# insurance

Source: https://startwithidentity.com/verticals/insurance/
Last updated: 2026-06-18
License: content by Start with Identity. Cite the source URL.

---

## The job identity does in insurance

Insurance combines a regulated-data governance problem with a consumer and intermediary identity problem. Carriers must verify customers, onboard agents, brokers, and third-party administrators securely, prevent claims and application fraud, and prove to regulators that access to sensitive data is controlled and audited. The intermediary network (agents, brokers, TPAs) is a distinctive and often under-governed part of the surface.

## The regulatory and compliance floor

In the US, GLBA governs safeguarding customer financial data and the NAIC Insurance Data Security Model Law drives state-level requirements. SOC 2 is table stakes for partners, GDPR applies to EU policyholders, and EU insurers fall under [DORA](https://startwithidentity.com/guides/compliance/identity-controls-for-dora/) for operational resilience. The common thread is auditable access and strong identity verification.

## The threat landscape here

Insurance faces application and claims fraud, including synthetic identities, plus [account takeover](https://startwithidentity.com/glossary/account-takeover/) against policyholder portals and business-email compromise targeting payouts. Broker and TPA access that drifts out of governance is a frequent audit finding and breach vector.

## What good looks like

- [CIAM](https://startwithidentity.com/vendors/ciam/) with built-in [identity verification](https://startwithidentity.com/vendors/identity-verification/) and fraud signals at onboarding and claims.
- [IGA](https://startwithidentity.com/vendors/iga/) for access certification, segregation of duties, and a clean audit trail.
- Strong, federated authentication for agents, brokers, and TPAs, with governed, time-bound access.

## Vendors and fit

Enterprise CIAM and federation fit [Ping Identity](https://startwithidentity.com/vendors/iam/ping-identity/) or [Auth0](https://startwithidentity.com/vendors/ciam/auth0/); verification and fraud fit [Persona](https://startwithidentity.com/vendors/identity-verification/persona/) or [Socure](https://startwithidentity.com/vendors/identity-verification/socure/); governance fits [SailPoint](https://startwithidentity.com/vendors/iga/sailpoint/) or [Saviynt](https://startwithidentity.com/vendors/iga/saviynt/).

## Common pitfalls

- Treating fraud and verification as separate from CIAM, so signals are not used at decision time.
- Broker and TPA access that is granted broadly and never reviewed.
- Underinvesting in access certification until an audit forces it.

## Where it is heading

DORA will push EU insurers toward stronger privileged access and third-party governance, and deepfake-resistant verification will become standard at onboarding and claims.