Paul Carroll

What are the main challenges in underwriting today, and how might emerging technologies address these issues?

Balázs Kaman

One of the biggest challenges in underwriting today is simply getting the right data into the system. Many of our MGA customers underwrite highly specialized risks such as crypto exchanges, mining rigs submerged in the ocean, or electric vehicle chargers. The prerequisite for accurate underwriting is having high-quality data available for rating, but collecting and structuring that data is still painful and time-consuming.

Over the last decade, the industry tried to solve this by pushing data entry downstream and asking agents or insureds to fill out information directly in portals. With AI, we now have a better path forward. Instead of changing long-standing submission behaviors like sending emails, AI can extract and structure that data automatically and trigger the necessary workflow steps. That allows underwriters to spend less time rekeying information and more time focusing on evaluating risk.

Paul Carroll

I’d bet that the speed enabled by AI creates benefits beyond efficiency. In the consulting world, the concept of "time to value" has really taken hold over the past 15 years. In other words, don’t just tell me you’ll double my investment; tell me whether you’ll do that in two years or 10. What value does this acceleration bring to the underwriting field? 

Balázs Kaman

Absolutely. Tools that integrate via APIs [application programming interfaces], enriching the data that you have available, using AI to do some of the underwriting and also scoring the incoming requests let you focus on what really matters: These tools enable underwriters to cut processing times dramatically.

What used to take maybe days can now be handled immediately or can at least surface a preliminary price or rate, so you can then come back with a more polished rate after all the underwriting was taken into consideration. 

Paul Carroll

I imagine faster quote turnarounds provide a competitive advantage in the highly competitive MGA market? 

Balázs Kaman

Speed is the name of the game. We see that in all the customer types we serve. Wholesale brokers who don't necessarily do the underwriting themselves but focus on finding the markets that need a specific application—speed is very, very important for them. Also for MGAs who rate their own risk and do their own underwriting and who might have binding authority.

In the past, they used platforms where they needed to log in and rekey all the information. Modern systems like BindHQ allow integration with their APIs directly and massively reduce the time it takes to get quotes back.

Paul Carroll

How has insurance evolved in the six or seven years since BindHQ was founded? 

Balázs Kaman

I can say that many of the big frustrations—issues like duplicate data entry, disconnected systems, and long response times to customers—can all be addressed with today's technology.

Previously, only a handful of forward-thinking carrier markets had APIs, and even those weren't very modern or helpful. They typically only allowed for quoting, not binding or endorsing policies.

Our industry is slow to adapt. Still not every carrier has those capabilities. But we are getting there.

Seven years ago, I saw a lot of handwritten, scanned paper documents being uploaded into agency management systems. Then someone, mostly offshore, would rekey that information. Today, modern OCR or AI-assisted tools can read and process that information, which saves time, reduces cost, and creates a much better user experience.

Seven years ago, people simply sent ACORD forms in emails. This practice is still fairly common because people resist change. They wonder, “What's in it for me?” You really need to provide incentives to agents to start using new technology or platforms, or they’ll just email the expiring policy or a filled-in ACORD form from two years ago.

If you tell agents to come to your platform and rekey everything, that won't work. But with the new tools using OCR and GenAI to extract that information, you can save them tremendous time. As an MGA, if you can save time for retail agents and quickly provide accurate quotes, they're more likely to send business to you. I find it amazing how long forms have remained relevant despite technological advances. 

Paul Carroll

I hear all the time about problems with data standardization in the insurance industry. How do we address that, given that data is expressed in different formats across different systems?

Balázs Kaman

The question is tricky because insurance is complex. I joke that specialty insurance is anything about anything. It's a written contract about literally anything. So there are either no standards or there are too many standards.

People have tried coming up with standards, but specialty MGA program administrators come up with creative and innovative products, so how they capture data might change. And depending on who’s viewing the report, they might want to see things differently. So we provide access to the data and allow you to really build your own report.

There, again, generative AI can be hugely helpful because the tools can really democratize the data engineers' work. You can, in plain English, explain what reports you want to see. And then if the data is available, you can more easily build those reports.
But GenAI is unfortunately not a silver bullet. You cannot just put ChatGPT on top of a database and expect it will solve all the problems, because insurance is very complex. Depending on how you ask the questions, you might get different answers. Like, are you thinking about the term premium, the billed premium, the annual term premium, the pro rata premium? Even just "premium" has so many meanings that you need to be very careful when you are creating a report. 

Paul Carroll

Where do you see underwriting heading over the next two or three years?

Balázs Kaman

That is a great question. I've read a quote that people usually overestimate change in the short term and underestimate change in the long term. I think the GenAI hype has maybe settled down a bit. Everyone started using it, and they burned themselves once or twice. Now, some people are saying it's not the revolutionary thing we thought it would be.

But even if we just implement everywhere in all the tools, in all the workflows, the technology that is available today, it would already mean a huge change for the entire industry. Automating the busy work will be huge.

Also, I think concepts that are not even considered today will become more prevalent. Using AI agents and building custom agents to do underwriting and enrich data will be huge. Accessibility and the interconnected nature of our industry will be better.
I think the trick with GenAI is that you don't need to change human behavior. You can just put smart tools on top to get huge results.

I still think insurance is a relationship business. There will still be a huge role for the relationship part and the human element. Technology will not solve all parts of the problem, like securing capacity. 

Paul Carroll

How accurate is AI, and how accurate does it need to be?

Balázs Kaman

97% accuracy is sometimes great, but sometimes it's not good enough. If you need to report on your financials, for instance, 97% accuracy is not sufficient. However, if you want to provide speedy responses and a ballpark estimate is acceptable, then 97% can be good enough.

I think that's where the difficulty lies for many technology providers. Getting from zero to 95% accuracy is pretty easy with these new technologies. But going from 95% to 100%, where you can totally trust the system and take the human out of the process, is difficult. 

Paul Carroll

We’ve published numerous articles on “continuous underwriting,” where companies adjust policies in real time when conditions change rather than waiting for renewal periods. How do you view that concept? 

