Insurance Banana Skins – an Australian perspective

For the third consecutive edition, cyber crime holds its position as the most critical risk in the global insurance industry, as identified in the 2025 Insurance Banana Skins report. This persistence underscores the escalating sophistication and frequency of cyber threats, driven by both private and state-sponsored actors. Advances in artificial intelligence (AI) have notably amplified the threat landscape, lowering the barrier to entry for cybercriminals.

The insurance sector, with its sensitivity and concentration of valuable data, remains a prime target for cyber attacks. Breaches infiltrating insurers’ operations can result in devastating financial and reputational repercussions. The report highlights a growing sense of inevitability about cyber-attacks, with organisations recognising the real and present danger they face daily. “Cyber threats are definitely a ‘when’, not an ‘if’,” echoed a respondent from New Zealand, reflecting the industry’s heightened awareness and urgency for vigilance.

AI is reshaping the cybersecurity landscape for insurers, intensifying the battle against evolving cyber threats. While it may drive operational efficiency AI’s rapid adoption also poses risks. Poor governance and misuse can lead to greater vulnerabilities and proliferation of data, and the use of AI technology by threat actors has the potential to super charge the volume and of impact of attacks.

Insurance providers are compelled to embrace a proactive stance on cybersecurity, investing in resilient infrastructure capable of addressing the complexities of modern threats. The 2025 report, with a score the highest of any Banana Skin in almost 15 years of survey responses, stresses the urgency for the industry to enhance planning and response capabilities, particularly concerning risks originating from third-party vendors and cloud-based systems. Recognising the constraints of maintaining robust cyber defences, respondents express concerns about the balancing act between prudent investment and operational overheads.

Addressing cyber crime risk will require insurers to reassess their capabilities, talent and technology. There is a growing need to revisit cyber strategies, in the face of a shifting world order and exponential leaps in technology. Meeting the moment will require renewed urgency, creativity and different approaches, including strategic investments in AI-driven security technologies, improved threat intelligence, and comprehensive governance frameworks. This approach will empower insurers to strengthen their foundational security practices and implement future-ready measures calibrated to the evolving world we’re in.

Technology continues to feature prominently in the Insurance Banana Skins 2025 survey, reflecting its dual role as both a critical enabler and a growing source of systemic risk for Australian insurers. While advances in cloud, SaaS, data and automation promise efficiency and innovation, the survey highlights a more foundational concern: the increasing complexity and fragility of insurers’ technology ecosystems, particularly their dependence on third-party vendors.

1. Deepening Dependence on Technology Vendors

Australian insurers are increasingly dependent on a number of strategic technology vendors to support critical operations, from core systems to data and infrastructure. The 2025 survey highlights rising concern around vendor concentration risk and operational resilience.

As reliance deepens, insurers are more exposed to vendor outages, service degradation and shifts in vendor strategy. In a highly regulated environment, these disruptions can quickly escalate that can impact customer outcomes, regulatory compliance and business continuity.

2. SaaS Transformation: Strategic Imperative, Operational Risk

SaaS has become central to insurers’ modernisation agendas, offering scalability, speed and access to innovation. However, the transition away from legacy systems remains complex and risk-laden.

Legacy environments continue to constrain integration and slow transformation, while rapid SaaS migration can introduce new control gaps and accountability challenges. Insurers are increasingly focused on balancing speed of change with operational stability, recognising that technology transformation is as much an operating model shift as a systems upgrade.

3. Rebalancing the Vendor–Insurer Relationship

A standout theme in the 2025 Banana Skins results is insurers’ growing desire for greater influence over vendor product roadmaps. Historically, technology vendors have dictated development priorities, with insurers adapting their processes to fit vendor-led solutions.

That model is now under strain. Insurers are calling for deeper collaboration, co-design, and shared accountability, particularly as regulatory requirements, customer expectations, and risk profiles evolve more quickly than vendor release cycles.

For Australian insurers, a more balanced partnership model promises tangible benefits: solutions better aligned to local regulatory obligations, reduced customisation and integration risk, and stronger return on technology investment. For vendors, it presents an opportunity to build stickier, more strategic relationships, but only if client influence is genuinely embedded.

