The insurance industry operates on a foundation of trust. Independent brokers and agencies hold decades of sensitive client data, including medical histories, financial records, Social Security numbers, and other information that clients entrust you to protect. Yet in 2025, that trust faces an unprecedented crisis.

For independent agencies attending NAILBA 44 this week, the question isn’t whether data security matters—it’s whether your current security measures actually protect data when you’re using it.

The numbers tell a stark story: the healthcare and insurance sectors experienced record-breaking breach volumes in 2024, with more than 275 million healthcare records compromised—representing 82% of the U.S. population. Average breach costs now reach $7.42 – $9.77 million per incident for healthcare organizations, according to IBM’s 2024-2025 Cost of a Data Breach reports.

The Change Healthcare breach alone compromised 192.7 million records and caused losses exceeding $3.1 billion, demonstrating how a single third-party compromise can cascade across the entire industry.

The Hidden Vulnerability: When Your Security Disappears

Here’s what most insurance professionals don’t realize: traditional encryption protects your data everywhere except when you actually need to use it.

Your agency likely encrypts data at-rest (stored files) and in-transit (network transmission). That’s table stakes—and it’s exactly what regulators like NYDFS and NAIC Model #668 require. But consider what happens during your daily operations:

• New Business Processing: You decrypt application data to validate forms, confirm completeness, and transmit to carriers.
• Underwriting: You decrypt applicant information to run risk assessments and pricing algorithms
• Customer service: Your representatives decrypt account data to answer questions and update policies

During every one of these operations—the very activities that generate value for your agency—data sits exposed in plaintext, exposed to attacks, malware, insider threats, and sophisticated hackers.

This is the encryption gap, and it’s costing the insurance industry billions.

Why Independent Agencies Face Disproportionate Risk

Independent brokers and BGAs operate in an especially vulnerable position. Recent research from SecurityScorecard reveals that 59% of breaches among the top 150 insurance companies involved third-party attack vectors—more than double the global cross-industry average of 29%. The report found that agencies, brokers, IT providers, and claims processors represent critical failure points in the security chain. A recent example of this is the recent Salesforce breach that impacted more than 700 companies and resulted in more than 1 billion records stolen.

You’re simultaneously:

• Handling data from multiple carriers, each with their own security requirements
• Connecting to numerous third-party systems for quotes, applications, and claims
• Working with limited IT security resources compared to large carriers
• Storing sensitive data in legacy systems that may lack modern security controls

The Landmark Admin breach of 2024 illustrates this perfectly: one third-party administrator breach affected multiple insurance companies simultaneously, compromising hundreds of thousands of individuals. When attackers target the independent distribution channel, the impact cascades across the entire industry, resulting in financial losses and damaged reputations.

More than 56% of insurance companies experienced at least one compromised credential in the past two years, according to SecurityScorecard’s 2025 analysis. If you’re running policy administration systems or CRM platforms with weak authentication controls, you’re sitting on a critical vulnerability. Most organizations don’t know if their data is really protected within these systems. They may be technically compliant with security standards, but as we’ve learned that does not guarantee that your data won’t be exposed.

The AI Acceleration: New Capabilities, New Exposures

If you’re attending sessions about AI at NAILBA 44 this week, you’re not alone. 76% of U.S. insurance companies have integrated generative AI into at least one business function, according to a June 2024 survey by Deloitte’s Center for Financial Services, with applications spanning customer service chatbots, claims automation, fraud detection, and underwriting assistance.

But here’s the uncomfortable truth: most insurers lack comprehensive AI security frameworks. While adoption is accelerating, many organizations are deploying AI without adequate safeguards for the vast amounts of sensitive customer data these systems require.

AI systems need access to your most sensitive customer information to train models and generate insights. Traditional AI implementations demand that all this data be decrypted for processing. That means:

• Training datasets sit unencrypted for model development
• Live customer data feeds directly into AI inference without protection during analysis
• Incorrect model settings can accidentally store or reveal private information, which can lead to data leaks.
• AI-specific attacks like model poisoning and prompt injection can reconstruct training data

Meanwhile, the threat actors have AI too. Sophisticated phishing campaigns increasingly leverage AI assistance, and deepfake voice cloning—the kind used in the $25 million Arup engineering fraud—can be accomplished in a matter of hours.