Balázs Kaman

The technology would allow that, and really forward-thinking companies are doing it. In business auto, it's very common that you continuously underwrite. Based on the mileage that was driven, you fine tune the policy and dynamically do the rating. I believe this trend will intensify, particularly with the proliferation of IoT, as ubiquitous connectivity becomes the norm.

I also see embedded insurance as a trend, building on that connectivity through APIs. With AI, the integration part can be much simpler. 

Paul Carroll

Any final thoughts? 

Balázs Kaman

I think this is a very exciting time. In the past, humans were afraid when there was change, thinking they would be out of a job. But the coming years will help underwriters reduce the busy work, the boring stuff—keying in information, sending emails, responding to emails—so they can focus on what requires their expertise and on the art part of underwriting. The boring stuff will be taken care of by technology.

About Balázs Kaman

As Head of Product at BindHQ, Balázs leads the company’s product strategy and innovation roadmap, shaping how MGAs, wholesalers, and retailers connect through BindHQ’s modern insurance distribution platform. He champions customer-centric design and scalable architecture, ensuring products deliver measurable value for underwriters, brokers, and partners. With over 12 years of experience spanning product management, software engineering, and business operations across multiple indusries, Balázs combines deep technical expertise with a strong commercial mindset to drive digital transformation across the insurance value chain.

The oddest invitation I received at the recent InsureTech Connect was from the vice chair of Duck Creek, who suggested I attend a session it sponsored that... barely mentioned Duck Creek. Instead, the session was a celebration of a Duck Creek customer, Hagerty Inc. — and it was a revelation. While I wasn't familiar with Hagerty, it turns out to be a model for what insurance can (and should) be.

Having opened a small agency 40 years ago because they couldn't find insurance for their wooden boats, Frank and Louise Hagerty expanded into classic cars and then kept following their customers until Hagerty Inc. served just about any need a car enthusiast could have. That little agency now carries a market value of nearly $4 billion.

The journey shows how others can also wrap services around their core insurance products and do more for their customers, while turning them into loyal customers, if not fans. 

I know, I know, nobody is going to get as excited about directors & officers insurance as many do about classic cars, but it's possible for all sorts of lines of insurance to demonstrate broader understanding of, and care for, customers.

Some agencies and carriers are already doing so — and winning.

Don't you wish your company had videos as cool as Hagerty's "Driveway Find" about the immaculate restoration of a 1964 Chevrolet Impala that two car nuts did for the original owner or this "Redline Rebuild" of a Stovebolt 6 engine from an ancient Chevy pickup truck? (Fair warning: If you click through to either of those videos or to the media section of their website, you may be there a while. I'm not at all a car guy but got sucked in for a good half-hour.)

Hagerty got to this point by moving beyond wooden boats and into insurance for classic cars in 1991, then progressively expanding to take on more of car enthusiasts' needs. The company launched a price guide in 2008 — it had to have the information for insurance purposes, so why not provide it to customers and prospective customers? Information on price is valuable for just about any used item, but especially for a category like old cars where comparables are hard to find. In 2017, Hagerty began offering membership in a drivers club, which offers automotive discounts, roadside service and more. Hagerty has also set up a marketplace where people can buy and sell classic cars online. Hagerty charges no fees; it benefits just from being the center of attention. Last year, it bought a small carrier so it can serve customers directly.

Along the way, the company made some smart marketing moves, too. It launched a magazine in 2000, bought well-known events such as the Greenwich Concours d'Elegance and even worked its way into a presence in the Gran Turismo video game.

While owners of classic cars and motorcycles are a breed apart, perhaps matched in their enthusiasm only by certain groups of boat owners, agencies and carriers can fulfill all sorts of other needs, even if they're far lower on the excitement scale. 

I'm enthusiastic, for instance, about Empathy. While life insurers pay the death benefit and agents facilitate the bureaucracy associated with getting the claim, lots of the beneficiaries could use much more, well, empathy. They're facing a daunting series of processes — dealing with a funeral home, perhaps arranging a memorial service, notifying friends and relatives, and on and on and on. Many are going through the unfamiliar, intimidating process for the first time, while dealing with waves of emotion. Why not use Empathy or set up a similar service that goes beyond the insurance piece and helps people navigate the first month following a death? Why not say: "We've been here before. We know what you're going to deal with. Let us help."?

I'm likewise delighted by some of the innovations in P&C, where carriers are telling clients that they'll help protect their homes, not just pay to repair them after a loss. Whisker Labs is my poster child, with its Ting device that plugs into a wall and detects electrical faults that could lead to home fires. Some 34 carriers now provide the device and service free to customers, and I love the message that sends. I'm sure the carriers are finding that customers do, too. Water leak sensors aren't quite as far along in terms of cost-effectiveness, but they're getting there, and I hope carriers will start providing those for free, too, before long. 

Workers' comp, where huge progress has been made in preventing injuries, has also demonstrated the benefit of adding service that takes great care of the individual. If an injured worker feels ignored, they may take longer to recover and may even seek legal help. If an advocate calls them shortly after an injury, expresses concern and helps walk them through the whole recovery process, the results have proved to be better for everyone. 

There are surely other areas, too, where carriers and agents and brokers are going well beyond their contractual obligations. I just wanted to call attention to Hagerty as an example of how lucrative it can be to expand beyond the basic insurance product and tackle the full needs of a client. 

$4 billion is a rather nice market value for a small insurance agency to grow into.

Cheers,

Paul

Cybersecurity has fought a long, hard battle with alert overload.

Most companies throw money and workforce at the problem until they reach a point where they can't throw any more. Attrition and layoffs often follow as unjustified costs with no ROI are cut. As each member of the IT team departs, the organizational knowledge and context become increasingly elusive. Managed service security providers (MSSPs) and managed detection and response firms (MDRs) may come in as a saving grace, but that leaves the problem outsourced and still unresolved.

