ZeroTrusted.ai
← All industries

Insurance and risk carriers

Underwriting, claims, broker, and policyholder risk operations.

Assess third-party controls, AI usage, exposed assets, claims workflows, and residual risk with repeatable evidence and portfolio-level reporting.

Sector problems

What this environment has to get right

  • Insurers hold policyholder, claims, and sometimes health data, which makes them both a target and a regulated entity.
  • Cyber underwriting often rests on a questionnaire instead of evidence of how controls perform.
  • State insurance departments, NYDFS, and EU regulators each set their own expectations.
  • Agents, brokers, TPAs, and other vendors extend the attack surface.

Regulations and frameworks

How AI SOAR supports the evidence, not the determination

Mappings help you collect and organize evidence. An assessor, examiner, auditor, or authorizing official still decides whether the obligation is met. The platform does not certify an organization or file a regulatory notice.

FrameworkWhat it asks forHow the platform helps
NAIC Insurance Data Security Model LawOfficial source ↗Model Law #668 expects a written information security program, a risk assessment, incident response, and notice to the commissioner in adopting states.The insurance evidence pack maps program, assessment, and incident records to the model law sections the state has adopted.
NYDFS Part 500Official source ↗New York-regulated insurers maintain a cybersecurity program, MFA, an asset inventory, and a 72-hour notice for qualifying events.Identity checks, inventory, and incident timelines track the program. People file the notice.
DORAOfficial source ↗EU insurers manage ICT risk, incident reporting, resilience testing, and third-party risk. DORA has applied since 17 January 2025.An insurance overlay, resilience exercises, and supplier records support the subsidiary's management body.
HIPAA for health plansHealth insurers and health plans protect PHI where HIPAA applies.Healthcare evidence workflows and PHI redaction cover those records, including in AI prompts.

Typical workflows

Illustrative missions, with a person still in control

These workflows show how documented capabilities apply. They are not customer case studies, and they do not describe a guaranteed outcome.

Evidence-based cyber underwriting

Problem
An applicant reports that MFA and patching are in place, and the underwriter cannot see whether that is true.
What the platform does
With the applicant's authorization, a passive external assessment organizes findings into the underwriting file.
Human approval
The applicant approves scope. The underwriter reviews results before a pricing decision.
Evidence
An underwriting report tied to findings and hashes, instead of unchecked answers.

Model Law #668 examination

Problem
A state examination asks for the risk assessment, the written program, and incident-response evidence.
What the platform does
Compliance workflows map controls, evidence, and incident records to the adopted sections.
Human approval
The CISO approves the set before it goes to the examiner.
Evidence
An examination package mapped to the model law.

A 72-hour NYDFS clock

Problem
Ransomware hits a claims system and the notification clock starts.
What the platform does
Response follows the customer's policy, and the incident record tracks the NYDFS timeline.
Human approval
Containment and every external notice are approved by people. The platform does not file the notice.
Evidence
An incident timeline, an action audit, and notification tracking.

Agent roles and workflows

third-party risk · claims workflow reviewer · AI governance · portfolio risk · remediation supervisor

Select the installed agents and test their models, tools, permissions, and connectors before authorizing the mission. The available catalog depends on your deployment and release.

Agent verification and testing →

Requirements in context

SOC 2 · ISO 27001 · NIST CSF · GLBA where applicable · state insurance requirements

Set applicability for your assets, jurisdictions, and system boundaries. Connect control owners, current policies, technical tests, exceptions, and review decisions.

Explore regulatory evidence workflows →

A practical route from scope to evidence

  1. 01

    Scope and connect

    Define the customer profile, authorized assets, and responsible owners. Underwriting, claims, broker, and policyholder risk operations.

  2. 02

    Test and investigate

    Use third-party risk, claims workflow reviewer, AI governance workflows with approved credentials and mission limits. Preserve source evidence and failures alongside findings.

  3. 03

    Remediate and verify

    Assign corrective work, obtain approvals, capture changes, and retest. Export the evidence, exceptions, and status history for business owners and assessors.

Questions for this sector

Answers you can take to a scoping call

Does it support the NAIC Insurance Data Security Model Law?+

Yes. The insurance pack maps evidence to Model Law #668 in jurisdictions that have adopted it, and it can include NYDFS Part 500, DORA, and state insurance requirements that are in scope.

Can carriers use it for underwriting?+

Yes, with the applicant's authorization. Templates organize external and control evidence for the underwriting file so the file is not only a self-reported questionnaire.

Does it file regulatory notices?+

No. Incident workflows track deadlines such as the NYDFS 72-hour notice. People make and file the notice.

Does it cover health data held by an insurer?+

Where HIPAA applies, healthcare workflows and PHI redaction protect that data, including in AI use.

One connected product suite

AI FirewallAI HealthCheckAI SOARDeployment options

Related industries

Banking, financial services, and digital assetsHealthcare and life sciencesGlobal regulated enterprises
Discuss your sector assessment