Insurance is a highly regulated sector, not just by individual countries but by regional rules in the USA, Gibraltar, EU, MENA etc. But compliance should never restrict the daily operations of insurance brands so much that customers are frustrated by obscure jargon, constant ID checks, repeated statements and more. How do we find the right balance point?
Then there are the recent cyber issues, outages and other problems associated with online businesses, of all sizes. If customers find they cannot open an insurance app when they need it, during a Claims process for example, then your brand reputation suffers.
Here are some industry sector thoughts and insights;
These comments are by Zac Warren, Chief Security Advisor, at Tanium
Reputation Management: Costs to mitigate damage to your business’s reputation
“When organisations fall victim to a cyberattack or ransomware incident, the financial hit is immediate, but the reputational fallout can be far more damaging. Customers, partners, and regulators judge companies on their ability to protect data, and once that trust is broken, rebuilding it can take years. The 2025 NetDiligence Cyber Claims Study highlights that reputational harm and customer churn consistently rank among the largest drivers of post-incident losses, often surpassing the attack itself. A 2025 stock market analysis following a cyberattack found that breach disclosures are typically followed by significant negative stock price reactions, in some cases wiping billions from market capitalisation and eroding long-term customer trust. For insurers, this presents a complex and growing challenge: the costs of repairing brand damage often dwarf the lost revenue from downtime.
“We are increasingly seeing businesses commit millions to crisis communications campaigns, additional marketing, customer redress schemes, and investor reassurance initiatives in the aftermath of an attack. On top of this, insurers may be asked to support legal fees, regulatory fines, and compensation packages. Unlike traditional property damage, reputational loss is hard to quantify, and recovery is unpredictable. Organisations can only build the confidence to withstand and recover from an incident when they have full visibility into their digital estate, clear lines of accountability, and the ability to act at speed when threats emerge.
“For the insurance sector, the implication is clear: underwriting cyber risk cannot just focus on technical controls or direct financial exposures. Reputation must be treated as a critical asset. That means understanding how quickly and transparently a client can communicate during a crisis, the maturity of their incident response and PR planning, and whether leadership is prepared to act decisively under pressure. Insurers also need to recognise that they are not immune – they hold sensitive client and policyholder data, making them attractive targets for attackers. Achieving resilience in this environment requires investment in automation to shorten response times and strengthen consistency, alongside robust crisis communication plans to maintain stakeholder trust. In the digital economy, reputation is both a company’s greatest strength and its most fragile liability, and insurers will increasingly find themselves on the front line of managing, and personally experiencing, that risk.”
USING DATA EFFECTIVELY IS KEY
Francis Martin, CEO of The Insurance Emporium, offers these insights;
In the dynamic landscape of the UK insurance sector, data is undeniably the driving force behind innovation and transformation. The industry’s ability to manage and utilise data effectively has evolved significantly, reshaping the way insurers operate and interact with policyholders.
The FCA’s Consumer Duty regulation, which was introduced at the end of July this year [for new and existing products or services that are open to sale or renewal], is just one example of how vital it is for insurers to use data effectively. With the core principle being that firms must act to deliver good outcomes for customers, it is important insurers harness their data analytics to revolutionise their core processes from more accurate pricing, to understanding each and every customer’s needs and supporting them effectively.
While insurers will use data in a multitude of ways to help inform business decisions, customer outcomes are likely to rise on the list of priorities. Therefore, customer outcomes will now need to become another data set included in a firm’s data strategy, which should be reviewed frequently to help identify potential risks. By understanding the root cause of these issues, a business can then adapt their products, services and even their operations to ensure they provide customers with an effective and timely response.
On the flipside, what may become apparent during this newly engineered data process, is that a firm’s data set is poor, for instance it may be incomplete or inaccurate. If this data is imperative to monitoring and driving customer outcomes, it is essential for businesses to review their methods of collection to reduce these inconsistencies moving forward.
In conclusion, the UK’s insurance sector is undeniably embracing the power of data and reshaping the industry’s landscape. While great strides have been made, the sector must remain vigilant in addressing data-related challenges to continue its trajectory towards greater efficiency and customer-centricity.
COMPLIANCE IS COMPLEX, BUT PROGRESS CAN STILL BE MADE
Karli Kalpala, Head of Strategic Transformation & Financial Services Industry at Digital Workforce offers these insights on the complexities of compliance;
“In insurance, compliance cannot be an afterthought. Customer data is everything, and your security level should reflect how valuable you consider that data to be.
Compliance becomes critical with Agentic AI’s rise in insurance, with 20% of insurance organisations already piloting initial use cases of AI agents. However, poor data quality undermines AI performance – no amount of processing power can compensate for inadequate foundations. AI initiatives require rigid guardrails to prevent violations of data and privacy regulations. Customer satisfaction depends on service quality and how secure they feel sharing sensitive information, from financial data to medical histories used in risk profiling. Given the FCA’s oversight and the sector’s risk aversion, monetary and reputational harm presents too significant a threat – that’s why technology vendors must embed compliance from the outset.
Many insurers rely on legacy processes like spreadsheets, which carry tremendous compliance risk through human error and fragmented governance systems. This creates regulatory training gaps and a reactive, bolt-on approach to compliance rather than embedded protection.
CISOs and security leaders need to shift their mindset away from blocking progress and towards enabling it. Instead of saying no by default, the goal should be to find ways to move forward safely. Leading organisations are already making significant investments because they understand the disruptive potential of synthetic workers in the workplace. This inevitably involves higher operational spending through the investment cycle, but choosing not to invest is a decision to fall behind those who do.
Many still focus narrowly on the risks of chat-based systems and adversarial testing, often overlooking the wider opportunity. The same AI capabilities that create compliance concerns can also strengthen oversight across every part of an organisation. They can be used to assess risk, confirm compliance with regulations, and ensure that industry and marketplace requirements, such as those of Lloyd’s, are met at scale. When applied in this way, compliance becomes a driver of progress rather than a barrier to it.
To build compliance into platforms, you should act as if a breach has already occurred, making the changes now that would prevent it from happening again. These should include, but are not limited to, partnering with specialists who understand insurance systems integration, using threat modelling to identify risks early, and implementing strict access controls. Additionally, adopting zero-trust architectures that require continuous verification of every transaction and user, integrating AI-driven anomaly detection for fraud prevention, ensuring comprehensive audit trails across both Agentic AI workers and staff, and maintaining continuous code reviews with testing are essential.”
Be the first to comment