From rules-based automation in the 1990s and 2000s to machine learning algorithms in the 2010s to generative and agentic AI in this decade, the evolution of AI in insurance has been phenomenal, affecting the areas of underwriting, claims management, fraud detection, and customer engagement. Yet, in the last three years of the industry's AI rush, it's claims management that has become the default AI use case, with its evident ROI. This is possibly due to its visible cycle time, structured first-notice-of-loss data, and well-mapped workflows and exception paths. Very few carriers talk about their underwriting decision latency, their endorsement turnaround, or their fraud triage interval—all of which carry significant value.

And so, a question arises. Should speed be the only outcome of consequence in the new era of autonomous decision making? Be it in claims being processed in minutes, fraud being detected in real-time, or customer queries being answered instantly; speed of autonomy cannot be a destination by itself. We need to govern autonomy that combines speed, traceability, escalation, and accountability to create trust. Agentic AI's contribution to insurance is not throughput. It is compressed decision cycles with an intact audit trail.

Decision velocity is truly what agentic AI in insurance must aim for.

What decision velocity really means

For many industries, and more so for insurance, speed is considered a competitive advantage and differentiator. But in a life-intrinsic domain such as insurance, speed that cannot be explained, reversed or attributed to an accountable owner is an operational and regulatory risk. Without the discipline of correctness, auditability, and escalation, it becomes a liability in many ways.

Decision velocity brings this discipline to speed and scale. The discipline that embeds traceable reasoning and accountable ownership for every consequential decision from the time of the data event to its executed action. With intelligence, it moves the focus to decision ownership, not merely technology ownership. It transparently connects the facts of data, the patterns that analytics uncover, and the recommendations of AI in every business choice made.

Data freshness, reasoning compression and oversight latency — decision velocity thrives only when these three components move in complete unison and understanding. While agentic systems in insurance aim to accelerate decision making, they should not remove the controls that make the decision defensible.

An agentic architecture for insurance decisions

Traditional automation in insurance (and even RPA) is inflexible and deterministic. Rule and rating engines determine monetary thresholds and premium calculations based on predefined variables. And while there are referral workflows to alert and escalate potential risks that fall outside the delegated guidelines, the guardrails are narrow. What's more, they break when there is a shift in context.

Agentic AI can transform the operating model with its ability to ingest and validate multiple sources of data across policy administration systems, geographies, lines of business, and regulatory demands. However, all this pivots on the quality of data and its readiness for agentic AI systems, and this is what the agentic architecture must assure.

A production-grade insurance agent stack should comprise (a) a planning layer, (b) a retrieval layer with policy language, regulatory rules and prior decisions, (c) a tool layer of rating engines, fraud models, claims and policy admin systems, (d) guardrails, (e) a decision logger, (f) an escalation layer, and, above all, a human review console.

The premise of a singular and monolithic "do everything" agent will not work. Work must be bounded by multi-agent systems, where each agent owns one decision class with one accountable human. Remember, agentic does not mean autonomous at all costs. It means delegated work within governed boundaries. Such a model reduces scope risk. However, care must be taken to avoid fragmented decisions by reasoning in isolation. The production architecture must therefore have a unified orchestration layer, shared policy memory, common decision taxonomy, and clear accountability model across agents.

When it comes to data platforms for agentic insurance, the self-adaptive behavior in the user interface calls for real-time event and data streaming, plus real-time curation of enterprise data assets. The traditional enterprise data platform with staged data processing and disjointed data event streaming for specific use cases will not work (see table). Data quality must be uncompromisingly high, and multi-step refinement and generation of machine learning insights must be in real-time, with data features engineered from the ingested and streamed data into the enterprise data platform.

This, then, is how agentic AI brings decision velocity into insurance operations beyond claims management. Be it in underwriting submission triaging, policy endorsement processing, investigation of fraud signals, identification of subrogation opportunities or distribution support, the agentic architecture clearly delineates delegation from human intervention, and shows what the agent can do, where the human stays in the loop and what velocity gain looks like (see table).

Proactive governance for prevention of human oversight failure, agent failure and compliance

Here is a sobering reality. Unless proactively governed, agentic AI can fail while achieving what it was intended to. And this happens due to multiple reasons — stale, biased or narrow data, hallucinated policy interpretation, knowledge drift, conflicting recommendations from multiple bounded agents or complex feedback loops, missed context, overconfident routing and unclear escalation ownership. These are systemic risks that can cascade across the chain to compound uncertainty, opacity, and information asymmetry.

Defining what failure means is absolutely vital, both in business and operational terms. There must be clearly articulated failure controls: confidence thresholds, retrieval-source validation, exception queues, human override reasons, re-playable decision logs, adverse-action safeguards, etc., with temporary kill switches for agents that behave outside tolerance limits. And these controls must be translated into measurable metrics.

Continuous and evidence-based oversight is imperative, not periodical and static testing. Oversight intensity must be matched to consumer impact and reversal cost, and not to a uniform "human-must-approve" rule. It is this fallacy that causes the "rubber stamp failure," where reviewers end up approving almost all agent decisions — a classic instance of minimum oversight and maximum theatre.

Three levels of oversight are recommended, based on decision criticality. The first is the pre-decision review, especially for high-stakes and low-volume instances. The second is the post-decision sampled audit, for medium-stakes and high-volume instances. And the third, for everything else, exception escalation. To add greater effectiveness, we will need to tier systems by both impact and volatility — and ensure that each modification is accompanied by a "change-impact" review.

And oversight must sit above the agent layer, not only inside each workflow. Otherwise, multiple bounded agents can create distributed logic, inconsistent outcomes, and no single view of accountability across the underwriting or servicing process. True governance goes beyond compliance to creating resilient AI systems that assure total trust and safety as they continue to evolve.

The five key governance artifacts that hold up in a market conduct exam include model cards, decision logs with reasoning traces, consumer-impact assessments, bias testing cadence, and third-party model attestations (also see the box on "Five questions a state DOI examiner will ask about your AI").

Five questions a state DOI examiner will ask about your AI:

1. What decision did the agent influence?
2. What data did it use?
3. Which human was accountable?
4. How were exceptions handled?
5. How do you test for bias, drift and inconsistent outcomes across agents?

The following may be referred to as guiding frameworks for governance:

The NAIC Model Bulletin on the use of AI Systems by Insurers (2023) and what it actually requires in terms of governance framework, third-party AI risk management, testing for bias and unfair discrimination, documentation, etc.

The Colorado AI Act and insurance rules that serve as a leading state-level enforcement signal, in terms of algorithmic discrimination testing, governance documentation and consumer disclosures.

The NYDFS Circular Letter No. 7 (2024) on AI in underwriting and pricing.

The EU AI Act for high-risk classification for life and health insurance, which clarifies implications for global carriers.

Seven key implementation lessons in production

The truth is, agentic pilots succeed because they run on narrow data, face relaxed oversight, avoid regulatory scrutiny, and are not integrated into real decision accountability workflows. Production is where the rubber hits the road. It requires governance to be embedded into decision accountability workflows from Day One, not added after a successful proof-of-concept. When governance is an afterthought, the pilot does not survive operational reality.

#1 — Bound the agent narrowly. Broad-scope agents hallucinate decisions. Make it one agent, one decision class, one owner.

#2 — Do not confuse narrow scope with narrow accountability. Narrowly bounded agents still need a shared governance layer so that their decisions do not fragment underwriting, servicing or fraud workflows.

#3 — Instrument before you scale. Observability — input, retrieval, reasoning, tool call, output, override — is the long pole. Carriers that skip this will hit a wall in production.

#4 — Design oversight as a product surface. If your reviewer experience is a spreadsheet, you will get rubber stamping. Treat oversight as a UX problem.

#5 — Data architecture is everything. Without a lakehouse, feature store, and semantic layer, agents work on stale or inconsistent data to produce indefensible decisions.

#6 — Change management is the real constraint. Underwriters and adjusters will not trust a system whose reasoning they cannot inspect. Explainability is an adoption requirement, not just a regulatory one.

#7 — Stress-test agent failure before launch. Simulate bad retrieval, missing documents, contradictory policy language, broker pressure, regulatory constraints, and handoff failures between agents.

