Cybersecurity built for insurers and insurtech.

Insurance is regulated as part of BFSI but carries its own cyber profile. The IRDAI Information & Cyber Security Guidelines set the baseline — a board-approved security policy, a CISO, periodic VAPT and audits, incident reporting and third-party risk management — and they reach the entire distribution chain: insurers, ISNP (Insurance Self-Network Platform) operators, web aggregators, corporate agents, brokers and the growing insurtech layer. Overlaid on this is the DPDP Act, because an insurer's data estate is dominated by sensitive personal and health data, and CERT-In's 6-hour incident-reporting and log-retention directions.

Macksofy delivers IRDAI-aligned audits, application and API VAPT, cloud security and 24×7 Managed SOC into life, general (motor/property/marine), standalone health insurers and reinsurers. Most engagements run as an annual programme — periodic VAPT across the policy-admin system, customer and agent portals, mobile apps, the ISNP and the API estate that connects aggregators and insurtech partners — plus the point-in-time IRDAI audit and a CISO-on-tap retainer.

What's specific to insurance vs. generic BFSI: the attack surface is dominated by web and API channels (aggregator integrations, agent portals, claims and onboarding APIs) and by a long tail of third-party insurtech and TPA integrations; the data sensitivity is health-grade, so DPDPA and breach exposure are acute; and claims-fraud and account-takeover detection belong in the SOC alongside classic web/API threats. Reports follow the IRDAI format and map cleanly to ISO 27001 and the DPDP Act.