4. The Foundational Technology Risks

While AI and cybersecurity dominate headlines, the survey reinforces that foundational technology risks remain unresolved. Core system modernisation, data governance, cloud architecture and ecosystem management are deeply interconnected. 

When neglected, these issues can compound: 

• Weak data foundations undermine AI value
• Poor vendor governance amplifies cyber exposure
• Legacy platforms slow regulatory response

Technology risk in 2025 is therefore not siloed; it is systemic. Australian insurers increasingly recognise that mitigating these risks requires a holistic technology strategy, one that integrates infrastructure renewal, third-party oversight, data stewardship, and operating model change.

From Banana Skin to Strategic Advantage

The message from Insurance Banana Skins 2025 is clear: technology risk is no longer a background concern, it is a board-level issue central to resilience and long-term competitiveness.

Insurers that strengthen vendor partnerships, modernise responsibly and embed technology risk into enterprise decision-making will be better positioned to convert technology from a recurring banana skin into a source of resilience and growth. 

Artificial intelligence has shot up the risk rankings for Australia’s insurers in 2025, reflecting how quickly this new force is reshaping the industry. Just two years ago, AI barely cracked Australia’s top ten concerns. Now it sits at number three on the Banana Skins list, a jump that highlights our rapidly evolving digital landscape.

It is not just Australia. Across Asia-Pacific (where AI ranks second) and globally (also second), insurers everywhere are sounding the alarm about AI. Responsible AI has rapidly become a top priority.

So why is AI such a worry? In short, it is a powerful tool that can cut both ways. On one hand, AI promises to transform how insurers operate, from crunching data in underwriting to automating claims. On the other hand, if AI is misused or not properly controlled, it opens up new vulnerabilities.

Imagine an AI model making claims decisions that nobody can explain, or chatbots that accidentally leak customer data. Worse, think of cybercriminals using generative AI to craft ultra-convincing scams. These scenarios were science fiction a few years ago; today, they are very real concerns.

The technology is sprinting ahead of the frameworks we must manage it. Without the right oversight, AI could amplify risks such as fraud, bias, and compliance breaches faster than we can keep up.

At the same time, AI is also a huge opportunity, and that is the optimistic flip side of this story. Yes, it is a source of new risk, but it is also a game-changer for those who get it right. In fact, the Banana Skins report notes a bit of irony: failing to embrace AI is itself becoming a risk.

If you are too slow to adapt, you could fall behind competitors that use AI to underwrite more accurately, settle claims faster, or personalise products better. In a market this competitive, nobody wants to be playing catch-up because they ignored a technology that can drive efficiency and growth.

The challenge is not “AI or no AI”; it is how to adopt AI confidently and responsibly. It is about moving quickly to seize AI’s benefits; while keeping the right controls in place so you can trust the outcomes.

What is needed to strike that balance?

• First, strong governance and ethics around AI. Insurers are starting to put guardrails on their AI by setting rules for how and which models are used, regularly testing for biases or errors, and ensuring there is human oversight for major decisions. This builds trust that AI is a well-monitored tool.
• Second, investment in people and systems. Many Australian insurers are hindered by legacy IT platforms, poor-quality data, and a shortage of AI-skilled talent, all of which make it tough to deploy AI effectively.

We have seen cases where an AI pilot failed simply because the data was poor or the team was not equipped to interpret the results. By modernising core systems and upskilling teams, insurers can lay a foundation where AI projects succeed more often than they stumble.

When your people understand AI and your technology can support it, you are far less likely to be caught off guard by “surprise” outcomes. Instead, you can innovate in a controlled, transparent way.

The good news is, we do not have to start from scratch or go it alone. The latest NAIC guidance, released in October 2025, gives us a practical roadmap: six essential practices for responsible AI adoption that every insurer can start with, no matter where you are on your AI journey.

• First, make sure someone is responsible. Every AI system needs a clear owner so nothing falls through the cracks.
• Second, understand who could be affected and plan for it. AI moves quickly, so keep feedback channels open and pay attention to those who might be impacted.
• Third, treat risk management as ongoing. Match your controls to the level of risk and learn from any incidents.
• Fourth, be transparent. Track your AI systems, let people know when they are interacting with AI, and explain decisions in plain language.
• Fifth, keep testing and monitoring. Do not just set and forget; watch performance, stress-test, and get independent checks for important uses.
• Finally, keep humans in control. Build in override options, train your team, and always have a backup if the technology misbehaves.