Creating decision velocity with agentic AI in insurance is an unambiguous mandate for CIOs and CDOs. The good news is that the steps to do so are equally clear.

Create a 90-day diagnostic: a map of the top 20 consequential decisions, current latency, current oversight model, current regulatory exposure and current failure path.

For each decision, define what can be delegated to an agent, what must remain with a human, what needs pre-decision approval, and what can be handled through post-decision audit or exception escalation.

Pick a non-claims pilot. Underwriting submission triage or endorsement processing are the highest-yield, lowest-risk starting points.

Build the governance scaffolding — model registry, decision log, oversight workflow, escalation rules and accountable decision owner — before the agent, not after.

Define decision velocity as a tracked metric alongside loss ratio and combined ratio.

The message for the insurance industry is loud and clear. Enterprises will not be judged on how swiftly they adopted agentic AI. They will distinguish themselves on whether they made faster decisions without losing control, accountability, or trust. Those that treat agentic AI as a faster claims engine will hit a ceiling within a year. The ones that make it their decision-velocity capability, governed by design, will be the winners.

Personal care has long been part of insurance's promise. That's why Allstate has assured customers they're in good hands and why State Farm has claimed to be a good neighbor for so many years. And now "big data" and AI allow insurers to know so very much more about their policyholders, so they can tailor products and services to individual needs and tastes. 

But a TransUnion study found that customers didn't get the memo. 

While 70% of insurers told TransUnion they deliver a personalized experience, only 43% of customers agreed. Among members of Gen Z, which is becoming a more important market for insurers every day, only 32% said they received personalized care.

This should be a teachable moment. 

Part of the lesson from this study is simply about the importance of getting objective information, so you aren't breathing your own exhaust and exaggerating how well you're doing on important initiatives such as personalization. That point seems to have become a theme for me, based on the number of times I've hit it in these commentaries, including in a recent one about a young German soccer fan on a six-week trip with friends to watch World Cup matches. He has gone viral by providing an eye-opening look at American culture that has surprised those of us steeped in that culture. 

But I think there are two other points worth making about personalization, one about playing defense, the other about playing offense. I'll start with defense, because few insurance executives seem to be focused on it.

The TransUnion survey found that 46% of respondents invested in hyperpersonalization as a way to sell more products. That's great. Growth makes the world go 'round. But only 10% invested in personalization as part of adjusting to evolving customer expectations. That's not so great.

For three decades now, companies have had to adjust to being "Amazoned." As customers became accustomed to Amazon's one-click purchasing and other innovations, they began to demand similar simplicity from other companies, even ones in far more complex industries than book selling. The CEO of Deere complained to me in the late 1990s about being held to a standard set by FedEx. He said a customer noted that when he spent $10 with FedEx, it could tell him to within 30 minutes when an envelope would be delivered, but that when he spent $350,000 with Deere, it couldn't tell him to within three months when the equipment would arrive.

The insurance industry has done a lot to make life easier for customers, but Amazon, FedEx and others are a moving target. They keep innovating, so customers keep raising their expectations, including for insurers. They aren't going to feel like they're getting personal treatment if they end a call wondering, "Why did I have to dig up my policy number and member number? Don't they recognize my phone number by now?" Or, "Why do I have to keep checking on the status of my claim? Don't they care enough about me to keep me posted?" Or any of the innumerable other questions that arise when a customer doesn't feel valued as an individual.

The effect of disaffected customers is harder to quantify than the upticks in sales that investment in personalized selling can generate, but it's still clear that unhappy customers are more likely to jump to another broker or carrier. You also undercut the brand if you brag about personalized attention, then treat people like a number. So more defensive spending on personalization — to keep customers from becoming unhappy, as their expectations keep rising — is needed. 

The issues with playing offense are straightforward — but mind-numbingly hard. We all know the issue is about gathering more data, merging it with existing data streams and making the information available to whoever needs it, whenever they need it. But saying you need to break down the barriers between data silos is a lot easier than actually doing it, given the various ways data is defined and managed. And, by the by, how reliable are those external data sources?

Given that the issues are known and that money is being invested, I'll just add one thought, from "Beyond Digital," a 2022 book I helped write. The authors, PwC partners Paul Leinwand and Mahadeva Matt Mani, have a section on what they call "privileged insights" that was perhaps my favorite part of the book. The basic idea is that you construct a virtuous circle with customers. You do something useful for me, which makes me trust you enough to tell you a bit more about myself and my needs, which lets you serve me better, which.... 

The idea doesn't apply as well to insurance as it does to industries where interactions with customers are frequent, but the principle still applies. You warn me that hail is coming and that I'd better get my car under cover or send me a Ting sensor that spots an electrical problem in my wiring before it can cause a fire, and I'm going to become more open with you. You might find yourself creating that virtuous circle that gives you privileged insights about me that competitors can't get, no matter how much third-party data they purchase.

The drive toward personalization makes all the sense in the world, and we've published scores of articles on how to accomplish it — among my recent favorites are Reimagining Insurance Via AI and Personalization and How to Leverage the Personalization Boom. But we've all seen how theory doesn't always translate seamlessly into practice. 

The TransUnion study suggests that we should spend more money and effort on using personalization to treat customers as they want to be treated and, as always, must get outside our echo chambers and see the world as our customers see it.

Cheers,

Paul

Motor insurers in the UK paid out a record £11.7 billion in claims during 2024, a 17% increase from the previous year, according to the Association of British Insurers. Rising claims volumes are only part of the problem. The disputes sitting inside those numbers, particularly the ones tied to pre-existing damage, represent a cost that cannot be addressed by processing claims faster. They require a different approach at the point of underwriting.

When a vehicle owner files a claim, the insurer has to answer a very fundamental question: Did the damage occur during the policy period, or did it exist before the policy coverage was offered? Answering this question with absolute confidence is next to impossible without verified documentation during policy inception.

This results in disputes that cost both time and money, reduce trust, and, in many cases, result in fraudulent payouts that should never have been made. This gap is now increasingly being addressed through AI-driven inspections at the point of policy inception. It creates a verified, timestamped record of a vehicle's condition before coverage begins, removing the ambiguity that fuels most FNOL disputes.

Why FNOL Disputes Persist

Most FNOL disputes over damage causation share the same root cause: there is no verified baseline record of the vehicle's condition at the point the policy was issued.

When a new policy is written without a photo inspection, the insurer accepts the vehicle's stated condition without verification. If a claim is filed within weeks of inception, the insurer has no objective way to determine whether the damage is new or pre-existing. The policyholder says it is new. There is no evidence either way. The claim is paid, or the dispute drags on.

This is compounded by FNOL data quality problems. Research cited by EasySend found that over 60% of manually completed FNOL forms contain errors, incomplete information, or unreadable data. When the original inspection was also manually conducted and poorly documented, the claims team had very little to work with.

The cost of this gap is measured in claims leakage, adjuster time, and the operational overhead of investigating disputes that should never have reached that stage. It also affects customer trust. Legitimate claimants who face investigation due to a lack of baseline data experience a poor claims journey through no fault of their own.

Why Traditional Pre-Insurance Inspections No Longer Scale

Physical pre-inspection by a field surveyor was the standard approach for addressing this problem. It worked when policy volumes were lower and inspection coverage was more limited. It does not work today.

A field inspection takes two to five days from scheduling to a completed report. For an insurer processing thousands of claims every month, there is a substantial overhead of scheduling and logistics. The cost of each inspection, including surveyor fees and administrative processing, typically ranges from $100 to $300 per vehicle.

Another major problem is the consistency of the reports. Two different inspectors examining the same vehicle will not always produce the same findings. A scratch documented by one inspector may not appear in a report written by another, depending on lighting conditions, viewing angle, and individual thoroughness. When that inconsistency surfaces during a claim, the insurer is in a difficult position.

These limitations are well documented. A growing number of motor insurers are replacing physical inspections with an AI-powered photo inspection workflow that completes the same documentation process in minutes rather than days, at a fraction of the cost, and with consistent output every time.

Creating a Verified Vehicle Baseline Before Coverage Begins

The principle behind AI pre-insurance inspection is straightforward. Solutions such as Inspektlabs have demonstrated how AI-powered photo inspections can generate consistent, timestamped vehicle condition reports remotely, helping insurers establish a verified baseline before coverage begins. The report is timestamped and stored digitally.

