Entering the Cloud: Risk Versus Reward

Posted on: February 25, 2016

Global Software as a Service (SaaS) revenues are forecasted to reach $106B in 2016, increasing 21% over projected 2015 spending levels. A Goldman Sachs study published last month projects that spending on cloud computing infrastructure and platforms is still on target to increase 30% from 2013 through 2018 compared with 5% growth for overall enterprise IT. However, insurance companies are lagging behind other businesses in terms of their adoption rate and there is good reason for that. Insurance companies, by nature, must be highly risk averse and some of the top considerations to be aware of when considering cloud based options are:

Regulations

Insurers have to adhere to government regulations which cover how data is used and where it is stored. In particular, sensitive healthcare, personal, and financial data are all forms of information that must be stored in a very carefully controlled environment.

Security

The case can now be made that cloud security has surpassed the security measures at most onsite data centers. However, the challenge with cloud based services is the company does not have direct control of the security and this lack of control means that an insurer must rely solely on the Service Level Agreement (SLA) of the cloud provider but there is often difficulty substantiating and/or validating their claims.

Visibility

Building upon the challenge of security above, an insurer has to ask if they really understand where their data is located? Has it crossed borders? Who has access to it? These questions that can be very difficult to reconcile.

Accessibility and Latency

When utilizing cloud based services an insurer is putting their business in somebody else’s hands and relying on their management. There is always the assumption that adequate resourcing will be put into place to handle peak demand and that latency will be kept to a minimum by always utilizing the most appropriate servers but in the end if there are performance issues it is the insurer’s reputation that is damaged in the public’s eye, not the cloud hosting facility’s.

Lack Of Trust

Not only must the insurer trust the cloud supplier but they must have enough faith in the supplier that they will meet all of their SLAs. This trust must also be solid enough to transfer through to the insurer’s customers and ensure their SLA’s are met and that no outages or data breaches impact the trust of the insurer-client relationship which can be very damaging in the event of a catastrophe such as a data breach or loss.

Mid-sized insurers with under 2 Billion in Net Premiums Written (NPW) tend to have the greatest challenge with these issues because they often lack the internal skills, manpower, and resources and this – coupled with an aging workforce – is making complex new SaaS adoption/implementation tasks more difficult.

This is where third party SaaS suppliers can greatly assist insurers because they are specialists in their fields and through the process of vetting and technical due diligence have gone to great lengths to ensure they have the correct protocols in place to facilitate adoption which most insurers simply do not have the expertise, time, or resources to achieve.

Third party suppliers, such as ExpeFlow Inc. that we at Benchmark are using to manage our workflow and business processes, offer the best of both worlds to insurers – a Private Cloud Model and a company with the expertise to manage it. A private cloud model such as ExpeFlow’s is located off-premises at a Tier III data facility which specializes in secure data hosting (see Wikipedia for further information on data facilities https://en.wikipedia.org/wiki/Data_center) and provides hardware and bandwidth resources solely to the client. The private cloud model is able to address each of the insurer cloud-based concerns listed above and, as a result, the sector is growing fast because it provides a more secure option that still offers a flexible, nimble, customer-centric cloud-based business model but in a more secure fashion.

However, as attractive as a private cloud sounds they do have challenges, especially if on-premises insurer based IT is responsible for managing it. A private cloud requires the same staffing, management, maintenance and ongoing expenses as a traditional internal data center. This is where business strategy comes into play and consideration of the various “hybrid cloud” deployment options should occur. A CIO might be wise to choose a mix of private and public cloud services, called “hybrid” cloud deployment depending on the task at hand. For example, for claims management a third party vendor such as ExpeFlow might be brought in to manage the workflow and the corresponding sensitive data while, for non-sensitive data such as website hosting, it might be prudent and cost effective to leverage the many public cloud resources dedicated to website hosting. This hybrid strategy makes a lot of sense – utilize a private cloud and domain experts where sensitive information indicates it is necessary and public cloud for all else – in fact, Gartner predicts that the majority of insurers will utilize some derivative of this type of hybrid cloud deployment by 2018.

Other challenges to private cloud adoption include migration issues related to planning and mapping the transition of protocols, policies and procedures, as well as reviewing the delicate balance of a variety of concerns such as cost, skill set, speed to market and compliance/security concerns. This is where choosing the appropriate third party vendor partner is critical. Their expertise can ensure all transitions, protocols, and procedures are accounted for and the right service and the right solution are provided to efficiently and cost-effectively solve the business problem at hand.

This new diversity in technology deployment options has really taxed insurers and that is why so many are turning to third party vendors. Even for companies that commit to culture change and teach current internal employees modern technology it can take several years to get projects off the ground and to production status versus utilizing companies that specialize in offering insurance related services who can come on-site and begin implementing the appropriate solution accompanied by the appropriate cultural change management and support immediately.

The staggering array of options that new cloud-based technology offers is very complex and evolving every day at a break-neck pace and at Benchmark our opinion is that the “hybrid cloud” deployment model is the most effective strategy which balances risk versus cost – bring in the experts where risk and business process complexity warrants and utilize internally managed public cloud technologies for less demanding/sensitive projects – thus optimizing both financial and human resources.