Newsletters
Risk Central
Digital EditionInsurance Industry Faces Rising Third-Party Cybersecurity Risks
A comprehensive study of 150 insurance-related companies reveals significant cybersecurity vulnerabilities in the industry’s supply chain, with 59% of reported breaches involving third parties and 23% of firms showing concerning security weaknesses, according to an analysis by SecurityScorecard.
The insurance industry’s cybersecurity landscape presents a complex picture, with both strengths and areas of concern, according to the report. On average, the insurance sector maintains a security score of 86 out of 100, placing it on par with other critical industries such as energy and aviation. This performance is encouraging, as it surpasses the global mean of 83 across more than 12 million organizations, according to SecurityScorecard.
A closer look at individual company ratings reveals that 77% of the 150 insurance firms analyzed boast strong or good security postures. However, this leaves a significant 23% with concerning weaknesses.
“Our analysis of the insurance industry’s security posture offers a mixed picture. Average security scores match those of other industries, yet 23% of companies have unsatisfactory ratings, which raises concerns,” the report noted.
Security Performance by Industry Segment
Within the insurance sector, a clear three-tier hierarchy has emerged in terms of cybersecurity performance, SecurityScorecard found. At the top tier, insurance carriers and reinsurers lead with impressive mean/median scores of 89/90 and 86/89, respectively. The middle tier consists of third-party claims administrators, scoring 86/88. At the bottom tier, agencies/brokers and insurance IT providers both score 83/85.
This stratification appears to correlate strongly with regulatory scrutiny, according to SecurityScorecard. Insurers and reinsurers, subject to stringent oversight and solvency requirements, demonstrate more mature cyber security practices. Their position at the core of the industry, coupled with the financial risks they manage, likely fosters a stronger risk management culture, the report’s authors reason.
In contrast, agencies, brokers, and IT providers face less regulatory pressure, which may contribute to their lower security scores. These segments often have larger attack surfaces due to their customer-facing nature or complex IT environments, potentially increasing their vulnerability to cyber threats, the report noted.
Geographic Variations
Cybersecurity performance in the insurance industry shows notable regional differences. Companies in the Americas and EMEA (Europe, Middle East, and Africa) regions demonstrate stronger security postures compared to their counterparts in APAC (Asia-Pacific). The Americas boast a mean/median score of 86/88, while EMEA closely follows with 87/87 and APAC lags behind with 84/85.
Within APAC region, the security ratings varied widely. For example, Australian companies ranked 92/90, Indian companies ranked 90/90, Japanese companies ranked 88/88 and Chinese firms ranked 79/79, the report noted.
“Chinese businesses already pose inherent third-party cyber risk due to Chinese government-sponsored cyber espionage. Now these lower security scores add another layer of concern for foreign partners,” SecurityScorecard stated. “The weaker security postures of Chinese insurance firms could unwittingly expose their overseas counterparts to third-party breaches and network compromises.”
Growing Third-Party Risk Challenge
The insurance industry is facing a mounting cybersecurity challenge, with a significant number of companies falling victim to data breaches. Recent industry analysis reveals that 28% of insurance-related companies experienced at least one publicly reported breach. This translates to 42 out of 150 top companies worldwide, highlighting the pervasive nature of the threat.
More alarming is the frequency of multiple breach incidents. Of the affected companies, 12 experienced two or more breaches, indicating persistent vulnerabilities or targeted attacks. One company even reported six separate breach incidents, underscoring the relentless nature of cyber threats in the sector, the report noted.
Perhaps the most concerning trend is the prevalence of third-party involvement in these breaches. A staggering 59% of all reported breaches involved third parties, either compromising another organization’s infrastructure or data, or reaching the target via a vendor or another third party. This rate surpasses that of any other industry analyzed, including top U.S. federal contractors, and far exceeds the global cross-industry baseline of 29%.
Insurance carriers, which typically maintain higher security scores, were disproportionately affected by third-party breaches. While carriers comprised about 27% of the total sample, they represented 50% of the companies hit by third-party incidents, SecurityScorecard noted.
“Ransomware is the top threat to the insurance industry, exceeding its dominance in most other sectors. Every attack tied to a known threat actor involved ransomware,” the report stated.
View the full report here. &