It's no surprise that forward-thinking organizations are turning to artificial intelligence to revolutionize their security operations centers (SOCs). But what might be surprising beyond the technological benefits is a compelling ROI use case: AI SOC agents deliver measurable returns that can transform an organization's security budgets from a cost center into a strategic investment.

The Rising Costs of Traditional SOCs

Staffing a typical enterprise SOC requires a staggering investment in human resources that extends far beyond analyst salaries. The total operational expenditure balloons when factoring in benefits, continuous training, and the high costs of employee turnover, creating a massive and perpetual financial burden for organizations.

Beyond financial impact, SOC teams are wasting 25% of their time chasing false positives. All this while the average security incident costs $4.4 million in real dollars when considering downtime, data loss, and remediation efforts (while not factoring in lost business, negative publicity, and reputation damage).

Traditional SOCs also struggle with coverage gaps since human analysts can't maintain consistent vigilance across three shifts. This results in detection misses, as well as delays during off hours, creating inconsistent coverage and opening vulnerable windows that sophisticated attackers know to exploit.

The ROI AI SOC Can Deliver

Organizations implementing AI SOC agents report dramatic improvements across numerous financial metrics, some reducing costs by up to 80% in their security operations budgets, all while simultaneously improving threat detection accuracy.

The primary ROI drivers include reduced response times since AI agents investigate alerts in minutes rather than hours, reducing Mean Time to Resolution (MTTR) by 3x. This acceleration directly translates to reduced incident costs, with faster containment limiting the reach of security breaches.

AI SOCs also eliminate alert fatigue by automatically triaging and filtering false positives. As a result, AI agents enable human analysts to focus on actual threats. For example, organizations using AI SOC solutions report that analysts spend 90% of their time on high-value activities rather than mundane alert handling. In addition, AI agents provide uninterrupted monitoring without degradation in performance, preventing coverage gaps that attackers can exploit during off-hours.

Realizing Annual Savings

By implementing an AI SOC, enterprises can significantly reduce costs while enhancing efficiency. Instead of continually expanding analyst headcount to keep up with rising alert volumes, organizations can streamline existing teams into smaller, more specialized units. This shift not only cuts substantial operational expenses but also improves job satisfaction for security staff, who can now focus on higher-value work rather than being buried in routine alerts.

AI agents process alerts at a speed no human team can match—consistently outperforming human analysts in battle-like environments nearly 95% of the time. Their precision, consistency, and ability to scale make them unmatched when it comes to rapid detection and response. Yet, the future of security operations won't belong to machines alone. True resilience will come from the balance between relentless AI-driven execution and human strategic oversight. AI handles the grunt work—sifting through noise, prioritizing threats, and executing playbooks—while humans focus on what they do best—critical thinking, creative strategy, and adapting to the unexpected. Together, this hybrid force redefines how security teams win against evolving adversaries.

Additional Cost Savings With AI SOC

Organizations also realize additional financial benefits of AI SOC agents beyond immediate cost savings. A critical benefit of AI SOC is an improved security posture that can enable business growth initiatives previously unreachable. For example, threat hunting capabilities identify vulnerabilities before they're exploited, preventing costly breaches and regulatory penalties. The average data breach fine in many jurisdictions now exceeds $2 million.

In addition, when it comes to the competition, AI SOC-powered organizations can respond to threats faster than competitors, protecting market position and customer trust. This competitive advantage can preserve revenue streams and enhance brand value.

Maximizing AI SOC Implementation ROI

To maximize ROI from an AI SOC implementation, organizations should follow some essential guidelines.

To start, successful deployments integrate AI agents with existing security infrastructure rather than replacing entire systems. After that, the transition from manual to AI-assisted workflows requires careful planning, so organizations should invest in analyst training and gradual responsibility transfer. Finally, AI agents improve over time through continuous machine learning, but organizations must actively participate in this optimization process to maximize returns.

Security Investment for the Future

AI SOC agents represent more than technological security investments; they're a fundamental shift in how organizations approach cybersecurity economics. By moving security operations from reactive cost centers into proactive value generators, AI enables the strategic security posture that modern businesses require.

The annual savings discussed are not just about cutting costs; they also allow for reinvestment of AI-generated savings into strategic security initiatives that drive business growth. As cyber threats continue to evolve, organizations that embrace the AI SOC advantages today will be better equipped to handle tomorrow's challenges while maintaining the financial flexibility to invest in future innovations.

For organizations evaluating AI SOC implementation, the question isn't whether they can afford to invest; it's whether they can afford not to. In an era where cyber threats grow more sophisticated daily, AI SOC agents are the only way to keep up. They provide a scalable, cost-effective solution that transforms security from a necessary expense into a competitive advantage.

For years, CISOs have relied on a defense-in-depth strategy built with layers of security to protect the physical perimeter, the endpoint, the applications, and the data that flows between them. While a best practice in its day, this approach has left many organizations in a state of entrenched "product sprawl," coping with a patchwork of disparate tools and consoles, each designed to do its job but not necessarily to work well together. The inherent shortcomings in this legacy architectural approach are being exposed at a moment when the volume of data flowing through enterprise environments is exploding and the number of hybrid and remote users has surged, leading to visibility gaps, alert overload, slow response times, conflicting policies, rising costs, and reduced security effectiveness.

Fundamentally, the attack surface has changed beyond recognition, and it's clear that traditional approaches cannot address the increased complexity of modern networks. The concepts behind Secure Access Service Edge (SASE) represent a needed paradigm shift in how we think about security architecture by converging security and networking into a single, integrated, cloud-delivered platform that vastly simplifies how we connect and manage on-premises and remote entities.

In recognition of the just-concluded Cybersecurity Awareness Month, let's look at the top five ways SASE transforms enterprise security:

1. Security and networking convergence

In legacy architectures, networking and security are built and operated separately. Security solutions such as NGFWs, SWGs, VPNs, CASBs, etc., sit apart from networking components like routers, SD-WAN controllers, and WAN optimizers. Each tool has its own policy engine and controls its own data flow, making it complex to stitch them together to work in concert.