When a claim is filed, the pre-policy report is the baseline. If the damage appears in the pre-policy record, it predates coverage. If it does not appear, the claim is consistent with a new incident. This helps eliminate much of the ambiguity that usually drives most disputes.

For underwriters, the same baseline has a direct operational benefit. A verified vehicle condition record supports a more accurate premium rating, particularly for used vehicles or those with a break in prior coverage. Underwriting decisions that were previously based on stated information can be anchored in verified evidence.

For policyholders, the process is faster and more transparent. A guided smartphone capture takes two to three minutes. There is no appointment to schedule and no field visit to wait for. The policyholder submits their photos, receives confirmation that the inspection is complete, and the policy can be issued the same day.

AI Is Transforming Motor Insurance Inspections

The shift from physical to AI-powered inspection is not just about speed. The technology introduces capabilities that physical inspection cannot replicate.

Computer vision and automated damage detection: AI models trained on millions of vehicle damage images identify dents, scratches, glass damage, and miscellaneous damage consistently across every submission. The same detection criteria apply regardless of who submitted the inspection or when.

Guided photo capture and image quality validation: Policyholders are guided through a standardised capture sequence that covers all required vehicle angles. Images are automatically checked for clarity and completeness before the AI assessment runs. Substandard photos are rejected, and the policyholder is prompted to resubmit, ensuring the output is based on usable evidence.

VIN recognition and vehicle identity verification: The vehicle registration visible in the inspection is cross-referenced against the policy to confirm the correct vehicle is being documented. This addresses a common form of pre-inception fraud where a substitute vehicle is photographed in place of the insured one.

Scalable operations without proportional cost increases: A manual inspection operation grows with headcount. An AI inspection workflow handles increased volume without adding staff or extending processing time.

Benefits Beyond Fraud Prevention

The case for AI pre-insurance inspection is often framed around fraud. The operational benefits extend well beyond that single application.

• Faster underwriting decisions: A verified condition report available within minutes of submission removes the inspection bottleneck from the policy issuance cycle. High-risk profiles and break-in renewals that previously required days to process can be handled the same day.
• Reduced claims leakage: A documented baseline at policy inception means fewer ambiguous claims result in unwarranted payouts. The evidence needed to validate or challenge a FNOL submission is present from the start.
• Lower operational costs: AI pre-inspection costs a fraction of a field survey. For insurers processing high volumes, the annual savings are significant. Those savings compound when the downstream cost of disputes and investigations is also reduced.
• Improved customer experience: Policyholders complete the inspection process in minutes, from their own location, at a time that suits them. There is no waiting for a surveyor appointment. Cover can be confirmed the same day.
• Better auditability and compliance: Digital, timestamped reports create a clear audit trail for every policy. Regulators and internal compliance teams have documented evidence of the inspection process and its outputs.
• Data-driven decision making: Aggregated inspection data across a portfolio reveals patterns in vehicle condition, damage frequency, and geographic risk concentration. This feeds directly into underwriting model refinement.

Why Pre-Insurance Inspections Are Becoming a Strategic Imperative

Motor insurance is under sustained pressure from multiple directions. Claims costs are rising. Fraud techniques are becoming more sophisticated. Regulatory expectations around fair treatment and evidence-based decisions are increasing. Policyholders expect faster, more transparent service.

Pre-inspection sits at the intersection of all four pressures. It reduces claims cost by establishing a verifiable baseline. It supports fraud detection by documenting the vehicle's condition before fraud can be attempted. It creates an auditable evidence trail. And it delivers a faster policy inception experience for the policyholder.

Straight-through processing (STP) for motor claims is one of the most discussed ambitions in insurance operations. STP requires reliable baseline data at the point of policy inception. Without it, every ambiguous FNOL submission requires human review. AI pre-inspection is what makes large-scale STP achievable in practice.

Insurers investing in AI-powered inspection infrastructure now are building a capability that will compound in value as the volume of policies processed digitally continues to grow. Those who delay face a widening gap between the speed and efficiency of their claims operations and what the market expects.

The competitive dimension is also real. An insurer that can offer policy inception in minutes, backed by a verified inspection, is providing a meaningfully different customer experience from one that still requires a scheduled field visit. As digital distribution continues to grow, that difference matters at the point of sale.

Final Thoughts

FNOL disputes over pre-existing damage are not a claims problem. They are an underwriting problem that gets discovered at the claims stage.

The answer is not better dispute resolution. It is removing the conditions that create disputes in the first place. A verified, timestamped record of the vehicle's condition before coverage begins provides the evidence that dispute resolution requires. The most effective way to handle an FNOL dispute is to have already made it unnecessary.

As motor insurers accelerate digital transformation, an AI pre-insurance inspection platform is becoming a foundational capability. It supports better underwriting, faster claims processing, reduced fraud exposure, and a customer experience that meets modern expectations. It is not an optional efficiency improvement. For insurers operating at scale in an increasingly competitive market, it is becoming a baseline requirement.

America has entered its Peak65 era. With a record 4.2 million baby boomers celebrating their 65th birthday in 2025, the number of people entering retirement age in the coming years is expected to continue rising.

Regardless of whether someone is retiring immediately or continuing to work, the moment demands a new approach to coming lifestyle changes. It's also a time when people reassess their risk tolerance to ensure their savings strategy can support an uncertain retirement horizon.

Annuities have long been a versatile financial tool for this demographic, providing predictable income and financial security at a time when heightened concern for stability is warranted. And demand in the market has followed suit, with last year's U.S. annuity sales surpassing $460 billion for the fourth straight year.

Yet despite the demand, consumers lack confidence in understanding their annuity plans.

For insurers, this demographic shift presents a unique opportunity to engage and educate clients, becoming a trusted source for their future financial security. To capitalize on the momentum, advisors must address the knowledge gap with personalization, transparency, and trust.

The costly impact of miscommunication

Turning 65 is a gateway moment when new financial responsibilities and freedoms emerge – and when high-stakes decisions can have long-term consequences.

But from initial education to continuing policy communications, many consumers are left with a limited understanding of how their annuity works – as well as how it fits into their broader financial plan.

Recent data underscores the scale of the issue. According to Smart Communications' 2026 Customer Experience Benchmark Report, only 50% of consumers rate the communications they receive from insurers as very good or excellent, a 10-point decline from the previous year. This drop becomes significant given that 86% of customers say communications are important to their overall experience with a company. With interactions between insurers and consumers often taking place during emotionally charged, stressful or life-changing moments, communications are not a secondary concern, but central to maintaining an open and trusting relationship.

When communication fails, it creates inefficiency, with 46% of consumers contacting customer support teams when communications are difficult to understand. Confusion can also lead to frustration or disengagement, with many abandoning processes altogether. In fact, 62% of consumers say they would switch providers if communications do not meet expectations.

Shifting from first impression to long-term engagement

As with many insurance products, misconceptions about annuities are not the exception for many clients. As a trusted advisor, it's important to understand where these gaps show up and how to address them.

For instance, it's a common assumption that annuities guarantee fixed lifetime payments, when in reality payouts can vary depending on contract structures or underlying investment performance. Misunderstandings like this highlight a broader issue: too often, information is explained in ways that are technically accurate but not easy to understand. It's here that a personalized approach, which lays out a client's plan and outcome, would drive far better sentiment and results.

Breakdowns in understanding can occur at any stage of the customer's journey, and when they aren't clearly addressed, confidence and trust begin to diminish:

• In the pre-purchase stage, communication often falls short in helping consumers understand what an annuity is and how it fits into their broader retirement strategy.
• At the point of sale, complexity peaks. Contract terms, fees, and payout structures are frequently presented all at once, creating an overwhelming amount of possibly new information at the exact moment a decision is required.
• In the post-purchase stage, communication often becomes more reactive than proactive. Statements, updates, and policy documents may lack clarity or context, making it difficult for customers to interpret performance, understand their income options, or feel confident in their long-term plan.

Rebuilding client confidence through better communication

To sustain growth and retention in the Peak65 era, insurers must fundamentally rethink how they communicate with customers. Communication is no longer a supporting function but a strategic differentiator, where clear, timely, and relevant interactions not only improve customer understanding but also directly reduce operational strain, increase engagement, and build the trust required for long-term customer loyalty.

