Resources Categories
INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES
Applicable Cybersecurity Services and Codec Networks Bundles for Intermediaries
How Codec Networks services and bundled service models help insurance intermediaries and insurtechs resolve their threats, comply with IRDAI's 2026 guidelines and satisfy insurer partners.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Intermediaries need assurance that satisfies IRDAI and every insurer they work with. Codec Networks works on four principles:
- Align to IRDAI 2026: map every engagement to the 2026 guidelines, CERT-In and DPDP.
- Test the journey: cover leads, onboarding, insurer APIs, payments, servicing and claims end to end.
- Think like an insurer: produce evidence that answers partner due-diligence questions.
- Prove closure: close audit gaps and track remediation to completion.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Customer data leakage |
DPDPA readiness, data minimisation, DLP |
Protected customer data |
|
Broken API authorisation |
API security testing, code review |
APIs that return only the right data |
|
Health and claims data exposure |
Claims platform testing, classification and encryption review |
Protected medical data |
|
Phishing and impersonation |
Brand monitoring, takedown, awareness |
Faster removal of fakes |
|
Account takeover |
Portal and app testing, authentication review |
Stronger account security |
|
Premium and payment diversion |
Payment-flow testing, call-back controls review |
Protected premiums |
|
BEC |
BEC simulation, email security and DMARC review |
Reduced payment fraud |
|
Ransomware |
Ransomware simulation, backup testing, EDR/XDR validation |
Tested recovery |
|
Distributor credential theft |
Access reviews, MFA and device controls, monitoring |
Accountable distributor access |
|
Insider misuse |
Insider simulation, download monitoring |
Visible misuse |
|
Lead-data scraping |
Bot and abuse testing, rate-limit review |
Protected lead data |
|
Cloud misconfiguration |
Review against IRDAI cloud requirements, posture monitoring |
Compliant cloud use |
|
Claims and document fraud |
Upload and document controls testing, forensic investigation |
Lower claims leakage |
|
Third-party and SaaS compromise |
Vendor risk management, contract review |
Enforceable vendor controls |
|
AI assistant misuse |
AI/LLM security testing and governance |
Safe AI deployment |
|
Weak detection and response |
Managed SOC, playbooks, tabletop exercises |
Reliable 6-hour reporting |
|
Unpatched internet-facing systems |
Six-monthly external PT, infrastructure VAPT |
Reduced initial access |
|
Recovery failure |
BCP/DR drills on real scenarios |
Proven recovery |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
Six-monthly grey/white-box external PT by a CERT-In empanelled auditor; web, mobile, portal and API testing; infrastructure and cloud testing |
|
Information security audit & compliance |
Cyber audits and gap assessments against IRDAI's 2026 guidelines, compliance reports, ISO/IEC 27001:2022, insurer due-diligence evidence |
|
Offensive security & simulation |
Phishing, BEC, ransomware and insider simulations, red teaming, tabletop exercises |
|
Data privacy & protection |
DPDPA readiness, consent and data minimisation, classification, encryption and DLP reviews, breach response |
|
24/7 Managed SOC & threat monitoring |
SOC-as-a-Service, SIEM, EDR/XDR, API abuse and fraud signals, brand monitoring |
|
Cyber forensics |
Incident triage, claims and insider investigations, root-cause analysis |
|
Third-party risk management |
Cloud, SaaS, KYC and payment vendor assessments; contract reviews |
|
Cloud security |
Review against IRDAI cloud requirements, CSP terms, posture and IAM reviews |
|
Emerging technology security |
AI chatbot and LLM security testing and governance |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to intermediaries and insurtechs; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
Six-monthly external PT, retest and closure |
All intermediaries |
PT reports and closure tracker |
|
B2 |
Application, API & DevSecOps Security Program |
Web, app, portal and API testing, secure SDLC |
Aggregators, TPAs and insurtechs |
Application and API risk report |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
IRDAI cloud requirements, segmentation, IAM |
Cloud-native platforms |
Cloud review report |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
Cyber audit and compliance report under IRDAI 2026 |
All intermediaries |
Audit report, gap matrix, evidence index |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
ISO 27001, policies, insurer due-diligence packs |
Intermediaries with many insurer partners |