Advanced SASE solutions eliminate this divide by unifying these functions, not just yoking them together. Instead of hop-by-hop inspection service-chained across multiple appliances, security is applied natively within the traffic flow, providing seamless network and policy enforcement that streamlines operations, reduces latency, and closes gaps.

2. Single-pane-of-glass visibility

With traditional tools, security teams must pivot from one interface to another, trying to manually identify indicators of compromise with delayed or contradictory data.

In contrast, SASE gives networking and security teams a unified control plane. They gain full visibility into users, devices, applications, and threats across the entire infrastructure – from branch to cloud to remote endpoints. As a result, log correlation becomes faster, enriching data and allowing responses in real time.

3. Modernized defense-in-depth

Defense-in-depth isn't dead as a concept, it's just evolved. SASE provides all the core pillars of layered security (NGFW, intrusion prevention, DLP, ZTNA, CASB, SWG, etc.), but as coordinated capabilities in a single architecture. Policies apply equally everywhere, unlike with legacy tools, where policies may apply only in certain locations, leading to inconsistent enforcement in a hybrid world where users are constantly moving between corporate networks and connecting from anywhere.

The value of delivering defense-in-depth capabilities within a single architecture can be found in cohesive, layered protection without the operational burden of stitching together multiple point solutions, thus providing inline control for real-time defense. This enables immediate, coordinated action, and allows security functions such as ZTNA, NGFW, SWG, IPS, and threat intelligence to share context and enforce unified policies. This approach reduces gaps, eliminates redundancy, and simplifies management to strengthen security posture while improving performance and efficiency.

4. Zero Trust built in

The Zero Trust philosophy of "never trust, always verify" is critical in today's evolving threat landscape. Yet many organizations limit Zero Trust Network Access (ZTNA) to remote users, while sticking with traditional perimeter security and network access control solutions for in-office authentication. This creates uneven security coverage and leaves gaps where implicit trust is persistent after initial access. Advanced SASE solutions embed Zero Trust principles across all entities regardless of their location. A device's posture is continuously evaluated, least-privilege access is dynamically enforced, and identity-aware security policies allow for microsegmentation to restrict lateral movement. All policies are centrally managed and auditable to ensure consistent, adaptive protection everywhere.

5. AI made effective

Advanced SASE platforms also lay the foundation for AI-driven security by providing enriched data for all entities that can be parsed and correlated via a single system, enhancing the Zero Trust model by eliminating blind spots and enabling deeper, more accurate analysis for faster remediation. AI poses a problem for traditional solutions, which use their own built-in AI and therefore know how to enrich only their own data. When it comes to working with other solutions' enriched data, a third-party solution such as a SIEM is needed that can take this data, parse and correlate it as needed, and display it in a way that showcases indicators of compromise and real and potential threats.

Security leaders find themselves with an incredible challenge. The threat landscape is evolving faster than ever, and legacy tools are failing to keep up. The pressure to consolidate, simplify, and modernize has never been greater. SASE offers a way forward with a new architecture that's faster and smarter and meets the reality of how businesses operate today.

The banking, financial services and insurance sector (BFSI) has a problem. While nearly every industry leader agrees that digital transformation is business-critical, new research from Iron Mountain and HFS Research uncovers a stark disconnect between aspiration and action, with 78% of BFSI executives globally warning that failing to digitize could result in permanent competitive irrelevance.

The Back Office: No Longer Just Support

The back office has evolved from a support function to the backbone of operational resilience, regulatory compliance and differentiated customer service. Despite this, most organizations are struggling to move beyond legacy, paper-driven processes. While 81% of BFSI executives globally believe artificial intelligence will soon handle the vast majority of routine back-office tasks, only 13% have deployed AI at any meaningful scale. And while 77% believe the traditional back office will disappear within three years, only 21% are "radical transformers"—the organizations making bold moves to get there.

This leaves the BFSI industry to face an uncomfortable truth: The opportunity to achieve compliance, resilience and efficiency through digital and AI-powered operations is within reach, but only for those willing to move beyond incremental change. In today's BFSI sector, transforming the back office isn't just a lofty goal, it's become a business necessity. While many leaders are making ambitious plans to overhaul their core operations, turning that vision into reality remains a challenge.

The following seven hard truths highlight the disconnect between digital aspirations and the persistent realities of legacy systems, underscoring the struggle between commitment and true readiness for change.

Seven Hard Truths Reshaping the BFSI Back Office

1. Failing to digitize means falling behind permanently: Digitization has become a critical business success factor, with the overwhelming majority of leaders recognizing that organizations that do not act now could fade into irrelevance. Back-office transformation has shifted from a technological luxury to a strategic necessity.
2. Ambition outpaces action: While many organizations have expressed commitment to digitization and AI integration, only a small minority have successfully implemented AI-powered tools and systems on a large scale.
3. AI readiness is a workforce challenge: AI is poised to handle the majority of routine back-office work, with 81% of executives expecting AI agents to manage at least 75% of these tasks. Yet only 27% of organizations feel their teams are ready for this shift, representing a critical skills gap that could impede digital transformation efforts.
4. The "zero office" is still aspirational: While 77% of leaders believe the traditional back office will vanish within three years, replaced by an automated "zero office," only 21% are taking the bold steps needed to realize that vision. Most are hesitant, caught between legacy and opportunity.
5. Compliance drives change, but capabilities lag: Regulatory compliance is a top driver for back-office transformation. However, only 31% of BFSI firms have predictive, real-time compliance capabilities. As regulations accelerate, organizations must move from reactive to proactive compliance.
6. Investment and expectation are both high: BFSI firms plan to invest an average of $25 million each in back-office transformation over the next two years, with most demanding a return on investment in less than 24 months. This urgency requires clear priorities and a willingness to break from business as usual.
7. Only radical transformation yields true results: The research also spotlights a group of radical transformers—just 21% of respondents—who are investing in enterprise-wide reinvention. These organizations are already reporting higher revenue growth. In contrast, 79% remain stuck in incremental or limited transformation, risking long-term stagnation.

