- Home
- Industries
- Insurance
Secure your own house,
and your policyholders' worst day.
Insurers and brokers hold some of the most detailed personal and financial data in any market, and answer to central banks and insurance supervisors across the region. Cyber insurers also need a responder who documents everything. We do both, around the clock.
Where insurers and brokers get hit.
Rich data, many intermediaries and payments that move on instruction.
Policyholder data theft
Claims files hold health, financial and identity records in one place. Attackers steal them for extortion and fraud, often before any encryption.
Ransomware and extortion
Operators know an insurer cannot stop paying claims or quoting business. They target core policy and claims systems for maximum pressure.
Claims and payment fraud
Attackers take over adjuster, broker or vendor mailboxes and redirect claim payments or commission transfers.
Broker and agency networks
Brokers and managing general agents connect to carrier portals with varied security. One weak intermediary can open a path to the carrier.
Third-party and cloud platforms
Policy administration, claims and rating platforms often run with vendors. Regulators expect you to manage that risk, not outsource it.
AI in underwriting and claims
Models and AI agents now touch policyholder data and decisions. Unmonitored, they can leak data or be manipulated.
The frameworks you report against.
GCC insurance supervisors first, then Singapore, then data protection law, then the US rule that applies when you write business there.
| Framework | Who it applies to | What we help with |
|---|---|---|
| Central Bank of the UAE (CBUAE) requirements | Insurers and insurance brokers supervised by the CBUAE | Gap assessment, 24/7 detection and response, and the testing evidence examiners ask for |
| SAMA Cyber Security Framework | Insurers in Saudi Arabia within the framework's scope | Maturity assessment against the framework, remediation planning and monitoring evidence |
| Qatar Central Bank (QCB) requirements | Insurers supervised by QCB | Programme assessment, detection and response, and incident facts for timely reporting |
| Central Bank of Bahrain (CBB) rulebook | Insurance licensees of the CBB | Mapping your programme to the rulebook and building the evidence for inspections |
| MAS Technology Risk Management (TRM) Guidelines | Insurers regulated by the Monetary Authority of Singapore | TRM gap assessment, penetration testing and incident handling support |
| UAE PDPL, DIFC and ADGM data protection, Saudi PDPL and Qatar Law No. 13 of 2016 | Insurers and brokers handling policyholder personal data | Breach investigation, impact assessment support and documented incident records |
| NYDFS Cybersecurity Regulation (23 NYCRR Part 500) | Insurers licensed in New York | Risk assessment, penetration testing, incident response planning and the evidence for annual certification |
Working alongside insurers on claims.
Incident response for policyholders
When a policyholder is hit, we contain, investigate and recover, and coordinate with the insurer and breach coach from the first call.
Claim-ready evidence
Evidence preserved to forensic standard, with a documented timeline of containment, remediation and recovery that adjusters and counsel can rely on.
Underwriting and renewal support
We help applicants answer security questionnaires accurately and close the control gaps behind a refusal. See cyber insurance support.
How we help insurers and brokers.
MSOC
An autonomous SOC that detects and contains threats in under two minutes, around the clock, with senior analysts on top.
Learn more →Incident response
NIST-aligned response for your own environment or your policyholders', with evidence handled to a court standard from the first call.
Learn more →Cyber insurance support
Accurate questionnaires, closed control gaps and, after an incident, the forensic evidence and timeline a claim needs.
Learn more →ForsetiGRC & compliance
Ongoing control management and evidence for the CBUAE, SAMA, MAS and the other regulators you answer to, kept current between reviews.
Learn more →Supply chain & third-party risk
A vendor programme aligned to your regulator's outsourcing expectations: tiering, technical assessment and monitoring of critical suppliers and intermediaries.
Learn more →BifrostDigital forensics
What was taken, by whom and when, documented to a standard insurers, regulators and courts accept.
Learn more →What buyers ask.
We are a cyber insurer. Can you respond for our policyholders?
Yes. We work alongside insurers and breach coaches on claims: senior responders contain and investigate, and every action is documented so the claim has the evidence and timeline it needs.
Will you negotiate with attackers on a ransomware claim?
Yes, when it helps. Our responders negotiate with threat actors after identification and sanctions screening, to buy time, gather intelligence and protect options while we contain and recover. We never recommend paying a ransom.
Can you help us prepare for a regulatory review?
Yes. We assess you against CBUAE requirements, the SAMA Cyber Security Framework, MAS TRM or whichever regime applies, close the gaps with you, and keep the evidence current through Forseti so the next review is not a scramble.
Where does policyholder data live?
We deploy to meet each client's data-residency requirements, including in-country where regulation requires it, and we operate to the group's SOC 2 Type II controls.
Talk to someone who knows insurance.
Put a specialist on a call to scope monitoring, regulatory readiness or claims response. No charge, no commitment.