Technology has been a key enabler of this shift, but only when applied with intention. Modern CRM systems, AI-driven tools, and digital onboarding platforms allow insurers and advisors to deliver more personalized, responsive, and consistent experiences. These capabilities enable meeting customers where they are and tailoring communications to their needs.

At its core, closing the gap requires simplifying complexity without losing meaning. Plain-language explanations and outcome-based messaging make products easier to understand. Consistency across channels ensures clients don't encounter gaps or repetition.

It also means simplifying where and how clients can access information about their plans. Reducing friction in every interaction, such as onboarding or accessing documents, helps eliminate gaps before they arise.

As millions more Americans reach retirement age, insurers should look to deliver clarity at every stage of the customer journey. In a market defined by uncertainty, the ability to turn complexity into confidence will be the defining advantage.

A lot of that anxiety comes from so-called "vibe coding." Vibe coding means using AI to build software by merely describing requirements, without worrying much about structure, testing, or long-term maintenance. Vibe coding can feel reckless (because it is). As if "moving fast and breaking things" at human speed wasn't scary enough; now we can break things with lightspeed automation. Use vibe code in production? No way.

AI coding has clear potential for productivity gain, but only if insurers address two obstacles:

• Obstacle 1: AI-generated code needs to be safe enough for production use
• Obstacle 2: AI-generated code must work with existing systems

Without addressing these issues, AI-generated code is limited to standalone prototyping. That does indeed have value, but the real opportunity comes from moving past the two obstacles. 

Over time, we've developed practical ways to make AI-generated code production-ready.

Solving Obstacle 1: Making AI-Generated Code Safe for Production

An LLM can write a research report for me in seconds, but I would never publish the result as is. Code is no different. AI-generated code should be treated like code written by a very junior engineer. It should never go directly into production. Frankly, no code—whether written by a human or AI—should go directly into production!

Here are some best practices for making it safe.

• Engineer Code Review: Experienced engineers need to review AI-generated code, as they would review a junior engineer's code before putting it into production.
• Unit Tests: Unit tests are highly valuable, but it's dangerous to let AI generate these. If the AI misunderstands your requirements and generates a bug, it'll probably misunderstand your requirements for the test too. The AI is likely to write unit tests that actually pass only if the bug is there!
• Integration Tests: Integration tests validate the contracts between components. Most production failures occur here, not inside isolated functions. AI often models these complex interactions too simply: over-mocking dependencies, testing only happy paths, and ignoring real failure modes. Integration tests require judgment about how the systems are intended to collaborate. AI can generate integration tests, but you need to review the tests thoroughly and hand-write any test cases that AI missed.
• End-to-End Tests: I have some good news: here is a place where AI works great! Use AI to specify tests for overall user-level workflows, which will only pass if the entire system is working as expected.
• Static and Dynamic Code Analysis: All the tools that review engineers' code quality can also review AI-generated code. There are many popular tools such as SonarQube, CodeQL, and OWASP ZAP. Choose some good ones and use them.
• Code-Generation Tool Selection: The best AI tool to use is a matter of opinion and will likely change faster than your browser can refresh this page! At the moment, popular code-generation tools include Codex from ChatGPT, Claude Code from Anthropic, and Cursor. Keep watch on the latest developments and be prepared to change when something better comes. Most importantly, only use AI tools approved by your security team.
• Security Team Collaboration: Every insurer has a security team. All developers should work closely with their security teams to keep up with AI's rapidly evolving capabilities and vulnerabilities.

Solving Obstacle 2: Integrating AI-Generated Code with Other Systems

We've now covered best practices for high-velocity, production-ready AI-generated code. That's great if it's all you need, but in the enterprise, code doesn't operate in isolation. Most insurance software (certainly most insurance core software) wasn't engineered with AI in mind, and that can drastically reduce the benefits of AI for the enterprise.

Here are the things that make software compatible with AI-generated code. They are a must-have list when selecting enterprise software vendors.

• Look For Modular Design

  Remember when I said AI-generated code should be treated like code written by a very junior engineer? If you give a junior engineer the keys to your whole code base, you can expect an intractable amount of code reviewing before you can ship it. They need guardrails, and so does AI.

  This is why modularity (with well-defined contracts!) is highly important. If the architecture is divided into well-defined plugins, configurations, and integrations, and all the connection points use open standards that are well documented, you can give AI these small components and reasonably review and test each one.

• Look For Open Languages and Formats

  Code-generating AIs are trained on all mainstream programming languages and file formats. They all know Java, Python, and JavaScript. They also know JSON, CSV, and RESTful APIs. Unfortunately for insurers, a lot of insurance core platforms have invented proprietary languages and file formats, which no LLMs are trained on. Insurers have great difficulty trying to use AI-generated code around these systems.

• Look For Documentation

  Whether it be APIs, configuration syntax, or system architectures, engineers hate it when they have to ask vendors for information that should be provided in documentation. Whereas humans have the privilege of calling support or emailing other engineers, AI gets stuck.

  Insurers today need to look at their vendors' documentation with a very critical eye. In the past, poor documentation was acceptable when supplemented with weeks of training and continuing access to experts. This model is annoying with human developers, but it totally breaks with AI-generated code.

• Look For Data-Fluent Systems

  From report generation to business intelligence to data lake integrations, many use cases for AI-generated code deal with data. Your AI-generated software will be no better with data than the enterprise software it relies on.

  • Data fluency for an enterprise software means:
  • Strong APIs for accessing individual records
  • Included data lake for mass queries
  • Webhooks and delta file exports for keeping external systems updated in real time
  • High-speed server responses for all data retrieval operations
  • High uptime so data is always available
  • Real-time data consistency across the system

  If your enterprise platform doesn't have strong APIs, then your AI will struggle to write code to interact with it. If it can't support mass queries, then your AI can't generate reports for you. If the system is slow, the code your AI generates will be slow. If the system has frequent downtime…you get the idea.

  If the flow of data around your enterprise is too complicated and asynchronous that your own engineers struggle to add new capabilities, then your AI-generated code will struggle too.

• Look For MCP Servers

  Model Context Protocol (MCP) is currently the most popular standard for connecting AI with other software platforms. A modern enterprise software platform has user interfaces for human interaction, APIs for external software interaction, and MCP servers for external AI interaction.

  This is admittedly off-topic when evaluating enterprise software's ability to integrate well with AI-generated code, but any enterprise software must be considered AI-compatible. With an MCP server, the latest LLMs require no code at all to connect with enterprise platforms. This is why MCP is supported by such enterprise software giants as Salesforce, Snowflake, Atlassian, and HubSpot, among others.

Conclusion

AI-assisted development is here, and it's already too powerful for insurers to ignore. Like any powerful tool, it can be immensely valuable or immensely dangerous. Insurers today can safely realize 75% reductions in their development costs and a 2x increase in their IT velocity if they use best practices and work with AI-compatible platforms.

As AI continues its rapid pace of development, smart platform decisions today will amplify into massive future advantages.

If you've ever wondered who pays for those highway billboards promising life-changing payouts for your injury lawsuit, the answer is: We all do.

Those billboards are largely funded by plaintiff firms manipulating the legal system to prioritize profit over justice. And based on the return on investment, there's no reason to believe we won't continue to pay for those garish signs through increasing costs for everyday products and services.

Businesses are deemed by the plaintiffs' bar to have deep pockets of wealth and are able to afford to settle multimillion-dollar and multibillion-dollar lawsuits. However, those costs are passed on to consumers in the form of rising prices for goods and services. The American Tort Reform Association found that lawsuit abuse costs every American $1,424 annually—nearly $6,000 per year for a family of four.

Legal system abuse is not new. Terms like "social inflation" and "nuclear verdict" have been around for years, and both continue to play a role in the broader realm of legal system abuse.

In this article, we will take a deeper dive into what constitutes legal system abuse and explore the rise in nuclear verdicts and the effect of third-party litigation funding in civil suits. We'll explain how policymakers and the insurance industry are working to curb the abuse and, finally, what businesses can do to protect themselves and effect change.