Radical transformers stand out not just in confidence but in results. These organizations treat back-office transformation as a growth engine, not a cost-cutting exercise, and they are seeing stronger revenue growth than their peers as a result. Their intent is matched by action: They invest more aggressively and target transformation that delivers enterprise-wide impact, not just incremental improvements.

For these leaders, customer experience is the guiding star. They view the back office as a direct driver of competitive differentiation, ensuring that every process ultimately supports better digital interfaces and client outcomes. Radical transformers also move quickly to adopt emerging technologies, building fluency in AI, automation and compliance tools that others are still piloting.

Crucially, they recognize that people are at the heart of transformation. Investment in upskilling and workforce readiness is central to their strategy, enabling teams to thrive in AI-driven, prompt-led environments. And while others focus on reducing risks or costs, radical transformers measure success by growth-oriented metrics, including innovation, customer experience and new value creation.

From Incrementalism to Bold Action: The Path Forward

The message from the research is unmistakable: Incremental change is no longer enough. Piecemeal digitization will not bridge the digital ambition gap or deliver the resilience, compliance and customer focus the industry demands. Only bold, enterprise-wide actions such as rethinking processes, investing in talent and scaling AI will separate tomorrow's leaders from the rest.

With BFSI firms accelerating investment and demanding rapid ROI, there is no room for hesitation. Those who move decisively now will shape the future of the industry. Those who delay will be left behind.

Businesses today are drowning in data. With everyone working from anywhere, the cloud taking over, and "bring your own device" (BYOD) policies running rampant, data is spread out, moving quickly, and constantly changing.

In the meantime, cyberattacks are getting smarter and faster. Collaboration tools have made sharing data extremely easy, and even GenAI is leaking data. As if that's not enough, compliance requirements are constantly evolving. With limited budgets, understaffing, and expansive skills gaps, it's no wonder IT and security teams feel overwhelmed.

Operationalizing data security has been a challenge for decades. Despite costly investments and countless hours of labor, admins are still flying blind. Legacy data security tools that require regex, trainable classifiers, or other pattern-based methods catch only a small fraction of sensitive data and bury IT teams in false positives.

The good news is that there are new, modern data security governance platforms available today that have ditched the legacy approach. In particular, businesses should seek solutions that leverage context-aware AI for discovery, risk monitoring, and remediation that can deliver the following benefits:

Superior visibility into their data: To effectively protect sensitive data, organizations first need to know precisely what data they have, where it's hiding, who's peeking at it, and how it's being shared.

Context-aware AI scans each data record in its entirety and can not only locate personally identifiable information (PII) and payment card information (PCI) but can even find things like intellectual property (IP) and other critical business records that other tools miss since this data doesn't usually contain patterns. Additionally, AI can identify duplicate or near-duplicate data, as well as the category and subcategory of each record. For example, it knows the difference between a bank statement and a corporate tax form or a resume versus a job application. Having this level of granularity enables security teams to make better-informed decisions when assigning classification labels, establishing where data should be located, or setting access and retention policies.

Stopped sensitive data leakage: Not only must security teams make sure that employees and third-party contractors aren't accessing data that they shouldn't, but they also must ensure that the users who are authorized to access it aren't sharing it. They should seek a solution that helps them contextually discover, monitor, and protect their sensitive data, not just at rest, but also as it travels to ensure that it isn't being shared with unauthorized users, personal email addresses, file sharing applications, social media, or GenAI applications.

Enabled GenAI without expanding the attack surface: GenAI is reshaping our world in real time. Tools like Microsoft Copilot, ChatGPT, Perplexity, and Google Gemini are changing how we make decisions, solve challenges, create content, and engage with others at work and home. But while they bring greater operational efficiencies, improved decision-making, and reduced costs, they also introduce significant data security risks.

Organizations need a solution that helps them identify when employees are using unsanctioned, or "shadow" GenAI, so they can regain control and keep their data secure. They also need to ensure that, regardless of where their data is located, it is accessed by the correct identities, at the appropriate times, and for the intended purposes. A truly comprehensive data security governance solution will enable them to define guardrails on what type of data should be blocked or redacted by groups and for each GenAI application and help them curate data when training their own proprietary GenAI workloads.

Aced regulatory compliance audits: Regulatory frameworks help businesses mitigate risks, operationalize processes, and maintain customer trust. But mapping security controls to these frameworks can quickly feel overwhelming. Adding further complexity, different industries and regions can have widely varying data handling and classification requirements. Businesses need a clear view of their compliance status, tools to fix issues, and peace of mind that they're not one audit from disaster. They should seek a solution that provides a dashboard showing their current compliance status with all relevant regulations and security controls, as well as support for custom frameworks. They also need granular visibility into all data records that violate compliance, with the ability to remediate them directly within the platform.

Maximized effectiveness of existing security tools: Tools like zero trust network access (ZTNA) and cloud access security broker (CASB) don't scan data to decide whether to allow or block access. Instead, they enforce policies based on labels, so if those labels are wrong or missing, they could either leak sensitive information to unauthorized users or block access needed for productivity. Context-aware AI and autonomous classification help ensure that sensitive data is labeled correctly and only accessible by authorized individuals.

Faster ROI, smarter policies, and less stress: Context-aware AI significantly speeds up the data discovery process and saves countless hours that administrators used to spend on algorithm tuning and chasing false positives. However, since new data is constantly generated and is always changing, capturing only a snapshot of the data at a single point in time is not enough. Security teams can save time and enhance data protection by implementing a solution that continuously monitors data, flags risks, and automates remediation steps. Choosing a provider that offers managed services can also reduce the burden on overstretched security teams by providing data security experts to assist with tasks ranging from deployment to training their teams on the platform, building a data governance roadmap, mapping classification labels, reporting, and tracking continuing progress toward their objectives.

