Resources Categories
INDUSTRY FACT FILE · INSURANCE
Market Landscape and the Drivers of Cybersecurity Demand in Insurance
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for insurers and reinsurers.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: IRDAI 2026 guidelines 5. Legal and statutory drivers 6. How the drivers differ by insurer type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's insurance market spans large public-sector insurers, fast-growing private insurers, specialised health insurers and global reinsurers. Digital distribution, cashless claims and government health and crop schemes have expanded the volume of sensitive data insurers hold—while IRDAI's revised 2026 guidelines raise the bar for governance, testing and assurance.
|
6 Apr 2026 IRDAI's revised guidelines issued |
FY 2026-27 Compliance required from the current financial year |
3 years Maximum term before rotating the independent auditor |
6 hours Incident reporting to CERT-In, copies to IRDAI |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large public and private insurers |
Large customer bases, legacy and modern systems, many partners |
Independent audits, PT, SOC, red teaming, partner assurance |
|
Mid-sized and new insurers |
Digital-first, lean teams, rapid growth |
Gap assessments, managed SOC, application and cloud testing |
|
Health insurers |
Large medical datasets, TPA and hospital networks |
Health data protection, TPA assurance, ransomware resilience |
|
Reinsurers and FRBs |
Fewer customers, highly confidential data |
Email and BEC protection, data protection, comply-or-explain documentation |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Regulatory compliance |
IRDAI 2026 guidelines, annual audits and reporting timelines |
Gap assessments, audit support, PT |
|
Policyholder trust |
Data breaches and scams damage reputation |
Privacy programmes, brand monitoring |
|
Claims leakage and fraud |
Forged documents and organised claims fraud |
Fraud analytics, forensic investigations |
|
Business continuity |
Ransomware or outages halt claims and servicing |
Resilience testing, BCP/DR drills |
|
Partner ecosystem growth |
More banks, brokers, aggregators and TPAs integrate |
Partner and API assurance |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Digital issuance and portals |
Account takeover and application flaws |
Application testing and external PT |
|
Partner APIs |
Data exposure through brokers, banks and TPAs |
API security testing and partner assessments |
|
Cloud adoption |
Misconfiguration and CSP requirements |
Cloud reviews against IRDAI requirements |
|
Legacy policy systems |
Patching gaps and weak segmentation |
Infrastructure VAPT and segmentation reviews |
|
AI and analytics |
Model abuse and data leakage |
AI security testing and governance |
Figure 3: The four groups of drivers behind cybersecurity spending in insurance.
4. Regulatory drivers: IRDAI 2026 guidelines
|
Area |
Key requirements (as reported) |
|
Scope and timing |
Issued on 6 April 2026, replacing the 2023 guidelines; compliance required from the current financial year Applies to insurers, FRBs (comply or explain) and intermediaries; insurers ensure a minimum framework for agents, POSPs and individual surveyors |
|
Governance |
ISRMC at least quarterly; independent CISO; tiered approval of exceptions up to the Board for those beyond one year |
|
Assurance |
Annual audit by an independent assurance team, presented to the Audit Committee, Risk Management Committee or Board; auditor rotation every three years Audit reports to IRDAI within 90 days of financial year-end or 30 days of audit completion, whichever is earlier |
|
Testing |
External penetration testing at least every six months, grey-box or white-box, by a CERT-In empanelled auditor |
|
Incidents and continuity |
Incidents to CERT-In within six hours of detection, with copies to IRDAI and other regulators BCP/DR tested at least annually against realistic scenarios |
|
Data, cloud and vendors |
DPDP-aligned technical and organisational measures; four-tier classification with PII flagged; encryption of confidential data in transit and on removable media MeitY-empanelled CSPs with STQC audit status; NDAs and data erasure on exit Right-to-audit and sub-outsourcing approval in vendor contracts; supervised privileged access for vendors |
|
Confirm against the circular These requirements summarise the 2026 guidelines as reported in public sources. Insurers should confirm details and timelines against the official IRDAI circular. |
Figure 4: Regulatory timeline for insurance cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Insurance Act, 1938 and IRDA Act, 1999 |
Basis for IRDAI regulation |
Regulatory audits and supervisory responses |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
6-hour reporting; ICT logs for 180 days in India |
Logging, incident readiness, SOC |
|
DPDP Act, 2023 and Rules, 2025 |
Health and personal data; most obligations from May 2027 |
Classification, safeguards, consent, breach workflows |
|
Prevention of Money Laundering Act, 2002 |
Reporting obligations for life insurers |
KYC and transaction monitoring reviews |
|
Contracts |
Reinsurance, bancassurance, TPA, hospital and vendor agreements |
Partner assurance evidence and audits |
6. How the drivers differ by insurer type
|
Insurer type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Life insurers |
Policyholder trust, payout integrity |
Portals, legacy policy systems |
IRDAI 2026, PMLA, DPDP |
|
General insurers |
Claims efficiency, partner networks |
Claims platforms, survey apps |
IRDAI 2026, DPDP |
|
Health insurers |
Cashless experience, medical data |
TPA and hospital interfaces |
IRDAI 2026, DPDP (sensitive data) |
|
Reinsurers and FRBs |
Confidentiality, global standards |
Email, data exchange |
IRDAI 2026 (comply or explain for FRBs) |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Are we aligned to IRDAI's 2026 guidelines?” |
Gap assessment and remediation roadmap |
Annual reassessment and audit support |
|
“We need six-monthly external PT.” |
Grey/white-box PT by a CERT-In empanelled auditor |
Half-yearly testing calendar |
|
“We need 24x7 monitoring and 6-hour reporting.” |
Managed SOC and IR retainer |
Monitoring and response |
|
“Our TPAs and partners hold our data.” |
Third-party assurance programme |
Annual partner assessments |
|
“We must protect health data.” |
DPDPA and classification programme |
Periodic reviews and breach drills |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published or reported up to October 2026. It is not legal advice. Confirm obligations against the official IRDAI circular.