Resources Categories
INDUSTRY FACT FILE · INSURANCE INTERMEDIARIES
Market Landscape and the Drivers of Cybersecurity Demand for Intermediaries
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for insurance intermediaries and insurtechs.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: IRDAI 2026 guidelines 5. Legal and statutory drivers 6. How the drivers differ by intermediary type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's intermediary market ranges from large broking houses and bank corporate agents to digital aggregators, TPAs serving several insurers and fast-growing insurtech platforms. Digital distribution and embedded insurance have increased the share of policies that pass through intermediaries' systems—while IRDAI's 2026 guidelines and insurers' partner reviews raise the bar for security evidence.
|
6 Apr 2026 IRDAI's revised guidelines issued |
FY 2026-27 Compliance required from the current financial year |
30 days To submit compliance reports after audit (as reported) |
6 hours Incident reporting to CERT-In |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Large brokers and bank corporate agents |
Many clients, complex integrations, mature compliance teams |
Audits, PT, SOC, BEC protection, insider monitoring |
|
Web aggregators and insurtechs |
Digital-first, API-heavy, cloud-native, fast release cycles |
API and application testing, cloud reviews, AI security |
|
TPAs |
Time-critical claims operations for several insurers |
Claims platform testing, ransomware resilience, SOC |
|
Smaller brokers and corporate agents |
Lean IT, outsourced systems, limited security staff |
Gap assessments, annual audits, managed services |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Regulatory compliance |
IRDAI 2026 guidelines, audits and compliance reports |
Gap assessments, cyber audits, PT |
|
Insurer partner requirements |
Due-diligence questionnaires and onboarding reviews |
Audit evidence, ISO 27001, partner reviews |
|
Customer trust |
Data leaks and scams damage conversion |
Privacy programmes, brand monitoring |
|
Fraud and payment losses |
Premium diversion, fake policies, commission fraud |
Fraud analytics, BEC controls, forensics |
|
Investment and acquisitions |
Investors and acquirers review security posture |
Security due diligence, maturity assessments |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Insurer and partner APIs |
Broken authorisation and mass data exposure |
API security testing and code review |
|
Cloud-native platforms |
Misconfiguration and CSP requirements |
Cloud reviews against IRDAI requirements |
|
e-KYC and document uploads |
Identity fraud and forged documents |
Onboarding and upload flow testing |
|
TPA claims platforms |
Ransomware and medical data leakage |
Claims platform testing and SOC |
|
AI assistants |
Prompt injection and data leakage |
AI security testing and governance |
Figure 3: The four groups of drivers behind cybersecurity spending for intermediaries.
4. Regulatory drivers: IRDAI 2026 guidelines
|
Area |
Key requirements (as reported) |
|
Scope and timing |
Issued on 6 April 2026, replacing the 2023 guidelines; compliance required from the current financial year Applies to insurers and to intermediaries including brokers, corporate agents, web aggregators and TPAs |
|
Audit and reporting |
Cyber security audits by CERT-In empanelled auditors Compliance reports within 30 days of audit completion, according to published summaries |
|
Testing |
External penetration testing at least every six months, grey-box or white-box, by a CERT-In empanelled auditor |
|
Incidents |
Cyber incidents reported to CERT-In within six hours of noticing them |
|
Data, cloud and vendors |
DPDP-aligned measures; classification of personal data; encryption of confidential information MeitY-empanelled CSPs with STQC audit status; data erasure on exit Right-to-audit and sub-outsourcing approval in vendor contracts; supervised privileged access |
|
Insurer oversight |
Insurers remain accountable for policyholder data shared with partners and increasingly require evidence of intermediaries' controls |
|
Confirm against the circular These requirements summarise the 2026 guidelines as reported in public sources. Audit frequency, auditor eligibility and the reporting route for each intermediary category should be confirmed against the official IRDAI circular. |
Figure 4: Regulatory timeline for intermediary cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Insurance Act, 1938 and IRDAI regulations |
Registration and conduct rules for each intermediary category |
Compliance audits and inspection readiness |
|
IT Act, 2000 and CERT-In Directions (28 April 2022) |
6-hour reporting; ICT logs for 180 days in India |
Logging, incident readiness, SOC |
|
DPDP Act, 2023 and Rules, 2025 |
Customer and health data; most obligations from May 2027 |
Consent, safeguards, breach workflows |
|
Consumer protection law |
Fair treatment of customers and complaint handling |
Secure servicing and complaint workflows |
|
Contracts |
Insurer, bank, hospital, client and vendor agreements |
Partner assurance evidence and audits |
6. How the drivers differ by intermediary type
|
Intermediary type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Brokers |
Client trust, premium integrity |
Email, client portals |
IRDAI 2026, DPDP |
|
Corporate agents |
Insurer partnerships, customer trust |
Bank and insurer integrations |
IRDAI 2026, RBI (for banks), DPDP |
|
Web aggregators |
Conversion, insurer partnerships |
APIs, cloud, lead flows |
IRDAI 2026, DPDP |
|
TPAs |
Claims continuity, insurer contracts |
Claims platforms, hospital interfaces |
IRDAI 2026, DPDP (health data) |
|
Insurtech platforms |
Growth, investor scrutiny |
APIs, cloud, AI |
Licence category rules, IRDAI 2026, DPDP |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We need our IRDAI cyber audit.” |
Audit by a CERT-In empanelled auditor and compliance report |
Annual audit and closure tracking |
|
“Insurers keep sending us questionnaires.” |
Audit evidence pack and ISO 27001 alignment |
Annual partner assurance |
|
“Our APIs connect to dozens of insurers.” |
API security testing and secure SDLC |
Release-linked testing |
|
“Our claims platform must not stop.” |
Claims platform testing and ransomware resilience |
Managed SOC and annual drills |
|
“We rely on cloud and SaaS vendors.” |
Vendor risk and cloud reviews |
Annual vendor assessments |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published or reported up to October 2026. It is not legal advice. Confirm obligations against the official IRDAI circular.