The role of nuclear verdicts

Legal system abuse is defined as the misuse of courts and legal procedures to gain a strategic, financial, or tactical advantage. It has become a growing problem, driving up costs, delaying justice, and eroding public trust in the civil justice system.

One of the defining characteristics of legal system abuse is the rise in nuclear verdicts, which are defined as jury verdicts exceeding $10 million.

Nuclear verdicts often include punitive damages that far exceed a plaintiff's actual economic losses. In addition to the financial effect on defendants, they can raise settlement expectations and contribute to rising insurance premiums.

Nuclear verdicts can also have a significant effect on the public's perception of fair and proportional damages in civil litigation. These awards go beyond what most legal experts consider rational compensation for the harm suffered. They are driven by emotional appeals, aggressive litigation tactics and expanding theories of liability. Here are two examples of nuclear verdicts:

• Juries have issued massive punitive awards against a multinational pharmaceutical, biotechnology and medical technology company in cases that allege its talc-based products caused cancer. Some verdicts have exceeded $1 billion, and earlier cases produced punitive damages surpassing $4 billion before reductions on appeal.
• In 2019, an auto-liability case in Nassau County, N.Y., resulted in a jury award of $100 million to the victim's parents for pain and suffering and $900 million in punitive damages against the defendant, a trucking company.

The number of corporate nuclear verdicts rose to 135 in 2024, a 52% increase over 2023 numbers, according to a report, "Corporate Verdicts Go Thermonuclear 2025 Edition," by research firm Marathon Strategies. The total sum of these verdicts reached $31.3 billion, a 116% increase over 2023. "Thermonuclear verdicts" of $100 million or more increased to 49 in 2024, with five of those cases resulting in verdicts greater than $1 billion. A decade ago, these verdicts would have been considered extreme outliers.

Tactics of the plaintiffs' bar

Legal system abuse can occur when attorneys exploit procedural rules, court structures or litigation mechanisms to gain the upper hand in civil litigation.

Common tactics of legal system abuse demonstrate a shift from using the courts as a forum for justice to using them as leverage for financial gain. They include:

• Frivolous claims and lawsuits: Frivolous litigation is one of the most recognizable forms of legal system abuse. These cases burden courts, increase defense costs and pressure defendants—especially small businesses—to settle rather than endure prolonged litigation.
• Abuse of class-action procedures: Class actions are intended to efficiently resolve widespread harm, but they can be manipulated. Some filings prioritize attorney fees over meaningful relief for plaintiffs or rely on expansive class definitions to inflate potential damages. This can coerce defendants into large settlements regardless of the underlying merits.
• Predatory litigation funding: Third-party litigation funding has expanded rapidly, allowing outside investors to finance lawsuits in exchange for a share of the recovery. While sometimes beneficial, it can also encourage speculative or unnecessarily prolonged litigation.
• Manipulation of courtroom practices, discovery, and evidence: Discovery abuse—such as excessive document requests, refusal to produce information or strategic withholding—can dramatically increase litigation costs. Parties may use discovery not to uncover facts but to pressure opponents into settlement by making the process prohibitively expensive. Jury anchoring is another tactic allowed in some jurisdictions where an attorney introduces a higher numerical value to jurors to rely, or "anchor," on that figure as a reference point when assessing potential damages in a lawsuit. Numerous studies have shown the strong effect this practice has on jury award decisions.

Of these tactics, the recent emergence of third-party litigation funding potentially has the most effect. It has become one of the most influential—and controversial—forces shaping civil litigation. Its rapid growth raises concerns about transparency, fairness and escalating legal costs.

Litigation funding

Third-party litigation funding (TPLF) is the practice in which outside investors finance a lawsuit in exchange for a share of any settlement or judgment. These funders generally have no direct claim in the underlying dispute but use litigation as an investment vehicle. Analysts increasingly identify TPLF as a driver of social inflation, contributing to rising claims costs and larger verdicts because funders profit only when payouts increase.

TPLF operates through several models. In single-case funding, a financier backs one lawsuit, typically one with high potential damages. Portfolio funding involves financing multiple cases at once, spreading risk across a broader set of claims. The key parties include the funder, who supplies capital; the plaintiff, who receives financial support; and the attorneys, who may coordinate with funders on litigation strategy.

While proponents argue that TPLF expands access to justice, critics warn that it can provide incentives for frivolous or overly aggressive litigation. Because funders profit only from large recoveries, they may encourage plaintiffs and attorneys to pursue riskier strategies, prolong litigation or reject reasonable settlements. Reports also highlight that the industry operates with minimal transparency, often without disclosure to courts or opposing parties. This secrecy raises ethical concerns about who is influencing litigation decisions and whether funders exert control over case strategy.

Tort reform

Legislative and policy responses to legal system abuse have grown significantly in recent years, with states adopting new tort reform measures, transparency rules and procedural changes aimed at curbing excessive litigation and rising verdicts. These reforms, however, face political resistance and uneven implementation across jurisdictions.

Efforts to address legal system abuse often begin with limits on punitive damages, which several states have enacted to curb unpredictable and disproportionate jury awards.

A wave of state-level tort reform has also emerged. Georgia, for example, enacted sweeping reforms in 2025 through Senate Bills 68 and 69, introducing new procedural rules, damages limitations and updates to trial practices. Similar initiatives in other states aim to streamline litigation, reduce forum shopping (the strategic practice where a plaintiff chooses to file a lawsuit in a specific court or jurisdiction that is most likely to provide a favorable outcome) and promote fairness in civil proceedings.

Another major development is the push for transparency in third-party litigation funding, requiring greater disclosure of funding providers and financial interests in lawsuits. Between 2023 and 2025, eight state legislatures, including Georgia and Louisiana, have made the contents of TPLF contracts subject to automatic discovery or upon request.

These reforms face significant opposition from trial lawyers and advocacy groups, who argue that caps on damages and procedural restrictions limit access to justice for injured individuals.

Potential solutions to the problem of legal system abuse include federal legislation to create uniform standards for litigation funding disclosure, punitive damages and class-action procedures. Congress is currently examining legislation that would introduce transparency when TPLF agreements are present in a suit before a federal court or bar foreign actors from participating in federal TPLF arrangements. Nationwide rules could reduce inconsistencies and prevent forum shopping.

The role of insurance

The insurance industry has become one of the most active voices in confronting legal system abuse, responding with risk-management strategies, advocacy efforts and collaborative initiatives aimed at reducing inflated claims costs and restoring balance to the civil justice system.

Insurers have adopted risk-management practices to stem the rising costs associated with legal system abuse. These practices include enhanced claims monitoring, early case assessment and the use of analytics to identify patterns of excessive litigation. Industry research shows that legal system abuse has significantly inflated claims payouts across multiple lines of insurance, with commercial auto insurers alone paying $20 billion more than expected between 2010 and 2019 due to litigation.

Many insurers advocate for tort reform, supporting legislative efforts to curb abusive litigation tactics and reduce the frequency and severity of nuclear verdicts. Insurance industry groups such as the American Property Casualty Insurance Association and the Insurance Information Institute have led the charge.

What can you do?

Putting an end to legal system abuse will require coordinated efforts from individuals, businesses, policymakers and the broader public. With tort costs reaching hundreds of billions annually and driving up prices for consumers, every stakeholder has a role to play in promoting fairness and transparency. And consumers and businesses have the most influential voices.

Companies can reduce exposure to abusive litigation by strengthening compliance programs, improving documentation and using early dispute-resolution strategies. Businesses can also actively support state and national efforts to curb abusive tactics.

Working together, insurers, consumers, businesses and policymakers can help restore balance to the civil justice system, reduce unnecessary costs and ensure that the legal process works in the service of justice instead of profit.

A senior leader has been in their role for 15 years. They know how the steering committee reads bad news. They know that if they lead with the complication, the conversation shifts from "how do we solve this?" to "should we proceed at all?," and this initiative is too important, too close, to lose to a room that hasn't seen what they've seen.

So, they frame the complication as a minor implementation consideration. It's real. It's manageable. They're protecting the initiative. They're advocating for the people this change is meant to serve.

Six months later, that minor implementation consideration is the reason three functions can't use the system.

The leader didn't lie. They translated. And the translation left something out.