If we get it right, AI could become less of a “banana skin” and more of a catalyst, helping insurers detect fraud faster, serve customers better, and operate more efficiently, so you can focus on sustainable growth. 

By taking these steps now, Australian insurers can turn risk into opportunity and lead the way in responsible AI adoption.

Political risk has climbed sharply to the fourth most important risk for Australia’s insurers in 2025 compared to ninth globally and up from eighth position in our last survey. Results indicate heightened sensitivity to regulatory and geopolitical shifts in response to elevated community concerns over the past 12 months locally and globally. 

Locally the unexpected scale of the win for the incumbent Australian government in the May general election, and the political fracturing that has heightened since over topics such as net zero, has elevated political uncertainty. Analysis of voter sentiment points to several economic concerns – cost of living, housing affordability and economic security – with younger and lower-to-middle income voters seeking more active government intervention on these issues¹. 

Affordability remains a key area of political pressure. While the consumer price index moved back within the RBA’s preferred 2-3% band early in the year, housing costs throughout the year have continued to rise alongside the price of electricity with the latter being the main contributor of goods inflation - up 37.1% in the twelve months to October 2025 following the conclusion of state government rebates for households. Services inflation has been driven by rents, medical and hospital services, domestic holiday travel and accommodation. 

Rising inflation is now back on the watch list as a more likely downside risk – and inflationary pressures are in part coming from government actions – imposing tariffs and the related supply disruptions; growth in public sector jobs and wages; continued budget deficits; and low productivity.   

The year has not been without its share of extreme climate events, such as Tropical Cyclone Fina in Darwin occurring unusually early for a cyclone (in November 2025) and ex-Tropical Cyclone Alfred hitting Southeast Queensland and Northern New South Wales in March 2025. The latter brought record rainfall, destructive winds, and severe coastal erosion that caused widespread flooding and damaged infrastructure. Insurers are mindful that increasing frequency and severity of weather events could prompt greater regulatory scrutiny and oversight, and government initiatives could include mechanisms for minimising the costs to households while potentially increasing pressure on insurers bottom lines.

Looking farther afield while the election of a US President wouldn’t normally attract significant attention from Australian business, the Trump Administration hit the ground running with a swathe of wide-ranging and far-reaching trade, foreign policy, budgetary, immigration, industry policy and defence changes. As one of the world’s largest economies with the deepest financial system the impacts of these changes have been felt across the world. It has been a priority for governments and business globally to understand and analyse the impacts and risks of US policy changes.

Indeed, throughout the year geopolitics has driven fundamental changes to business risk and uncertainty by being a root cause of several military conflicts, global supply chain reconfigurations, and shifting trade relationships. Uncertainty, elevated risk and unpredictability are now the norm, and while risk can be measured and prepared for with known probabilities, uncertainty represents the unknown unknowns - scenarios we cannot fully predict or prepare for. Today’s climate presents both challenges for insurers.

Managing Regulatory Change in Insurance: A Practical Approach to Compliance

The latest Banana Skins Survey shows that ‘regulatory change’ has moved to the fifth position among risks in the insurance sector. This shift suggests insurers are becoming more accustomed to the ongoing pace of regulatory reform.

Regulatory change remains a constant, driven by several key factors. These include:

• rising cyber and data risks, fraud, and scams linked to increased use of artificial intelligence. 
• insurance affordability concerns, prompting a focus on supporting vulnerable customers and ensuring transparency in pricing and fairness.
• increasing transparency across claims processes, including third-party suppliers, to improve transparency throughout the claims lifecycle.
• Ensuring recent regulatory reforms such as AASB S2, FAR, and CPS 230 are fully embedded, while also seeking opportunities to strengthen compliance frameworks moving forward.

To manage these considerations effectively, leading insurers are adopting compliance by design—building regulatory requirements into processes from the start to avoid relying on reactive controls.

Leading insurers are also working to optimise existing controls rather than add numerous new ones, reducing complexity while maintaining compliance. This is aided through using AI across regulatory horizon scanning and GRC systems.

Finally, a shift toward managing regulatory change with the customer in mind is essential.  This means having a clear focus on managing compliance and risks to deliver good customer outcomes.