--- title: 'Cyber Security for Insurance Brokers | UK' url: 'https://triplepoint.org.uk/industries/insurance-brokers' markdown: 'https://triplepoint.org.uk/industries/insurance-brokers.md' date: '2026-10-29' description: 'Cyber security for UK insurance brokers: stop premium payment fraud, protect client data and insurer logins, and meet FCA expectations. From £13/user.' --- # Cyber Security for Insurance Brokers | UK ## Why insurance brokers are targeted A broker holds detailed personal and financial information about every client, sometimes including health details for protection cover, plus logins to the insurer portals where policies are placed and changed. Money moves too. Premiums are paid, claims are settled and refunds go out, often arranged by email. An attacker who gets into a mailbox can redirect payments, or use your firm's name to trick clients who trust you. ## What we see ### Premium and payment fraud A criminal in a mailbox sends clients "updated" bank details for a premium, or diverts a claim payment or refund to their own account. ### Stolen insurer portal logins Passwords for insurer and placing platforms are valuable. A stolen login can expose client records or be used to make changes in your name. ### Sensitive client data Personal, financial and sometimes health information on every client. A breach may need reporting to the ICO, and possibly to the FCA. ### Ransomware at renewal time Losing access to your broking system or client files stops renewals and quotes, and attacks are usually launched outside business hours, when nobody is watching. ## What clients, insurers and regulators expect - **The FCA.** Under Principle 11, firms must tell the FCA about anything it would reasonably expect notice of. The FCA's guidance on [reporting operational incidents](https://www.fca.org.uk/firms/operational-resilience/reporting-operational-incidents) says an incident may be material if it results in unauthorised access to your systems, makes them unavailable, or causes a significant loss of data. New, standardised incident reporting rules come into force on 18 March 2027. - **UK GDPR.** Your firm is responsible for the personal data it holds. A breach that puts people at risk must be reported to the ICO within 72 hours of you becoming aware of it. - **Insurers and networks.** The insurers you place business with, and any network you belong to, may ask about your security. Your own professional indemnity and cyber insurers certainly will. - **Your clients.** You may be advising clients on cyber insurance and the controls insurers expect. Meeting those standards yourself makes the advice more credible. What we recommend ## Protection for insurance brokers From£4 ### Email security Filters impersonation, payment fraud attempts and malicious attachments out of your mailboxes before your team sees them. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/people-and-email/email-security) From£8 ### Identity threat detection (ITDR) Spots stolen passwords and suspicious Microsoft 365 sign-ins, the usual first step before payment fraud. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) From£13 ### 24/7 managed detection & response (MDR) A 24/7 team watching your devices and systems, including evenings and weekends, and stepping in to contain an attack. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/detect-and-respond/mdr) From£4 ### Phishing simulation & training Practice phishing emails and short training, so your team spots the real thing in the middle of a busy renewal season. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) From£3 ### Mobile device management Keeps client data on staff phones under control, and removes it if a phone is lost or someone leaves. Per user, per month, excluding VAT. [More details](https://triplepoint.org.uk/security/devices/mobile-devices) ### Business email compromise If a mailbox is compromised, we lock the attacker out, find out what they saw and help you contact the right people quickly. [More details](https://triplepoint.org.uk/security/incident-response/business-email-compromise) ## How we work with brokers A typical small brokerage has between 10 and 50 people, an IT provider or a broking software supplier for day-to-day support, and nobody whose job is security. That's the gap we fill. We start with a conversation about how your firm works: where client data lives, how premiums and claims are paid, which systems your team logs into, and what your own insurer asks for. Then we recommend the protection that fits, with prices up front. Everything runs from one platform with one monthly invoice, and you can add to it as you grow. Questions Do we have to tell the FCA about a cyber attack?+If it's material, yes. The FCA expects to hear about incidents that, for example, give someone unauthorised access to your systems, make them unavailable or cause a significant loss of data. A personal data breach is reported to the ICO separately. Our guide, [Do we need to report a cyber attack?](https://triplepoint.org.uk/guides/report-a-cyber-attack-uk), covers the ICO side. We already have an IT provider. Do we need you as well?+Usually yes, and the two work well together. Your IT provider looks after users, software and hardware. We supply and manage the security: the protection itself and the 24/7 monitoring behind it. What would this cost for a 15-person brokerage?+Our 24/7 MDR starts at £13 per user per month, so from £195 a month for 15 people, excluding VAT. Email security and the other controls are priced per user too. Use the [price calculator](https://triplepoint.org.uk/security) for your own numbers. Where to go next- [Cyber insurance requirements: what UK insurers ask small businesses for](https://triplepoint.org.uk/guides/cyber-insurance-requirements-uk) - [Invoice fraud: how business email compromise works and how to stop it](https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise) - [Microsoft 365 account hacked? What to do next](https://triplepoint.org.uk/guides/microsoft-365-account-hacked) - [Compare our five protection tiers and prices](https://triplepoint.org.uk/security#protection-tiers) [< Back to Industries](https://triplepoint.org.uk/industries) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact?about=Insurance%20brokers) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security for Professional Firms & Charities](https://triplepoint.org.uk/industries.md) - Previous: [Cyber Security for Financial Advisers | IFAs](https://triplepoint.org.uk/industries/financial-advisers.md) - Next: [Cyber Security for Solicitors | UK Law Firms](https://triplepoint.org.uk/industries/solicitors.md)