The Skill That Made You Good at This Job

Every effective leader in a complex organization learns, early and through experience, that the same initiative requires different conversations with different stakeholders. The CFO needs a business case. The front-line manager needs to know what changes about how they do their job on Monday. The steering committee needs enough confidence to approve. The actuary needs the model assumptions. The board needs strategic context, not operational detail. And each stakeholder comes to the table with different expertise, different risk tolerance, and different decision authority.

This is not manipulation. It is sophisticated communication. I call it calibrated disclosure: the practiced judgment of what to say, to whom, in what form, at what moment. In insurance and financial services, calibrated disclosure is more than a skill. It is a professional requirement.

Part of an initiative leader's role in this sector is building the confidence required to move change forward in an environment where every proposed modification will be examined under a microscope by internal functions, by regulators, and in some cases by rating agencies.

And then there is the problem.

The same discipline that makes the briefing cleaner makes any omission invisible. The skill that builds confidence can, without anyone deciding it should, begin to protect the initiative rather than serve it. This shift does not announce itself. It operates below the level of ethical self-examination. You don't decide to calibrate away a risk. You calibrate because you've always calibrated. Because it works.

Where the Coalition Compromise Lives

This year, I developed a framework for change leaders on the ethical traps that become available under pressure. The one most relevant to this industry is what I call the "coalition compromise": the trap that activates when building stakeholder support begins to require managing information differently across audiences, not just for clarity but for outcomes.

Three structural features of regulated industries make a coalition compromise more available, more normalized, and harder to catch.

Disclosure is a professional discipline. In insurance, calibration is not optional. It is governed. Actuarial standards specify how risk models are presented to different audiences. Regulatory filings require precise framing for specific agencies. Leaders who have navigated all of this for years develop a deep, practiced confidence in their own judgment about what belongs in which conversation. There is an additional psychological dimension worth naming: When the calibration feels like it is following the rules, when a leader genuinely believes they are operating within the standards set by compliance and the regulators, the ethical self-check rarely fires. The leader is doing the right thing. They have the documentation. They have the process. And they are wrong in a way the process cannot catch.

Stakeholder complexity is structurally high. A single AI initiative at a large carrier may require navigating underwriting, claims, actuarial, compliance, legal, IT, distribution, and the board, each with different languages, expertise, risk tolerances, and decision criteria. In markets with distributed regulatory oversight, the complexity multiplies: A product requiring filing across dozens of jurisdictions generates separate stakeholder conversations at each level. The temptation to frame the initiative differently for each audience is not laziness. In the short term, it works.

The initiative window is often compressed. Regulatory timelines, competitive pressure, and board cycles create genuine urgency. Urgency compresses the ethical review. The question — "Am I framing this differently because it's clearer, or because it speeds movement?" — doesn't get asked when the steering committee meets in four days and the filing deadline is the following week. The coalition compromise doesn't require a decision to compromise. It requires only the absence of time to examine what you're doing.

The Line That Moves

The coalition compromise doesn't arrive as a single choice. It moves through stages. What makes it difficult to catch in regulated environments is that the early stages are explicitly trained.

Stage 1 — Translation. You simplify a complex finding for an audience that doesn't need the technical detail. A valid actuarial concern becomes an implementation consideration.

Stage 2 — Emphasis. You lead with the upside and position the complication toward the end of the document. The information is present. The weighting is a choice.

Stage 3 — Selective inclusion. The complication is in the record, available to anyone who asks. Steering committees are time-compressed environments where significant decisions get made amid competing "day job" responsibilities. Key members may not be present. Questions don't always get asked. The meeting moves on.

Stage 4 — Omission. The finding doesn't appear in the materials for this audience. It may have been raised briefly in a prior meeting where it wasn't picked up. In the room where the decision is made, it isn't there.

What makes this particularly difficult in regulated environments: Stages 1 and 2 are competencies organizations develop deliberately. The line between Stage 2 and Stage 3 is invisible in the moment. Stage 4 is reached without a single decision that felt like a decision.

What No Compliance Framework Catches

Compliance frameworks, including the three-lines-of-defense model that governs risk oversight across most large carriers, are built for decisions: for specific acts that can be governed, audited, and reviewed against a documented standard. The coalition compromise operates below the level of decision. It lives in framing choices, in the weighting of a slide, in which objections are raised before the meeting, and which are handled in the hallway afterward. None of those frameworks are designed to catch it.

There is a second dimension that rarely gets discussed: organizational contagion. When a transformation leader calibrates information selectively, they do not do it in isolation. The briefing gets built with a team. Materials get shaped by people who observe what their leader includes and what they don't, what gets said in the room and what gets managed around the edges. Those observations form behavioral norms: what is acceptable here, how we handle complications when the stakes are high.

The coalition compromise, left unexamined, doesn't stay in the steering committee room. It permeates. Product requirements to IT get shaped by the same logic. Customer-facing materials, sales training, and claims handling documentation are each an opportunity for the same framing choices to compound. What started as one leader's judgment call becomes the organization's operating standard. 

I have seen this dynamic inside a large financial services organization where siloed functions, low inter-unit trust, and a prevailing culture of risk aversion made it easy for misunderstandings to surface at the point of delivery to the customer, and for finger-pointing to follow when issues finally became visible.

What would catch the problem isn't a framework. It's a question built as a habit before every steering committee, every board presentation, every stakeholder briefing:

What does this audience not know that they would want to know if they did?

That question is not a compliance requirement. It is a capability. And most organizations have never built it deliberately.

Building the Discipline Before You Need It

The coalition compromise is most likely to emerge precisely when the initiative is most important, the pressure is highest, and the leader's conviction is strongest. Those are not the conditions under which most people do their best ethical reasoning. Which is why the work must happen before you're in that room.

Three disciplines, developed deliberately:

Name your translation standard before the briefing. Before preparing materials for a specific audience, define in writing what "translation" means versus what "omission" means for this conversation. What is the threshold — whether the finding, the risk, the complication — below which simplification is legitimate and above which it must be present regardless of how it lands? The act of writing forces the distinction. Calibrated disclosure that has been examined is a professional skill. Calibrated disclosure that hasn't is a liability waiting to surface.

I have worked with leadership teams who approach this not as a compliance exercise but as a personal commitment, drafting explicit principles about what they will and will not do when the pressure is high, before the pressure arrives. The ones who find it most useful are not the ones who already have strong ethical instincts. They are the ones who understand that under sufficient pressure, strong instincts alone are not enough. You're not writing rules for other people. You're building your own code.

Apply the adversarial read before sending. Before any significant briefing goes out, ask: if someone who actively opposed this initiative reviewed this document, what would they say is missing? If the answer is something that would change the audience's decision if they knew it, it belongs in the document. This is not about playing defense. It is about the difference between advocacy and selective presentation.

Build one truth-telling relationship. The coalition compromise flourishes in the space between what a leader knows and what the room is allowed to see. One relationship, built specifically for this purpose, changes that structure: a peer, a trusted direct report, a board member whose explicit role is to tell you what you don't want to hear before you've told the room something incomplete. This relationship is worth more than any compliance protocol, because it operates at the level where the coalition compromise actually lives — in the judgment calls made before the materials are finished.

The Capability the Industry Has — and the One It Needs

Insurance has built deep institutional capability around disclosure. That capability is a genuine competitive advantage, and the precise environment in which the Coalition Compromise becomes structurally available, culturally normalized, and professionally indistinguishable from good judgment.

Until the moment it isn't.

The leaders who navigate this well over time are not more ethical. They are more deliberate. They have built the habit of asking, before the brief is finalized, before the room fills up, what this audience doesn't know that it would want to know.

If the answer is "nothing," then proceed.

If the answer takes more than a moment to arrive, that pause is worth honoring. It is the one place a framework can't go that a leader can.

For health plan officers and financial leaders, pharmacy benefits have crossed a threshold. U.S. prescription drug spending surged to $915 billion in 2025 and is projected to exceed $1 trillion in 2026 — one of the fastest growth rates in two decades. Pharmacy benefits is no longer a cost category — it has become a material driver of financial volatility.

