Where an insurance CIO's decisions reach the policyholder

I plan catastrophe readiness around the two weeks after an event, not the first night. Japanese non-life insurers face typhoons every autumn and earthquakes without warning, and the constraint after either is rarely the website. It is the number of people who can assess, approve and pay, and the time it takes to give them safe access. At Kotonami I built surge mode between 2021 and 2023: a short reporting form hosted apart from the core claims system, a photograph-based route for small claims within limits the head of claims sets, about 900 dormant accounts that two named managers activate after a disaster headquarters is declared, and a payment run that can be repeated during the day. We rehearse activation twice a year. I report the measures that matter to the board after every significant event: days to pay half and four-fifths of claims, how long the oldest unassigned claim had waited, and the people working claims each day.

Most of our policies are sold and renewed by agencies, many of which also represent other insurers. The Act on the Protection of Personal Information makes us answerable for how people who handle our policyholders' data on our behalf treat it, and the sector learnt in 2024 how much customer information can move between insurers through shared agencies. My approach is to make the safe way the quickest way. We switched off bulk exports of policyholder lists, rebuilt the renewal worklist inside our portal so that agencies had no reason to keep spreadsheets, and issued about 6,000 managed tablets with remote wiping. Small agencies use a smartphone app that keeps documents in a protected container. Large dealer groups may connect their own customer systems only under a contract that sets what they may hold, for how long and with what audit rights. I measure agencies' renewal-visit times as closely as data incidents, because a slow tool produces workarounds.

Kotonami's motor and household policies ran on a mainframe whose oldest programs date from the 1980s, maintained by a shrinking number of engineers. I inherited a big-bang rewrite that had specified only 31 per cent of its requirements after two and a half years. I recommended stopping it, accepted a ¥4.1 billion write-off and replaced it with migration product by product onto a packaged policy-administration platform, configured rather than rewritten. Small-business property moved first in 2023 and household fire in 2025, with motor due in 2027. I judge a renewal programme by three things: the share of products already live on the new platform, the number of mainframe programs actually switched off, and the run cost that has really left the budget. A programme that adds a new system without retiring an old one has doubled the estate it set out to simplify, however modern the new part looks.

Japanese insurers buy much of their engineering from system integrators, usually on contracts priced by the person-month and delivered through several layers of subcontractors. I do not believe the answer is to bring everything in-house; integrators carry skills and peak capacity we could not afford to keep. But I want the judgements that decide whether a system works to be made by our own people. Since 2021 we have grown the CIO's office from 40 to 120, mostly by hiring mid-career engineers and architects, and we now run design reviews and acceptance testing ourselves. Run services are paid against service levels rather than hours, which reduced our largest run contract by 12 per cent. Change work remains on time and materials where the scope is genuinely uncertain. Every contract names the subcontracting layers that may touch policyholder data, and our engineers sit in the same teams as the integrator's rather than reviewing their work at arm's length.

An insurer's cyber exposure does not end at its own offices. The most likely point of entry into Kotonami is a shared computer in a repair shop or a family agency, logged into our portal with a reused password. Since 2022 every agency login requires a second factor, and our tablets and app keep no policyholder files on the device. I assume that ransomware will one day reach part of our estate, so we have agreed in advance with claims and finance the order in which services return: claims payment first, then renewals, then new business. Backups for the payment and policy systems are held in an isolated environment that our ordinary administrators cannot alter. We run an exercise every year in which outside directors join the executive committee to make the decisions a real incident would force, including when to tell regulators, agencies and policyholders, and we follow the security guidelines that Japanese financial institutions commonly adopt.