The AI Security Layer for insurance: append-only audit log for state insurance recordkeeping, contained subprocess execution for AI underwriting agents, PII / SSN auto-redaction, and pre-mapped controls across 12 compliance frameworks (+8 reference catalogs). All 4 platforms from $2,000/mo, billed annually.
Proactive protection against threats targeting policyholder data and claims systems
Attackers submit fraudulent claims through APIs. Behavioral baselines + adaptive Z-score circuit breaker catch velocity anomalies and slow-and-low patterns over 24h sliding windows.
Bulk scraping of policyholder PII, SSNs, and financial data via quote or lookup APIs. Sliding-window rate limits and response-size caps block enumeration attacks at the gateway.
Attackers manipulate underwriting APIs to get fraudulent quotes. Schema validation, parameter pollution detection, and HMAC signature verification block tampered payloads before they reach the underwriting model.
API Security + MCP Security + AI Gateway + Verification Engine — unified on one finding bus for insurance workloads
Secure claims, policy, and quoting APIs. Pre-mapped to PCI DSS v4.0 requirements, with a control crosswalk to overlapping SOC 2 controls.
Secure AI agents that assist with underwriting decisions. Every tools/call passes 7 sequential checks — permission, MFA, rate limit, rug-pull (SHA-256), threat detect, forwarding, response scan — before touching risk databases.
Route LLM calls for risk assessment and claims processing. PII / SSN scrubbing before LLM processing; adaptive Z-score circuit breaker for failover.
Validate every AI-driven underwriting or claims decision before it approves a policy or denies a claim. Real-time enforcement with staged rollout; BLOCK-capable on selected critical paths.
Zero code changes to your claims systems or AI underwriting stack. Target: Sub-5ms gateway proxy overhead on cached, single-region paths.
Not in Anthropic's MCP spec. Not in API gateways. Not in WAFs. Platform-level additions built for insurance workloads.
MCP servers the proxy launches locally (stdio, off unless the operator sets MCP_STDIO_SERVERS_ENABLED) run in their own session (setsid), drop to nobody if started as root, and get no-new-privs, ambient capabilities cleared and RLIMIT_AS/FSIZE/NOFILE/NPROC ceilings. Remote (HTTP) servers are proxied and inspected, not sandboxed, and network egress is not filtered.
SHA-256 hash of every underwriting tool definition pinned at tools/list. On every tools/call, the cached definition is re-hashed and compared. Drift raises MCPRugPullDetectedError, blocks execution, publishes a CRITICAL event.
Statistical, not threshold-based. Z-score > 3.0 against per-hour time-of-day baselines (catastrophe surge vs steady-state). 4 overlapping sliding windows (1m/5m/15m/1h). Progressive recovery (10→25→50→100%).
Findings from all four pillars land on one threat-event bus. A compound correlator groups them in 5-minute windows by correlation ID and by organization + client IP, and raises one incident when they match a known multi-stage pattern: a prompt injection at the gateway plus an SSRF probe and a path traversal at the API from the same client become a single critical Lethal Trifecta finding.
HMAC-SHA256 hash chain on authentication and domain events (since 2026-09-13), each entry signing the previous. Three verification levels (full / single / last-N). Control mapping (not an attestation) for SOC 2 CC7.2, NAIC Model #668 audit, and SIU fraud investigations.
Cross-session attack detection: 6-dimension risk score (max 110) across tool sensitivity, data volume, burst, denials, prior detections, and tool diversity. Catches organized claim-fraud rings and 24h slow-and-low patterns.
Every pillar publishes its findings to one threat event bus. The compound correlator joins findings on the same request by correlation ID, and separate requests from one client by organization + client IP.
mcp_tool_calls with its correlation ID • Compound findings link every contributing finding • Hash-chain entries are tamper-evident for SIU investigationsBuilt for every type of insurance organization
Secure property and casualty claims APIs. Detect fraud patterns and protect policyholder data from breaches.
Protect life insurance and health plan APIs. Secure beneficiary data and underwriting decisions with an append-only audit trail.
Secure treaty and facultative reinsurance APIs. Protect large data transfers between carriers and reinsurers.
Every claims event written to the append-only audit log. Control crosswalk: each SOC 2 control is mapped to its overlapping PCI DSS requirements.
"-Ready" / "aligned" reflect capability posture. PCI-DSS certification requires a Qualified Security Assessor (QSA) engagement on the customer's side; SOC 2 Type II observation in progress with external audit H2 2026.
Join insurance carriers and InsurTech companies using G8KEPR to prevent claims fraud, secure AI underwriting, and protect sensitive policyholder data with documented evidence.