The forces driving this exposure are converging. Specialty medications now account for roughly half of total drug spending, with many therapies exceeding $100,000 annually per patient, and some cell and gene therapies reaching into the millions. Overall healthcare spending is projected to grow 10% or more, with pharmacy costs among the primary drivers. At the same time, the passage of the Consolidated Appropriations Act of 2026 (CAA 2026) has expanded transparency, reporting and fiduciary requirements for health plans — adding regulatory and operational complexity on top of financial exposure.

In one-on-one conversations, I am hearing an acute reaction to mounting pressure being felt across the payer ecosystem. Plan sponsors are increasingly focused on how to maintain cost control while also meeting expanding fiduciary and transparency obligations. Health plans and TPAs are actively exploring more proactive approaches to medical and specialty pharmacy management as usage and cost volatility increase. At the same time, PBMs are working to redefine their role as traditional operating models face greater scrutiny and disruption.

The legacy PBM model was not designed to manage challenges at this scale. It was designed to aggregate volume. The result is a system that is increasingly difficult to measure, interpret, and control, precisely when greater visibility, accountability, and agility are most needed.

The Legacy PBM Model Concentrates Risk in the Wrong Places

The legacy PBM structure systematically limits visibility. Opaque pricing methodologies, hidden rebate structures, and aggregate-only reporting make it difficult for health plans to determine true net cost, validate savings claims, or identify the actual drivers of spending early enough to intervene effectively. Addressing this requires a more transparent operating framework built around integrated data visibility, component-level financial reporting, and greater accountability across pharmacy benefit stakeholders.

Flexibility is equally constrained. Bundled PBM arrangements limit a health plan's ability to adjust benefit design, introduce new strategies, or respond quickly when specialty usage shifts unexpectedly. Fragmented vendors and siloed data eliminate the possibility of a single, reliable source of truth, which is essential for effective financial and operational oversight. More adaptable, modular benefit structures allow plans to introduce targeted specialty management strategies, optimize site-of-care programs, and implement new financial controls without overhauling the entire pharmacy benefit model.

Market concentration compounds the challenge further. The top three PBMs control roughly 80% of U.S. prescription claims, limiting competitive alternatives and slowing adoption of models better suited to the current environment. The practical consequence is a widening gap between what health plans are accountable for and what their current structure actually allows them to manage.

To close these gaps, stakeholders are looking for new models that provide access to broader contracting scale, specialty networks, and integrated management capabilities to maintain greater control over benefit strategy, vendor selection, analytics, and member experience.

A Marketplace Model Approach to Pharmacy Benefits Strategy

Managing pharmacy benefit risk requires the same discipline applied to any significant financial exposure: visibility into the drivers, flexibility to respond, and the ability to make decisions based on empirical data rather than aggregated summaries.

A marketplace-based approach to pharmacy benefits addresses each of these directly. Rather than relying on a single bundled arrangement, health plans can evaluate pharmacy benefit components individually — assessing performance, replacing underperforming elements and aligning each component with specific organizational priorities and financial objectives. The result transforms a monolithic, difficult-to-audit arrangement into a set of discrete, measurable risk factors that can be actively managed and adjusted as market conditions evolve.

The implications are real:

Concentration risk is reduced. Dependence on a single PBM relationship — with its inherent opacity and limited leverage — is replaced by a diversified model in which no single vendor controls the full picture of pharmacy economics. A marketplace model broadens choice and competition, enabling organizations to manage risk based on the profile of their covered lives, not that of the masses.

Regulatory and fiduciary exposure are addressed directly. A marketplace model built on transparent, component-level reporting supports the disclosure, audit trail, and accountability requirements that CAA 2026 and ERISA-aligned fiduciary standards now demand. Plans can demonstrate not just what they spent, but why, and what oversight was applied. Furthermore, real-time access to integrated data enhances the power of predictive modeling and the potential for proactive risk mitigation.

Specialty drug volatility becomes more manageable. A small number of high-cost therapies now account for a disproportionate and increasingly unpredictable share of total spending. A marketplace model makes it possible to coordinate key cost savings components — site-of-care optimization, stronger clinical oversight, and more targeted financial management strategies — within a unified framework designed to intervene where costs are most concentrated. For example, plans may redirect eligible specialty infusions from high-cost hospital outpatient settings to lower-cost ambulatory infusion centers, implement enhanced monitoring protocols for emerging high-cost therapies, or better align pharmacy and medical benefit management strategies to more effectively identify, track and control specialty spending across the continuum of care.

Operational risk from rigidity is eliminated. Currently, when the prescription drug market changes — new therapies enter the market, GLP-1 usage accelerates, or a new cell and gene therapy creates an unanticipated claim event — payers can be slow to react, often having to renegotiate a bundled contract or wait for a vendor partner to build a new capability. A marketplace model enables organizations to act in real time, rather than reactively, as these dynamics unfold. This flexibility enables organizations to rapidly deploy targeted utilization management programs, introduce condition-specific clinical management strategies, expand specialty network access, or adjust financial controls in response to changing market conditions.

From Reactive to Proactive: Data as a Strategic Management Tool

Effective pharmacy benefit management is anticipatory, not retrospective. The legacy pharmacy benefits model is built around periodic, aggregated reporting — a structure designed for billing, not strategic decision-making. A marketplace approach changes the information architecture fundamentally.

With integrated, component-level data and real-time reporting, health plans gain the ability to identify cost drivers earlier, compare vendor performance against benchmarks, and make empirically grounded decisions rather than relying on assumptions embedded in aggregate summaries. This shifts pharmacy benefit management from a reactive posture — responding to spending that has already occurred — to a proactive one, where risk is identified and addressed before it becomes a financial event. Unified analytics also help align pharmacy and medical benefit insights, improving visibility into total specialty care costs and supporting more coordinated enterprise-wide decision-making.

This capability is especially critical as the pace of change in the drug market accelerates. Traditional tools — formularies, rebates, utilization controls — remain important, but they are no longer sufficient as standalone management mechanisms. Precise, real-time visibility into cost drivers and direct operational control over how those costs are managed have become baseline requirements for any health plan operating in today's pharmacy environment.

A Sustainable Framework Requires Structural Change

The structure of pharmacy benefits will continue to evolve as drug acquisition costs remain elevated, new high-cost therapies enter the market, and regulatory expectations increase. Health plans that continue to rely on the legacy model are operating within a framework that often limits visibility and flexibility at the exact moment both are most needed.

Organizations with greater expertise, visibility, and flexibility will be better positioned to adapt to ongoing market disruption, manage specialty cost pressures more effectively, and meet rising stakeholder expectations. Those that fail to evolve risk operating within a pharmacy benefit framework that is increasingly misaligned with the financial, regulatory, and operational realities of today's healthcare market.

An adaptable, marketplace-driven pharmacy benefit model enables health plans and payers to adapt to these realities without major structural disruption or service interruption. It replaces opacity with transparency, rigidity with modularity, and assumption-based management with data-driven oversight.

Executing this kind of transition requires more than a vendor swap — it requires a new paradigm and a strategic partner with the clinical, financial, and operational depth to navigate this environment. Collaborating with specialized pharmacy benefit partners — those with proven capabilities across specialty management, analytics, rebate optimization, and benefit design — can help plans build a more responsive and sustainable pharmacy benefit strategy.

Paul Carroll

To start us off, what is your overall outlook for the cyber insurance industry?

Liz Kim

If only we could predict where it's going to go, right? I've been in the cyber insurance industry for many years and I've worked across a lot of different roles. I've been in it as a lawyer, as head of claims for a major insurer, in underwriting, in product development, and as a broker. We’re in a soft market now, but, as with all insurance, the cyber market is cyclical.

I think cyber is more cyclical than other lines, for a couple of reasons. First, although there are plenty of disaster scenarios that people talk about in the industry — things like a worldwide AWS outage — we haven't yet really had a true disaster, which would tighten capacity and increase prices. Second, we have new entrants coming into cyber all the time. Because of that constant influx, a lot of their value proposition comes down to nothing more than having the lowest prices. That dynamic drives pricing down more than you'd typically see in other lines of business.

That said, companies that maintain underwriting discipline and pair their insurance with meaningful services or technology solutions to reduce digital risks are better positioned to hold pricing than those that are purely insurance plays.

