Revealed: Vulnerabilities Persist in the Insurance Sector
Cybersecurity ratings company SecurityScorecard, has published the results of its research into the supply chain cybersecurity vulnerabilities of the insurance sector, highlighting several areas where security enhancements are necessary.
A survey of the top 150 global insurance companies, using breach data alongside SecurityScorecard's own ratings, forms the basis of this analysis. It reveals persistent challenges in five key areas: insurance carriers, reinsurance providers, agencies and brokers, third-party claims processors, and insurance-specific software and IT providers.
This study is significant in that it highlights a substantial 59% of breaches were caused by vulnerabilities originating from third-party vectors. SecurityScorecard's findings underscore a severe systemic issue within the industry's cyber defences.
Andrew Correll, SecurityScorecard’s Senior Director of Cyber Insurability, says: "Insurance companies’ reliance on technology to manage daily operations has outpaced their ability to secure it.
“Cyber risks don’t stop at the first layer of defence – they extend deep into the supply chain, where vulnerabilities are harder to detect and even harder to mitigate. Addressing these risks requires a shift in how the industry prioritises third-party security."
Insurance and supply chain vulnerability
The expansive networks of third-party vendors that insurers depend on for essential services like claims processing and data management are frequent sources of vulnerabilities. Given the insurance industry's role as custodians of vast amounts of sensitive client data, they are prime targets for data breaches, ransomware and fraud.
The continued use of outdated IT systems by some firms within the industry compounds the challenges. These legacy systems often lack robust contemporary security protections which, coupled with vendors' weaker security measures, presents opportunities for cybercriminals.
To navigate these complexities, insurance companies must establish rigorous risk assessment mechanisms and continuous monitoring practices to protect against the financial, operational and reputational damages that may arise from cyber attacks through their supply chains.
Security in the insurance sector
The industry's security posture, with an average security score on par with other sectors (86/88), might appear robust at first glance.
However, 28% of insurance companies have experienced breaches– twice as many as in the US energy sector (14%).
The primary weaknesses identified are in application security (40%), DNS health (29%), and network security (20%). Specifically, agencies, brokers, and IT and insurance-specific software providers scored lowest.
- Third-party breaches reach 59% (double the global average of 29%)
- Third-party software & IT caused 50% of these breaches
- Malware infections and device compromises affected 17% of companies
- 77% of companies earned A or B grades for security scores
- Highest breaches were found in the U.S industry overall
Insurance carriers and reinsurance brokers are amongst the most frequently breached, bearing witness to outsourced services and third-party processors as critical points of failure where sensitive data is jeopardised.
These scores amplify the risk and vulnerability to cyber attacks inherent in the industry.
Recommendations for cybersecurity enhancement
SecurityScorecard strongly advocates for a range of strategic initiatives aimed at boosting cybersecurity within the insurance sector. A key area of focus is the strengthening of Third-Party Risk Management (TPRM). By rigorously vetting partners and vendors with low security scores, particularly agencies, brokers, IT and software providers, and third-party claims processors, insurers can ensure adherence to regulatory standards, mitigate potential financial losses from security gaps and enhance operational continuity.
Adopting a firm policy against ransom payments is crucial. Paying ransoms could not only lead to legal complications but also encourages more attacks with no assurance of data recovery.
There’s also a marked emphasis on heightened TPRM, especially for the US and China, and ensuring external vendors deploy secure and robust TPRM programmes to safeguard sensitive customer information and mitigate financial and operational risks.
As the cybersecurity landscape continues to evolve, insurers need to adopt proactive measures to heighten resilience, uphold regulatory compliance, and secure sustainable operational stability.
Explore the latest edition of Cyber Magazine and be part of the conversation at our global conference series, Tech & AI LIVE and Cyber LIVE.
Discover all our upcoming events and secure your tickets today.
Cyber Magazine is a BizClik brand