AI agents aren't just another layer of automation—they mark a fundamental shift in how insurers can scale decision-making and operations. Unlike traditional tools, they can interpret context, provide recommendations and carry out tasks across multiple systems. For insurers, this isn't about just answering questions—it means executing real work and driving measurable outcomes.

For example, an underwriter can ask an AI agent to review broker submissions, extract risk data and suggest pricing tiers based on historical patterns. A business analyst can use an AI agent to analyze customer lifetime value and identify new retention strategies. A product manager can even have an AI agent configure new insurance products based on specific business requirements. These agents accelerate operations and improve efficiency while leaving judgment and final decisions in human hands.

AI Experimentation Is Not Enough

The potential is clear, but the reality is more complicated. According to Boston Consulting Group, 67% of insurers have experimented with AI, but only 7% have scaled it across their organizations. That means the vast majority remain in pilot mode, running isolated experiments that rarely expand into enterprise-wide capabilities.

That gap between promise and practice is where insurers risk falling behind. AI agents can deliver real value, but not if they remain trapped in proofs of concept. Scaling requires more than one-off pilots—it demands modern infrastructure, aligned leadership and interoperable systems that can evolve alongside the technology itself.

AI Agents Require Modern Infrastructure and Interoperability

Several technological obstacles keep insurers from deploying AI agents at scale. Legacy systems still dominate many organizations, making it difficult to connect AI to core functions like policy administration, billing and claims. Data is often fragmented, inconsistent and locked in silos, limiting the usefulness of even the most advanced models.

Even when insurers modernize their infrastructure, interoperability quickly becomes the new barrier. Today's AI ecosystem is highly fragmented, with each platform requiring custom development to connect with insurance workflows. The result is a patchwork of brittle integrations that are expensive to maintain and risky under real-world demands. Technical debt and compliance pressures only add to the complexity.

This creates vendor lock-in. Carriers often stay with a platform not because it's the best fit but because switching would mean rebuilding their entire AI infrastructure from scratch. The consequences are serious: Innovation slows, costs rise and insurers lose access to emerging capabilities that could deliver better results.

Enter the Model Context Protocol (MCP)

There have been several attempts to solve the AI interoperability challenge. Solutions like LangChain provided some help but locked organizations into specific frameworks, while function calling still required custom glue code for each connection. These early frameworks proved the demand for better connectivity but also exposed the limits of proprietary approaches.

In contrast, the MCP, introduced in 2024 by Anthropic, establishes a universal, open protocol—similar to USB for hardware—that lets organizations write a connector once and use it across different AI models and providers. This standardization eliminates redundant work, enables clean separation between data sources and AI applications, and creates a true plug-and-play ecosystem for AI agent connectivity.

For the insurance industry, the implications are significant. MCP allows AI agents to execute workflows securely, with auditability and governance built in. It enables portability, so organizations can switch AI providers without rebuilding their integration layer. And it accelerates innovation, since new AI tools can be adopted faster and with less friction.

MCP isn't perfect, but it's the most widely adopted solution so far—and a major leap forward in enabling open, interoperable AI systems. That's why it has quickly gained traction among enterprise software leaders including Salesforce, Snowflake, Atlassian, Hubspot and many more.

How Core Platforms Can Deliver AI Connectivity

MCP solves the interoperability challenge, but it does not address the underlying data problem. AI agents are only as effective as the data they can access. If insurers rely on legacy systems with siloed or inconsistent data, even the most advanced AI deployments will underperform.

This is why insurers need modern core platforms built for data fluency—the ability to access accurate and complete data whenever it's needed, in whatever form the business requires. A data-fluent core platform provides:

• Cloud-native data availability and performance to support real-time workflows
• Flexible data access, such as open APIs, data lakes and event streams
• Complete and governed data with metadata, lineage and auditability for compliance

When paired with MCP, a data-fluent core creates the ideal foundation for agentic AI. It ensures that AI agents can connect seamlessly to critical workflows while reasoning across high-quality data. Together, they unlock not just isolated efficiency gains but the potential for enterprise-wide transformation.

The Path Forward

Even with interoperable systems and data-fluent cores, AI agents cannot operate in a vacuum. In a regulated industry like insurance, transparency and accountability remain nonnegotiable. Human-in-the-loop governance—reviewing recommendations, validating outputs, and ensuring fairness—will be essential to earning trust and meeting regulatory requirements.

The insurance industry has reached an inflection point. AI agents are powerful enough to reshape underwriting, analytics, and product design, but scaling them requires both standards like MCP and modern core systems designed for AI connectivity. By embracing open, interoperable architectures, insurers can avoid vendor lock-in, reduce complexity and accelerate innovation.

The winners will be those who understand that AI is not just about smarter models—it's about building the infrastructure that allows those models to thrive. With the right foundation in place, insurers can finally move beyond pilots and unlock AI as a true engine of innovation and growth.

Congress's sweeping reductions to Medicare and Medicaid funding have set the stage for a decade of disruption in the U.S. healthcare system. The headline numbers are staggering: nearly $1.4 trillion in combined cuts over 10 years, reshaping the safety net programs that tens of millions of Americans rely on.

For insurers, the issue goes deeper than dollar amounts. It's about communication. Every coverage adjustment, every eligibility requirement, and every treatment approval must be explained and confirmed, often across multiple parties, before care can proceed. CIOs are suddenly staring down a future where communication infrastructure is the backbone of the entire business, rather than just IT.

Imagine a patient awaiting a time-sensitive surgery, only to have it postponed when a pre-authorization notice is delayed or lost in the system. Follow-up care could be delayed if the insurer never receives a discharge summary. Even something as routine as a coverage update arriving late can cause panic and confusion for a family already under stress.

Rural providers face even more formidable challenges. Small hospitals and clinics are already battling staff shortages and financial strain, and with $137 billion in cuts looming, those pressures are expected to intensify. Many of these facilities still rely heavily on fax because inconsistent broadband access in rural America and limited budgets for digital transformation mean older technologies remain a lifeline. As more patients move from public to private coverage, insurers must prepare for a surge in fax-based communication, not a decline.