My overall outlook? It's always positive — because if it wasn't, I wouldn't still be in cyber after all these years. With the kinds of innovations we're seeing across the industry, it's always going to be an area that drives the market forward.

Paul Carroll

How has the cyber threat landscape evolved over the past year or so, particularly with the rise of AI capabilities being leveraged by bad actors?

Liz Kim

The biggest concern I'm hearing right now with respect to AI, in particular, is deepfakes. It's not necessarily a claims-oriented concern in the way ransomware or even extortion is — it's more of an existential threat, which is how most people seem to view it. But deepfakes do connect to insurance, in that some cyber insurers have AI-related exclusions that could potentially leave a deepfake-related claim uncovered. I don't think we've landed on a perfect solution there yet.

We're also seeing a rise in invoice fraud, especially through business email compromise and invoice manipulation. Deepfakes and other trickier social engineering techniques that are leveraging AI certainly make those types of scams even easier to pull off.

Paul Carroll

Tell me a bit more about invoice manipulation, if you would. It’s been around for a while, but I find it interesting that it’s picking up.

Liz Kim

What you see is threat actors creating a fake invoice from a vendor that the insured already does business with. They'll know somehow that you work with that vendor — maybe through social engineering, or maybe they've actually gained access to your systems. From there, they'll send you a fraudulent invoice using one of two main methods.

The first is domain spoofing, where the email domain looks very, very similar to the legitimate one — maybe just a misspelling, or .com versus .ca or .co. They're counting on the recipient not noticing.

The second is BEC, or business email compromise, where the hacker has actually compromised the email account of the other party and is sending invoices directly from it to legitimate contacts.

Either way, there's generally a payment redirection involved — like, "Oh, I've changed my banking information." That's a key red flag. There's no tech hack to prevent this; it's really a process issue. Accounting teams need to have protocols around anything involving a change to payment details. Verify it through a phone call to a known contact using confirmed contact information. And you need to be the one calling them, not the other way around.

You can even see cases where someone on the accounts payable team receives a fake email thread or a WhatsApp message from their CEO or CFO saying, "Pay this invoice."

What makes it convincing is that the thieves have done their homework: they know the CEO is connected to that person professionally on LinkedIn, or they've worked together, or they're tagged in a post. The thieves replicate real, believable scenarios to trick employees.

Junior employees often don't want to question something that looks like it's coming from the CEO. But that's exactly the point: You cannot bypass your internal validation protocols at any level, no matter how legitimate something looks. Because threat actors are trying to trick you.

Paul Carroll

I gather AI is also increasing the volume of cyber threats like phishing. What is the industry doing to counter that?

Liz Kim

Yes, the volume is going up. AI is an enhancement to all of the tactics that bad actors are already using.

A phishing email from three, four, or five years ago is not the same as a phishing email today. Before, there were very obvious markers — the spelling mistakes, the type of email. Nowadays, with advanced social engineering, they can make an email seem so much more legitimate. It's hyper-personalized.

At the same time, the prevention aspects are improving, too. The market is providing more education around building digital resilience and awareness of how phishing scams work: Don't click on things from someone you don't know, and don't click on something you weren't expecting — even from someone you do business with every day.

As an industry, we're not seeing the increase in claims volume that you would expect given the sophistication of AI, and that's because there's much more emphasis on education and prevention.

Paul Carroll

I've been tracking hackers since probably the late 1980s, back when friendly Nigerian princes used to offer me a lot of money. Now I'm at the point where I may report emails as phishing scams that turn out to be legitimate — I'm suspicious of everything these days.

Beyond education, what are you and others in the industry doing to prevent cyber threats from succeeding?

Liz Kim

We have our in-house technology experts — the BOXX Hackbusters team — who are on call 24/7. In addition, each commercial policy is bundled with Cyberboxx Assist, a suite of tools and services designed to help individuals and businesses predict, prevent, and respond to cyber threats. We also offer a virtual CISO [chief information security officer]. These services are focused on the SME space, because many of our insureds don't have any in-house technology expertise, and we can help them bridge that gap.

By offering services like our virtual CISO, it does two things. One, it raises awareness among the management team that cyber risk is a real issue that can impact their organization. Two, it allows our insureds to get expert-level cybersecurity advice. Our vCISO will work with them on a plan — and offer them advice and resources on how to execute it.

In terms of insurance offerings, BOXX introduced a tech E&O policy earlier this year. It has a really strong cyber focus and offers something very specific for technology companies: breach of contract coverage. To get a little lawyerly, the liability that tech companies face isn't a breach of industry standard, which is what you normally have for more traditional professionals like accountants, lawyers, doctors, and so on. Breach of industry standard is the coverage traditional professional errors and omissions insurance provides. But in the technology space, liability is driven by what companies put into their contracts. So the importance of having affirmative coverage for contracts really cannot be overstated when it comes to Tech E&O.

Paul Carroll

There seems to be growing emphasis not just on an organization's own cybersecurity, but on the security of all the vendors and business partners they interact with, because those relationships can serve as entry points for attackers. How is that third-party risk being addressed in the insurance market?

Liz Kim

We can't physically address the security of our insureds' vendors or business partners. So we have to essentially push our insureds to address the security of their own vendors and business partners through education and awareness.

That's critical, because as an industry, we're seeing more claims come in through those third-party relationships than through direct attacks on the insureds themselves.

Paul Carroll

Looking ahead two or three years, where do you think the cyber landscape is headed — and does it ever really change, or is it always going to be that back-and-forth battle between attackers and defenders?

Liz Kim

Even though cyber is an area that changes a lot, it also stays the same in a lot of ways. The role of cyber insurers — especially technology-focused ones like BOXX — is to stay ahead of what the bad guys are doing. That's why things like monitoring the dark web, which is still a relatively new practice for the industry, are so important.

The focus will shift, sure. We've seen it move from ransomware to extortion to business email compromise and invoice manipulation. But ultimately what we're doing remains the same: predicting, preventing, and insuring against negative cyber and technology-related events.

Paul Carroll

Are you seeing much change in the geographic origin of cyber threats? For a while, North Korea, China, and Eastern Europe were significant sources — has that landscape shifted?

Liz Kim

The industry is seeing what appears to be a decrease in volume from Russia and Ukraine, simply because their energies are focused on each other rather than on the rest of the world.

That said, I don't think we're seeing any decrease from the other traditional sources, such as China and North Korea.

Paul Carroll

This has been very helpful. I hope people get the message, especially about the vigilance needed to head off invoice manipulation.

Any final message?

Liz Kim

I’ll just note that I’m excited to have joined BOXX. Just in the few weeks I’ve been here, I’ve found the people to be amazing. The other thing that really drew me to BOXX — and that I've come to appreciate even more since joining — is that we have all the excitement and focus of a startup and we’re channeling that energy into growth after officially becoming a part of Zurich Insurance, a 150-year-old, well-established, and well-respected insurance company.

Paul Carroll

Thanks, Liz.

About Liz Kim

Elizabeth (“Liz”) Kim is the President, US at BOXX Insurance, where she leads the company’s U.S. strategy, operations and market expansion. With nearly 30 years of experience in the insurance industry, she brings deep expertise across underwriting, claims, product development, reinsurance and legal analysis. 

Before joining BOXX, Liz served as a Cyber Reinsurance Broker at Gallagher Re, structuring reinsurance solutions for cyber insurers, InsurTechs, and MGAs. She also held senior leadership roles at Hiscox in underwriting and product development after spending more than a decade as a litigator and claims leader managing complex technology, media, cyber, and professional liability matters. Her broad background gives her a practical, well rounded perspective on emerging risks and the operational needs of insurers and insureds. 

Liz holds a J.D. magna cum laude from Seattle University School of Law, an M.S.W. with honors from California State University Sacramento, and a B.A. in Sociology with a Minor in Women’s Studies from the University of California Davis. She is also committed to mentorship and community service and has volunteered with San Francisco’s Volunteer Legal Services Program, the Asian American Bar Association/Asian Pacific Islander Legal Outreach Pro Bono Clinic, and the ACLU of Washington. Liz also served on the Board of Directors of the Korean American Bar Association of Northern California and continues to serve on the Board of its affiliated Foundation, where she has chaired the Scholarship Committee and mentors law students.[