SecurityScorecard Report: 59% of Breaches Impacting Insurance Sector Caused by Third-Party Attack Vectors

Report highlights need to address third-party risks as cybersecurity gaps threaten critical services and policyholder trust

NEW YORK--(BUSINESS WIRE)--SecurityScorecard today released new research showing that 59% of breaches among the top 150 insurance companies involved third-party attack vectors, exposing critical vulnerabilities in the sector’s supply chain. These findings underscore the systemic risks posed by cyber threats to an industry responsible for safeguarding sensitive financial and personal information.

The insurance industry's interconnected network of carriers and reinsurers to brokers, claims processors, and specialized IT providers is essential for delivering services to hundreds of millions but also introduces significant cyber risks.

Andrew Correll, Senior Director of Cyber Insurability, said: “Insurance companies’ reliance on technology to manage daily operations has outpaced their ability to secure it. Cyber risks don’t stop at the first layer of defense — they extend deep into the supply chain, where vulnerabilities are harder to detect and even harder to mitigate. Addressing these risks requires a shift in how the industry prioritizes third-party security.”

Key findings

• 28% of companies reported breaches — higher than the S&P 500 (21%) and double the U.S. energy industry (14%).
• 59% of breaches involved third-party attack vectors, the highest rate observed so far and more than double the global cross-industry average of 29%. Third-party software & IT caused 50% of these breaches.
• Insurance carriers were disproportionately affected by third-party breaches. Although carriers made up about 27% of the total sample, they represented 50% of the companies hit by third-party incidents.
• More than half (56%) of companies had at least one compromised credential in the past two years.
• Malware infections and device compromises affected 17% of companies last year.
• The lowest-scoring cyber risk factors for the sector are application security, DNS health and network security. DNS health rarely ranks among these factors.

Cybersecurity recommendations for the insurance industry

Based on this analysis, the SecurityScorecard STRIKE team offers actionable insights for the insurance sector to strengthen its supply chain:

• Strengthen third-party risk management for insurance carriers: Carriers face elevated third-party risks due to dependencies on low-scoring industry segments, including IT vendors and brokers. Focus on high-risk partners to reduce vulnerabilities and address frequent breaches and credential compromises.
• Ensure vendors have their own effective TPRM programs: Fourth-party risks from vendors’ suppliers are critical but often missed. Ensure vendors have strong TPRM processes to close supply chain gaps and prevent breaches like the MOVEit campaign.
• Avoid paying ransomware demands: Paying ransoms encourages attacks, risks legal issues, and doesn’t ensure recovery. Avoiding payments helps deter criminals and protects the broader ecosystem.

Methodology

This report evaluates the SecurityScorecard ratings and publicly available breach histories of the top 150 companies in the insurance sector to offer clear insights into the state of cybersecurity across the sector. The research organizes the supply chain into five main segments: Insurance carriers; Reinsurance companies; Agencies and brokers; Third-party claims processors and administrators; and Insurance-specific software and IT products and services.

The list of 150 companies was carefully assembled using reliable insurance industry publications and rankings, ensuring accuracy and depth in the findings.

Additional resources

• Download “A Cyber Security Assessment of the Insurance Industry Supply Chain”
• To learn more about SecurityScorecard threat intelligence, visit our website.

About STRIKE

The STRIKE threat intelligence team combines unique threat intelligence, incident response experience, and supply chain cyber risk expertise. Backed by SecurityScorecard technology, STRIKE is a strategic advisor to CISOs worldwide, empowering the entire digital ecosystem to identify, measure, and resolve cyber risk.

About SecurityScorecard

Funded by world-class investors, including Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, GV, Riverwood Capital, and others, SecurityScorecard is the global leader in cybersecurity ratings, response, and resilience, with more than 12 million companies continuously rated.

Founded in 2014 by security and risk experts Dr. Aleksandr Yampolskiy and Sam Kassoumeh, SecurityScorecard’s patented security ratings technology is used by over 25,000 organizations for enterprise risk management, third-party risk management, board reporting, due diligence, cyber insurance underwriting, and regulatory oversight.

SecurityScorecard makes the world safer by transforming how companies understand, improve, and communicate cybersecurity risks to their boards, employees, and vendors. SecurityScorecard achieved the Federal Risk and Authorization Management Program (FedRAMP) Ready designation, highlighting the company’s robust security standards to protect customer information, and is listed as a free cyber tool and service by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Every organization has the universal right to its trusted and transparent Instant SecurityScorecard rating. For more information, visit securityscorecard.com or connect with us on LinkedIn.