The race between AI-powered attacks and AI-powered defenses is accelerating. But if your defensive AI requires you to expose sensitive data during processing, you’re bringing a knife to a gunfight.

The Solution: Encryption That Protects Data in Use

The technology that insurance agencies actually need is called encryption-in-use, and unlike some emerging security concepts, Paperclip has a solution that is production-ready today.

Encryption-in-use can be achieved through different technological approaches, each with distinct trade-offs:

Hardware-based approaches like confidential computing provide strong security guarantees, but also require extensive system rearchitecture, specialized expertise to implement and manage, annual certifications, and significant cost investments.

Software-based approaches like Searchable Symmetric Encryption (SSE) keep data encrypted during operations through advanced cryptographic techniques. These solutions integrate at the application layer without requiring hardware dependencies or infrastructure overhauls.

Paperclip’s SAFE platform uses the software-based SSE approach—delivering practical encryption-in-use that insurance agencies can actually implement without the complexity, cost, and rearchitecture challenges of hardware-based solutions.

How SAFE’s Encryption-in-Use Works

Instead of traditional encryption that requires full decryption for any operation, SAFE uses advanced Searchable Symmetric Encryptionhat keeps your data protected even during active use:

1. Data is shredded into encrypted fragments before storage—breaking whole records into components that are individually encrypted, making reconstruction impossible even if accessed
2. Deduplication and saltingcreate unique encrypted representations that prevent pattern analysis. Salting adds a random string of characters to the data before it’s processed by an encryption algorithm, which makes encryption stronger by adding randomness.
3. Dual-key architecture requires both data owner and data holder keys before any operation can occur
4. Search operations work on encrypted data using SSE algorithms—no decryption needed for queries
5. API-layer implementation means SAFE integrates with existing systems without network or database rearchitecture

Think of it this way: traditional encryption is like putting valuables in a safe, but taking them out and laying them on your desk whenever you need to use them. SAFE is like having a secure workspace where you can search, sort, and analyze valuables without ever fully exposing them.

The result: even if attackers compromise your systems, they get encrypted fragments that cannot be reconstructed into usable data—what Paperclip calls “Safe Harbor” protection.

Real-World Applications for Insurance Agencies

Case Processing: Validate coverage and process payments while keeping medical records and payment information encrypted throughout the workflow. Fraud detection algorithms analyze patterns without exposing individual claim details—exactly what SAFE enables through searchable encrypted data.

Multi-Carrier Operations: Analyze combined data from multiple carriers for benchmarking and client recommendations without exposing proprietary information from any single carrier. SAFE’s multi-party collaboration capability allows secure data sharing where no party ever sees another’s plaintext data—perfect for BGAs working with multiple carriers.

Third-Party Analytics: Share data with vendors, consultants, or business intelligence platforms while maintaining cryptographic proof that data remained protected during analysis. With SAFE’s dual-key architecture, you maintain control even when data processes in vendor environments—they can operate on encrypted data but never decrypt it.

AI-Powered Tools: Train machine learning models on encrypted client data for better risk assessment and personalization without creating massive honeypots of decrypted training data. SAFE anonymizes data before creating AI training sets, enabling you to leverage generative AI securely—addressing the AI security gap that leaves most insurers vulnerable.

Regulatory Compliance: Demonstrate to auditors that sensitive data remained protected even during active processing, not just in storage. SAFE’s architecture provides verifiable protection—the shredded, encrypted data structure means even compromised systems cannot expose usable information.

What the Performance Trade-Off Actually Looks Like

Let’s address the elephant in the room: performance overhead.

Encryption-in-use technologies add processing time compared to operations on plaintext data. SAFE adds approximately 50 milliseconds to typical search operations—virtually unnoticeable for most insurance agency workflows:

• Case management decisionsthat take 2-3 seconds might take 2.05-3.05 seconds with protection
• Customer service queries respond in real-time with minimal perceptible delay
• AI model training that happens periodically takes slightly longer but provides permanent security benefits

Compare that performance cost to the $6-10 million average breach cost, or the $9.75 million GEICO paid in fines, or the 200 hours victims spend recovering from identity theft.

SAFE’s near real-time performance makes it practical for production insurance operations that can’t afford any latency.

Building Trust Through Data Security

The insurance industry built its business model on trust. But in 2025, trust requires verification.

