9
Insurance is a data business that hates to admit it’s a data business. Every policy you write, every claim you adjust, every quote you bind sits on a stack of personal information, protected health data, and financial records that would make a hospital’s privacy office flinch. And right now, most of that stack is guarded by the same password somebody’s uncle used for his fantasy football league.
Here’s the uncomfortable part: the industry has spent two decades selling cyber policies to everyone else while treating its own house as low-risk. State insurance regulators are starting to notice. This isn’t an abstract reputational worry — it’s a structural one. The firms that handle the most sensitive data in the economy are holding it in the least defensible way, and the gap between the two is what regulators, examiners, and increasingly your own carriers are going to probe.
The 9 Tails view is blunt: for an insurance firm, AI isn’t a productivity upgrade you shop for — it’s a data-handling decision you make before you touch a single customer record. Here’s what we watch for when we audit an agency, an MGA, or a broker.
1. Your book of business is the prize, not your logo.
A sophisticated attacker doesn’t come for your brand. It comes for the aggregated trove you hold: names, addresses, social security numbers, medical details, claims history, and the financial positions of policyholders who trusted you. One compromised agency workstation is a feed of everything its clients ever told it. Treat your policyholder data — not your website — as the crown jewel, because that’s exactly where the adversary is already looking.
2. Public AI is a one-way door your data walks through.
The paralegal pasting a claim summary into a free chatbot. The broker asking a public model to draft a coverage comparison straight from a client file. That’s your regulated data leaving your boundary under terms you never read illuminating exactly where it went. Regulators don’t much care that the tool was convenient; they care that the data left your custody, and the record of it leaving is now on someone else’s infrastructure. What goes into a public model is effectively gone.
3. Regulators grade on demonstrated control, not on intention.
“We meant well” is not a control. When an examiner walks in, they want to see that your data stayed inside your boundary, that access was auditable, and that there’s a trail proving it. A firm that can point to its own governed infrastructure answers that question in minutes. A firm whose sensitive data has been flowing through public tools answers it in legal fees and remediation plans.
4. Your carriers and reinsurers are starting to ask sharper questions.
The people who underwrite your own operations are sharpening their underwriting questionnaires about how you handle policyholder data. The more clearly you can demonstrate that regulated data never leaves your boundary, the better your terms. Cybersecurity posture is quietly becoming a pricing input for the industry’s own risk, and the firms that look clean get the better seat at the table.
5. Open-weights models fit the way insurers actually work.
The capabilities an agency actually needs — drafting, analysis, claims summarization, policy comparison drawn from your own history — run perfectly well on models you deploy behind your own controls. You get the utility of AI without handing regulated data to a third party. That’s not a compromise. That’s the entire point.
The pattern across every 9 Tails engagement is the same: the firm that treats data custody as a structural decision, not a checkbox, stops fearing the regulator and starts benefiting from the clarity.
If you’re not sure where your firm’s sensitive data sits right now, you’re not ready to decide anything about AI. Start with the Confidential AI Exposure Checklist — five minutes that show you exactly what’s leaving your boundary, before anyone asks.