This dual reality of modern digital channels and legacy tools means insurers need communication strategies that bridge both worlds. CIOs can't afford to let legacy systems create bottlenecks, nor can they risk patient trust by relying on generic digital tools.

One technology stands out: cloud fax. Unlike traditional fax servers, cloud-based faxing is scalable, transparent, and compliant with industry standards like HIPAA. It integrates smoothly with on-premise, hybrid, and cloud environments, reducing ineffective workflows and ensuring sensitive documents move quickly and securely between providers and insurers. Costs decrease, visibility improves, and compliance boxes get checked without slowing operations.

So where should insurers start? A practical roadmap for CIOs includes three steps:

1. Assess. Identify the customer segments and workflows most at risk. How many policyholders will be affected? Which communication channels will see the heaviest surges?
2. Evaluate. Test your current systems under pressure. Can they scale? Do they deliver consistently? Are compliance and redundancy baked in?
3. Act. Move decisively toward modern, cloud-native platforms that can flex with demand. Partner with providers that understand the stakes in healthcare — not just IT vendors but specialists in secure, regulated communication.

It's tempting to view these challenges as purely technical. But at their core, they're about people. Patients who don't know whether they're covered, doctors waiting for a green light before treating someone in pain, or families making decisions under enormous stress. Every communication failure ripples outward into real lives.

That's why, in the post-cuts era, insurers must treat every message as a lifeline. Those who invest in resilient, secure communication workflows today will be the organizations patients and providers trust tomorrow. Those who hesitate risk finding themselves overwhelmed at best, irrelevant at worst, in a healthcare landscape that isn't slowing down for anyone.

Generative AI (GenAI) promised insurers quick wins, yet most pilot programs stall out before they can deliver real business value. In fact, a recent MIT study found that nearly 95% of generative AI initiatives never move past the initial pilot stage. Datos Insights, an insurance research firm, concurred.

This isn't just a missed opportunity, though. It's a red flag. With AI moving faster than any technology that insurers have adopted before, failing isn't an option. Companies that can successfully adopt AI are those that learn to fail fast, iterate quickly, and focus on practical applications.

Four Common Pitfalls Holding AI Back

If AI is so powerful, why are nearly all pilots failing? For insurers, it often comes down to making the same missteps over and over again. These aren't technical failures as much as strategic ones. Below are the four most common mistakes insurers make when rolling out AI — and how to avoid repeating them.

Mistake 1: Confusing Building for Innovation

Many insurers believe success requires building AI capabilities in-house. Yet MIT's research shows vendor-built solutions succeed twice as often as internal builds.

That doesn't mean "buy and forget." Startups carry vendor risk, and custom development is rarely worth the cost or maintenance. The smarter path is to work with enterprise platforms that insurers already use. Providers like Microsoft, Salesforce, and Amazon continue to expand their AI services, offering reliable, secure, and scalable options without requiring teams to reinvent the wheel.

Mistake 2: Chasing the Shiny Object Instead of the Sure Bet

Too often, AI budgets flow into customer-facing applications such as chatbots, lead-scoring tools, or digital assistants. These may look impressive in a board deck but are difficult to validate and introduce risks insurers aren't prepared to manage.

The fastest return on investment (ROI) is usually in the back office. Automating document ingestion, workflow routing, and data extraction saves thousands of hours and frees staff to focus on higher-value work. These high-volume, repetitive processes are exactly where AI performs best, yet they're often ignored in favor of harder-to-execute, more glamorous projects.

Mistake 3: Expecting Perfection Out of the Gate

We often judge AI by unrealistic standards. We'll allow a junior underwriter a learning curve, but if AI makes mistakes on day 1, it's branded a failure. Like a new employee, AI improves with use, with accuracy and efficiency increasing over time.

Workforce anxiety compounds this challenge. If employees fear AI could replace them, they're quick to dismiss its early missteps. Leaders need to reframe the narrative: AI isn't about replacing jobs but about removing repetitive tasks so people can focus on higher-value decisions. Success depends on setting reasonable expectations and building trust in the process.

Mistake 4: Overthinking Instead of Taking Action

Lengthy RFPs, demos, and vendor evaluations can consume months or even years, creating the illusion of progress while manual processes remain unchanged.

Ironically, many insurers already own the AI tools they need through enterprise licenses. Capabilities like Azure Document Intelligence, Power Automate, and Copilot services can automate document intake, claims routing, and workflow support right now. The fastest path to value is often activating existing capabilities rather than prolonging procurement cycles.

Taken together, these missteps explain why so many pilots stall out — but they also highlight the path forward. The insurers that are breaking through have a very different playbook.

What Successful AI Programs Do Differently

Not every insurer is struggling. A small percentage — 5%, in fact — are moving beyond pilots and seeing measurable results. Here are some common traits they share:

• They narrow the focus. Instead of chasing enterprise-wide transformation, successful organizations zero in on a single pain point. Solving one operational problem creates quick wins, builds credibility, and sets the stage for expansion.
• They start with the obvious, not the flashy. Rather than automating complex underwriting decisions, they tackle the "boring stuff" first, such as email routing or workflow handoffs. These repetitive tasks are high volume and easy to supervise. And while they deliver clear ROI, they also provide a non-threatening way to introduce AI to the organization.
• They execute quickly. Long planning cycles kill momentum. Successful programs prioritize speed by testing, validating, and deploying in weeks. Short feedback loops enable them to refine models in real-time and maintain value flow.
• They partner with proven providers. Rather than betting on untested startups or building everything internally, they lean on the AI services offered by large, established cloud vendors. This reduces risk, simplifies integration, and ensures security and compliance standards are met.
• They set realistic expectations. AI doesn't need to be flawless to be transformative. If it outperforms the manual process, then it's a win. Successful insurers measure against that baseline, not against perfection.

The bottom line: These organizations succeed because they've redefined what success looks like. They don't expect AI to reinvent the business overnight. Instead, they use it to quietly, steadily strip out inefficiency, building both measurable ROI and organizational trust in the process.