Maturity scorecard, evidence pack |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Customer and health data protection, DLP |
All intermediaries ahead of May 2027 |
Privacy gap assessment |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
24x7 SOC with API abuse and fraud signals |
Intermediaries needing continuous monitoring |
SOC reports, MTTD/MTTR |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
Incident response and investigations |
Any intermediary facing compromise or fraud |
Forensic report and RCA |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
Cloud, SaaS, KYC and payment vendor assessments |
Intermediaries reliant on vendors |
Vendor risk assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Phishing, BEC, ransomware and BCP/DR exercises |
Leadership, finance, claims and operations |
Exercise reports |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
AI/LLM testing and governance |
Insurtechs and aggregators using AI |
AI risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six intermediary programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
IRDAI 2026 Audit Programme |
B4, B1, B5 |
Audit, compliance report and testing obligations |
|
API & Platform Security |
B2, B7 |
API exposure, account takeover and scraping |
|
Claims Platform Assurance |
B2, B8, B10 |
TPA platforms, ransomware and claims fraud |
|
Premium & Payment Protection |
B10, B7 |
BEC and premium diversion |
|
Vendor & Cloud Risk |
B9, B3 |
Cloud, SaaS and KYC vendors |
|
Customer Data Protection |
B6, B11 |
DPDP readiness and AI data risks |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical intermediary |
Smaller brokers and corporate agents |
Aggregators, TPAs and growing platforms |
Large intermediaries and insurtechs |
|
Testing |
B1: six-monthly external PT |
B1 + B2: PT, app, API and claims testing |
B1 + B2 + B10: red teaming and simulations |
|
Audit and GRC |
B4: audit and compliance report |
B4 + B5: audit, insurer evidence packs |
B4 + B5 + B9: audit, vendor assurance |
|
Cloud and privacy |
B6: privacy readiness |
B3 + B6: cloud and DPDPA readiness |
B3 + B6 + B11: continuous assurance, AI governance |
|
Monitoring and response |
IR retainer (B8) |
B7: managed SOC + B8 |
B7: SOC with API abuse signals + B8 |
|
Reporting |
Compliance checklist |
Management and insurer reporting |
Board and insurer reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (IRDAI 2026 guidelines, as reported) |
How Codec Networks helps |
Bundle |
|
Cyber security audit by a CERT-In empanelled auditor |
Audit by Codec Networks as a CERT-In empanelled auditor |
B4 |
|
Compliance report within 30 days of audit completion |
Report preparation and evidence index |
B4 |
|
External PT at least six-monthly, grey/white box, CERT-In empanelled auditor |
Scheduled external PT with retest |
B1 |
|
Incidents to CERT-In within six hours |
IR retainer, playbooks, reporting support |
B7, B8 |
|
MeitY-empanelled CSPs with STQC audit status; data erasure on exit |
Cloud review |
B3 |
|
Vendor right-to-audit, sub-outsourcing approval, supervised privileged access |
Vendor risk programme and contract review |
B9 |
|
DPDP measures, personal data classification, encryption |
DPDPA programme, classification and DLP review |
B6 |
|
Security of customer-facing platforms and APIs |
Application and API security testing |
B2 |
|
Auditor eligibility and independence IRDAI's 2026 guidelines, as reported, require intermediaries' audits and external penetration testing to be performed by CERT-In empanelled auditors. Codec Networks is CERT-In empanelled and confirms eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Customer data leakage |
B6 |
B2 |
|
Broken API authorisation |
B2 |
B7 |
|
Health and claims data |
B2 |
B6 |
|
Phishing and impersonation |
B7 |
B10 |
|
Account takeover |
B2 |
B7 |
|
Premium diversion |
B10 |
B7 |
|
BEC |
B10 |
B7 |
|
Ransomware |
B7 |
B8, B10 |
|
Distributor credential theft |
B2 |
B7 |
|
Insider misuse |
B7 |
B8 |
|
Lead-data scraping |
B2 |
B7 |
|
Cloud misconfiguration |
B3 |
B7 |
|
Claims and document fraud |
B8 |
B2 |
|
Third-party compromise |
B9 |
B3 |
|
AI assistant misuse |
B11 |
B2 |
|
Weak detection |
B7 |
B8 |
|
Unpatched systems |
B1 |
B3 |
|
Recovery failure |
B10 |
B1 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include an IRDAI cyber audit report and compliance report, a gap matrix against the 2026 guidelines, external PT and API test reports with retests, an insurer due-diligence evidence pack, a privacy assessment, a cloud review and a vendor risk register.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Intermediary depth: quote, issuance, payment, distributor and claims platforms tested the way attackers use them, aligned to IRDAI's 2026 guidelines.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.