Find vulnerabilities in your insurance platforms before attackers do

Insurance runs on long-lived web platforms that hold an unusual concentration of sensitive data: policyholder PII, Social Security and driver's-license numbers, bank and payment details, and — for life, health, and disability lines — protected health information. Most of that data flows through internet-facing systems an attacker can reach without any insider access: policyholder self-service portals, online quote-and-bind and FNOL (first-notice-of-loss) claims intake, document-upload endpoints, and the agent, broker, and MGA distribution portals that sit one login away from a carrier's book of business. Many carriers still front legacy policy-administration platforms (Guidewire, Duck Creek, and homegrown systems) with newer web layers, so the external surface mixes modern APIs with older, slower-to-patch components.

The integration layer is where a lot of real exposure hides. Carriers and agencies constantly exchange data with third parties — LexisNexis, ISO/Verisk, MVR and credit-bureau feeds, MIB for life underwriting, reinsurers receiving bordereaux, and telematics or IoT feeds for usage-based auto. That traffic often rides on SFTP and managed-file-transfer (MFT) endpoints, EDI gateways, and partner APIs, the exact category of internet-facing appliance behind several of the largest mass-exploitation events in recent years. An exposed MFT admin console, an unpatched VPN or file-transfer CVE, or an API endpoint missing authentication is a direct path to claims and underwriting data — and to every partner connected downstream.

Insurance brands are also heavily impersonated. Policyholders expect emails and SMS about claims, premium payments, renewals, and refunds, which makes lookalike domains and spoofed sender domains an effective way to harvest credentials and payment data from customers and agents alike. On the carrier's own surface, the recurring problems FortWatch sees externally are weak or missing email authentication (SPF/DKIM/DMARC) that makes spoofing trivial, certificates and TLS configurations that drift out of date on secondary portals, forgotten subdomains from acquisitions or marketing campaigns that are ripe for takeover, and sensitive files (.env, .git, database backups) accidentally left reachable on staging or marketing infrastructure.