Creating a Way Forward

Insurance leaders have a choice: keep overengineering and overpromising, or simplify, act, and deliver. The technology is ready, the platforms exist, and the use cases are obvious.

What's missing is the discipline to execute with focus and speed. Insurers that figure this out in 2025 will gain compounding advantages in efficiency, cost savings, and customer satisfaction. Those that don't will still be explaining to boards why their AI initiatives haven't moved the business metrics that matter.

Don't be part of the 95%. Join the 5% who are making the right choices.

The global insurance industry is built on the concept of helping people at a time of great need. This extends beyond assisting policyholders by helping to protect their homes, businesses and so much more to include becoming a force for good across our communities through charitable giving and volunteerism. Every day, professionals across our industry roll up their sleeves to offer their time and talent, and to give generously, in support of the communities where they live and work.

Our industry provided $1.3 billion in charitable contributions in 2023, along with more than 500,000 professionals giving of their time to volunteer, according to the most recent data gathered at the Insurance Industry Charitable Foundation. These figures reflect 100 insurance and insurance-related organizations.

The insurance industry also recognizes that helping others is not only good for the community but good for business. Positioning our board member companies at the forefront of community involvement and highlighting their social impact programs can help showcase the good the industry does while focusing attention on those in need.

Ours is an industry that appreciates the power of collective strength in working together to make a greater impact. At the heart of many influential efforts is our organization – The Insurance Industry Charitable Foundation (IICF), which, by working with the global insurance industry for more than 30 years, provides grants, volunteer service and leadership programs throughout the U.S., U.K. and, beginning this year, in Canada.

Each October, IICF hosts a global Month of Giving, celebrating insurance industry volunteerism throughout the year and highlighting philanthropic commitment in action. In this article, we'll talk about some insurance industry initiatives that make a difference in local communities and provide best practices to build a successful philanthropic program.

The New Normal

The evolution of work over recent years has had a significant impact on philanthropy and charitable giving. Whether operating in a remote or hybrid environment, a daily 9-to-5 or in-the-office structure is no longer a reality for many insurance professionals. As such, the ability to find and connect with people is critical, along with turnkey avenues for philanthropy given that people are spread across multiple locations, geographies and time zones.

IICF's Fill the Truck Food Drive is an example of a turnkey initiative that meets people where they are. Created and implemented during the pandemic as a safe, socially distant way to donate much-needed food, Fill the Truck also provides a pathway for various areas of connection in the form of in-kind donations and financial contributions from an organization to individuals donating and facilitating the collection and delivery of food. Since its inception, this program has grown to deliver thousands of meals across the West and Southeast U.S. regions through the IICF's food bank partners.

Another distinct challenge when navigating philanthropy in today's business environment is striking the right balance between corporately supported initiatives and causes and the varied, and often more locally based, charitable passions of individual employees. Both are important and carry a considerable role in shaping corporate culture, and the quality of business, employee and community connection. Embracing both a top-down and bottom-up approach is important, helping to ensure that the philanthropic avenues are not only strategic, but also authentic in their connections.

For instance, one long-serving IICF board company, Brown & Brown, had been seeking to engage its summer interns with philanthropy in a meaningful way. Through the organization's Next Gen Connect Program, IICF helped facilitate connections with nine nonprofits from around the country. The 61 Brown & Brown interns developed social media campaigns, created impact videos and supported several functions that small and medium-sized nonprofits do not have the capacity to coordinate. The project instilled a sense of purpose among the group of interns and goodwill toward our industry, while providing fulfilling and relevant experiences.

This is just one of thousands of volunteer efforts from our tremendous partners and their colleagues. Each year IICF features the contributions of our Key Partner Companies, those companies supporting us at the highest leadership level, in an annual publication that shines a spotlight on their extraordinary contributions through charitable giving, volunteerism and innovative industry leadership. The impact can be viewed in the 2024 IICF Insurance Industry Philanthropic Showcase.

Setting the Foundation

I have always believed the building blocks of a successful community outreach program already exist within each organization; the key is properly identifying this foundation through the organization's collective values. For example, a company's clients – and their own employees – are already connected within their own communities and are acutely aware of their neighbors' needs. To that end, insurance leaders should aim to gain a deeper knowledge of programs already in place and expand on them to benefit the community.

Second, I like to urge organizations to benchmark participation and effectiveness of any programs in place, the same as any successful business would benchmark operational goals. Good measurement of outcomes will enable a company to understand its current position and determine how to effectively develop or expand its philanthropic strategy.

Finally, companies should identify the top performing champions of philanthropic programs and empower them to drive and grow those efforts. These "doers," are the champions who are truly passionate about connecting the community and the selfless purpose behind charitable giving. Organizations that can effectively harness that employee passion will reap the rewards – including a positive reputation across the community, and enhanced employee recruitment and retention. Some thoughts for consideration to develop a greater employee connection:

• Cultivate connections. Effectively communicate the reason for launching a charitable campaign or a coming volunteer event to drive employee engagement.
• Make involvement easy. Create a variety of options for engagement and opportunities to connect. Not everyone has the time, ability or financial resources to contribute to every single cause. Make it easy for people to engage by giving them opportunities to amplify a philanthropic message via social media, or throughout the community without needing to commit time or financial contributions.
• Share the successes. Contextualize the impact of a particular donation or volunteer effort and celebrate the successes. Make your teams aware of how their contributions have made an impact on a particular campaign, mission or nonprofit organization. This can be done through sharing success stories or clearly identifying how donated funds will be deployed in the community.

The IICF is privileged to have nearly 300 board companies, and more than 800 individual insurance professionals serving on its boards and committees across the U.S., Canada and the U.K. These include organizations, individuals and teams passionate about doing good in the world and making our communities better for all. Building even stronger connections among employers, employees and the community benefits all involved. And participation in our Month of Giving is a great start - find out how you can get involved by visiting https://www.iicf.org/.