contract has to require prompt notice to you and the incident plan has to include them. Most plans we review do not name a single third party.
Can you assess across our overseas operations?
Yes. We deliver across fifteen or more countries and reconcile the overlapping obligations into one control set rather than running a separate programme per market.
Not sure where to start?
Book a 30-minute call with a senior engineer. We will walk through your current posture, the frameworks that bind you, and what a realistic programme looks like.