(Image credit: editor.)

In insurance, growth is both thrilling and terrifying. Every CIO feels the pressure to modernize systems, move to the cloud, and deliver the digital-first experiences customers now expect. I’ve been through that myself, and when the growth curve takes off it can feel like you’re holding on for dear life.

The real challenge isn’t growth itself but making sure it doesn’t outrun the systems and people meant to support it. Without resilience built in from the start, progress quickly turns fragile.

Growth brings opportunity—and fragility

Most insurers are increasing technology spending, with more than 90 percent focused on cloud migration and data integration. Those investments create speed and new customer value, but they also widen the attack surface.

A platform that works smoothly at 50,000 users may strain at 500,000. A new payment provider might make operations seamless yet add another entry point for attackers. Growth is important, but resilience makes it sustainable.

According to IBM, the average cost of a breach in financial services is $6.08 million—more than 20 percent higher than the global average. That number alone shows how quickly progress can turn into pain if security fails to keep up.

Partners’ weaknesses become your weaknesses

Customers expect instant policy binding, real-time payments, and frictionless claims. Delivering those requires networks of vendors. Nearly 42 percent of breaches in fintech and almost half in financial services overall trace back to third-party providers. To policyholders, that distinction doesn’t matter. They see it as your failure.

That’s why due diligence must go deeper than paperwork. Insurers need to know how partners encrypt data, manage access, apply patches, and respond when something goes wrong. Shared responsibility is only real when both sides are truly accountable.

I’ve seen insurers rush into partnerships with vendors that looked strong on paper only to discover later that security was an afterthought. By then, it’s too late. When a partner is breached, your customers don’t see them. They see you.

Shortcuts always come back to bite

When growth is rapid, it’s tempting to push features live before the foundation is ready. Those shortcuts create the very gaps attackers look for. Hackers don’t need new exploits if you hand them one in the seams between old infrastructure and new.

The IBM report also found that breaches in financial services take longer to contain than in most industries, adding to their already higher cost. Another reason shortcuts are never worth it.

Three practices protect scaling insurers:

• Zero trust means verify everything and assume nothing.

• Continuous monitoring ensures small issues don’t snowball.

• Compliance standards such as PCI DSS and SOC 2 are the baseline, not the finish line.

Secure growth isn’t about traffic volume. It’s about avoiding cracks that multiply risk.

Modernization cannot weaken the core

As legacy monoliths break into microservices and APIs connect once-isolated systems, agility increases—but so do blind spots. Misconfigured cloud environments drove some of the costliest breaches in our industry last year. Poorly secured APIs are also among the fastest-growing causes of data exposure.

None of this happens because CIOs are reckless. It happens because modernization moves quickly, and teams are under pressure to deliver.

The solution is to bake security into modernization. DevSecOps practices—where developers, operations, and security teams work hand in hand—prevent vulnerabilities from being locked into new systems. Without alignment among those groups, you’re likely missing something that attackers won’t.

Culture matters more than technology

Most breaches aren’t masterstrokes by hackers. They’re weak passwords, missed updates, or alerts left unchecked. That’s why culture is as important as code.

Developers need to think security as they write. Operations should treat compliance as part of uptime. Leaders must treat data protection as a promise, not just a checklist.

Trust is the currency of insurance. Once broken, it takes years to rebuild. A PwC study found that 32 percent of customers will stop doing business with a brand after a single bad experience. The same applies when that experience is a breach.

Security as an edge

Breaches in financial services cost more than the global average and draw heavy regulatory scrutiny. But insurers that scale securely won’t just avoid risk—they’ll gain an edge.

The industry will not slow down. The real question is whether we build platforms that bend under pressure or ones that hold strong when it matters most.

Red Teaming Brings Foresight to Insurance Technology Project Risks