Research shows that 65% of data breach victims lose trust in organizations, and 80% of consumers abandon businesses after personal information is compromised. Yet studies also indicate that 60% of consumers would pay more for better data protection.

For BGAs, superior data protection represents a competitive advantage:

• Differentiate your agency when competing for high-value clients who take security seriously
• Strengthen carrier relationships by demonstrating commitment to data protection beyond minimum requirements
• Reduce cyber insurance premiums through demonstrable security improvements
• Build resilience against inevitable breach attempts, knowing that even compromised systems don’t expose usable plaintext data

Most importantly, you shift from trust-based to proof-based security. Instead of asking vendors and partners to promise they’ll protect data, SAFE’s architecture enables you to maintain cryptographic control—even if vendor systems are compromised, they never access your plaintext data because they only ever process encrypted fragments.

The Path Forward for NAILBA Attendees

If you’re at NAILBA 44 this week, you’re already ahead of the curve by prioritizing technology and innovation discussions. Here’s what to do with this information:

Immediate Actions

Evaluate your current encryption posture: Conduct an honest assessment of where data is protected (at-rest, in-transit) versus where it’s exposed (during processing, in vendor systems).

Assess third-party risks: Map all systems and vendors that process your sensitive data. For each one, determine whether they use encryption-in-use or traditional approaches—and whether you maintain cryptographic control.

Start planning for in-use protection: Begin conversations with your technology providers about their roadmaps for encryption-in-use capabilities. Consider scheduling a consultation with Paperclip to understand how SAFE can close your encryption gap without requiring the complexity and cost of hardware-based approaches.

Medium-Term Strategy

Pilot encryption-in-use for high-risk operations: Start with your most sensitive processes—high-value claims, complex underwriting, or AI training on customer data. SAFE’s API-layer integration supports targeted deployments that demonstrate value before enterprise-wide rollout, without requiring system rearchitecture.

Update vendor requirements: Add encryption-in-use capabilities to your RFPs and vendor assessments. Make it a differentiator when selecting new technology partners. Look for vendors who can demonstrate cryptographic control, not just contractual promises.

Prepare for evolving regulations: Build in-use protection before it becomes a compliance requirement, not after. SAFE positions your agency ahead of regulatory curves that increasingly focus on data protection throughout its lifecycle.

Long-Term Transformation

Make encryption-in-use foundational: As you modernize systems and adopt new technologies, ensure encryption-in-use is built into the architecture from day one. SAFE provides the foundational security layer for modern insurance operations—protecting data in policy administration systems, CRM platforms, analytics environments, and AI applications.

Leverage it as competitive advantage: Market your superior data protection to prospects and clients who value security. Demonstrate that their data remains encrypted even while you’re actively using it to serve them.

Contribute to industry standards: As an early adopter, help shape best practices for encryption-in-use in insurance distribution. Share lessons learned (without compromising competitive advantage) to elevate security across the independent agency channel.

The Bottom Line

The insurance industry’s data protection crisis won’t be solved by doing more of what hasn’t worked. Traditional encryption leaves your most valuable data exposed precisely when you’re using it to serve clients, process claims, and run your business.

The question for independent agencies isn’t whether to adopt encryption-in-use—it’s what breach prevention is worth to you.

With record breach volumes, $100M+ in regulatory fines, and 275 million records compromised in 2024 alone, the agencies that move first will benefit from:

• Stronger client trust and loyalty
• Reduced breach risk and costs
• Competitive differentiation
• Better vendor relationships
• Lower cyber insurance premiums

The technology exists today. Paperclip’s SAFE platform is production-ready, with proven implementations protecting sensitive data at scale through advanced Searchable Symmetric Encryption. Unlike experimental approaches that remain in research labs or hardware-based solutions that require extensive rearchitecture, SAFE delivers practical encryption-in-use that insurance agencies can implement in weeks, not years.

The only question is whether your agency will be among the first to protect data throughout its lifecycle—or among those explaining to clients why their information was exposed during a breach that encryption-in-use would have prevented. To move forward with clarity, view pricing for insurance organizations and evaluate the right level of protection.

Learn more about Paperclip SAFE at www.paperclip.com/safe.

 

 

Frequently Asked Questions

What is encryption-in-use and how is it different from traditional encryption?

