For decades, insurance had a reputation for being antiquated and resistant to change. But with technological disruption shaking things up across all industries, even the insurance companies had to give him. The result? Insurtech, short for insurance technology, reached over $500 million market evaluation last year. From AI to blockchain, the insurance industry is now employing several cutting-edge technologies for its future-proof revamp.
Made possible by the growing popularity of IoT, big data makes up a considerable part of that transition. Connected devices hold the key to making the underwriting process a lot faster, cheaper, and more efficient for insurers. Whether it’s auto insurance or health insurance, tracking devices can give underwriters a never-seen-before advantage.
Instead of relying on indirect indicators like age or gender, as insurers traditionally would, they can now assess risk on the basis of much more sophisticated data. A driving app can tell them how often someone speeds or how suddenly they brake. A fitness tracker, on the other hand, gives information about physical activity, quality of sleep, and overall lifestyle that is crucial to determining a policyholder’s life plan premiums. To insurers, IoT devices are a gold mine of big data.
It sounds like incorporating big data for insurtech is an obvious decision. Unfortunately, IoT devices that are instrumental in the process have major privacy and security issues that could hold the industry back.
Internet of Cybersecurity Nightmares
2019 brought some distressing news about the state of data privacy in IoT. First Amazon, and soon after Google, were reported to collect recordings from smart home devices and pass them on to contractors for transcription. Both companies claim that the practice affected only a fraction of users, but that doesn’t make eavesdropping on Echo Home and Google Home owners any less creepy.
What’s even worse, Google whistleblowers reported that the samples they were given for transcription included anything from sexual activities to domestic violence. It appears that no material is too sensitive for tech companies to share with employees. Amazon workers confessed to having a chat room where they share particularly funny recordings with others. That’s today’s IoT data privacy for you.
IoT manufacturers are not the only threat to users’ data. Connected devices have proved to be particularly vulnerable to hacking. In an experiment run by the Atlantic journalist, a fake wireless toaster was compromised within an hour from setup. A more terrifying example shows that IoT security problem could literally kill you. In 2015, attackers hacked the pacemaker of a simulated human, iStan, and used it to torture and kill the robot. Similar hacks were possible with insulin pumps and other medical devices, exposing the shocking recklessness of manufacturers in releasing these devices to the market.
Why do IoT devices have such poor cybersecurity? Because investing in security doesn’t have any financial incentive for manufacturers. Companies are rewarded with revenue for new features, lower prices and beating their competitors to the market. In a fast-paced and extremely competitive environment, IoT producers race to market release and often skip the security testing altogether. Inbuilt data security and privacy measures are very much an afterthought.
Changing the default passwords, encryption, and installing software updates are all good ways for users to protect the data transmitted through IoT devices. But none of them are as foolproof as making safety a default feature of those gadgets.
What does that mean for insurtech?
Skeptics might say that with low levels of digital literacy, consumers are unlikely to show concern about IoT privacy and security. As it turns out, however, 85% of Americans say they are extremely (24.7%), very (23.4%), or somewhat (28.0%) concerned about smart devices collecting personal data about them. As cybersecurity awareness rises, these numbers will only increase. Consequently, insurtech’s big data appetite might face considerable pushback.
Better regulations could be the answer to IoT challenges. Tech industry has a track record of over-collection and over-retention of data. Without a proper legislative framework, tech companies will always fail to sufficiently protect consumers’ interests.
However, policymakers are slow to make the change happen. In the US, California is the only state with IoT cybersecurity law and even that one is deemed not good enough by most security experts. Legislation typically struggles to catch up with most forms of innovation, leaving little hope for comprehensive IoT laws anytime soon.
It will be interesting to see whether the insurance industry will realize its dependence on better IoT security. There is room for innovation, such as blockchain-based projects for more secure data management. Will insurtech companies invest in those cutting-edge initiatives or lobby for legislative change? Both options are possible. In any case, insurtech’s appetite for big data might be bigger than the industry can swallow.