Encryption-in-use protects data while it’s being actively processed, not just when stored or transmitted. Traditional encryption requires data to be decrypted into memory for any operations, creating vulnerability windows. Encryption-in-use technologies keep data protected even during processing. Paperclip’s SAFE platform implements this through advanced Searchable Symmetric Encryption (SSE)—shredding data into encrypted fragments that remain protected during search and analysis operations, ensuring your data stays secure throughout its lifecycle.

Is encryption-in-use ready for production use in insurance agencies?

Yes. Encryption-in-use technologies have reached production readiness, though implementation approaches vary significantly. Hardware-based solutions (confidential computing) require specialized infrastructure and expertise. SAFE’s software-based approach is currently deployed in production environments protecting sensitive financial services data, demonstrating that practical encryption-in-use is not a future concept but a present-day solution available for insurance agencies today.

What does encryption-in-use cost in terms of performance?

Performance overhead varies by technology approach. Hardware-based confidential computing typically adds 20% to 2x processing time. Some academic approaches like fully homomorphic encryption add minutes of latency, making them impractical for real-time operations. SAFE adds approximately 50 milliseconds to typical search operations—virtually unnoticeable for claims processing, customer service queries, and most insurance workflows. This minimal overhead is far outweighed by the security benefits and breach cost avoidance.

Do encryption-in-use solutions work with our existing policy administration and CRM systems?

This depends on the technology approach. Hardware-based solutions typically require extensive system rearchitecture and application modifications. SAFE is designed to integrate with existing technology stacks without requiring platform replacement—it implements at the API layer and supports popular insurance platforms like Vertafore, Duck Creek, Guidewire, and Salesforce. Implementation requires API expertise and database knowledge rather than specialized infrastructure or complete system overhauls.

Will encryption-in-use help with regulatory compliance?

Yes. While current regulations like NAIC Model #668 primarily mandate encryption at-rest and in-transit, forward-looking compliance strategies recognize that regulators are increasingly focused on data protection throughout its lifecycle. Encryption-in-use provides demonstrable proof that data remained protected during processing—a powerful response to auditor questions and regulatory investigations. SAFE’s architecture ensures that even if systems are compromised, encrypted data fragments cannot be reconstructed into usable information—providing the “Safe Harbor” protection that exceeds regulatory minimums and anticipates future requirements.

How does encryption-in-use protect against third-party breaches?

When you share data with vendors, business associates, or cloud platforms using encryption-in-use, you can maintain cryptographic control even after data leaves your environment. SAFE’s dual-key architecture means vendors can process encrypted data for authorized operations without ever having the keys to decrypt it into plaintext. Even if a vendor’s systems are compromised, attackers get encrypted fragments they cannot reconstruct—turning vendor oversight from trust-based to cryptographically-enforced security.

Can encryption-in-use work with AI and machine learning systems?

Absolutely. Encryption-in-use is particularly valuable for AI/ML applications because these systems require access to vast amounts of sensitive data for training and inference. SAFE enables secure AI operations by anonymizing data before creating training datasets—AI models train on encrypted/anonymized information while you retain the ability to reveal actual data when authorized. This allows agencies to leverage generative AI’s benefits for underwriting, claims automation, and fraud detection while minimizing the massive data exposure risks of traditional AI implementations.

What happens if our encryption-in-use system is breached?

That’s the key advantage: even if attackers compromise systems using encryption-in-use, they cannot access usable data. SAFE’s shredded data architecture means attackers get encrypted fragments that cannot be reconstructed even with significant computing resources. The dual-key system ensures both data owner and data holder keys are required for any access. While no system is 100% invulnerable, SAFE dramatically reduces breach impact—attackers get encrypted fragments they cannot decrypt or reconstruct rather than plaintext information they can immediately exploit.

How do we get started with encryption-in-use for our agency?

Start by evaluating where your highest-risk data exposures occur—typically in claims processing, underwriting operations, vendor integrations, and AI/ML systems. Assess your current technology stack’s compatibility and understand the trade-offs between hardware-based and software-based approaches.

 

Schedule a consultation with Paperclip to learn how SAFE’s API-layer integration can protect your agency’s sensitive data throughout its lifecycle without requiring the complexity, cost, and rearchitecture of hardware-based solutions. Our team can assess your specific security requirements and design an implementation roadmap that balances security, performance, and operational needs—demonstrating value through targeted pilots before enterprise-wide deployment.