ACKO: Securing digital insurance in the age of AI — balancing innovation, risk, and resilience

In today’s hyper-connected era, digital trust has become the cornerstone of every customer interaction. Nowhere is this truer than in the insurance industry, where vast volumes of sensitive personal and financial data flow through digital ecosystems daily.

At the heart of this transformation stands ACKO, India’s first born-digital insurer, redefining how security, speed, and scale can coexist.

“Security is not an afterthought at ACKO — it’s built into our engineering process from day one,” says Harish Rama Rao, Senior Vice President – Product Engineering at ACKO.

For ACKO, security is not just a compliance mandate — it’s a strategic enabler of innovation.

Building security by design

ACKO operates in a highly regulated environment, managing millions of customer touchpoints every day. Rama Rao explains that every feature ACKO develops — whether for claims processing, policy issuance, or engagement — begins with security and governance built into the design.

“We operate at speed — our innovations reach millions instantly. So, we embed compliance and security right from the product design stage,” he says.

ACKO follows a “shift-left” philosophy, integrating security early in the development lifecycle. This ensures that vulnerabilities are addressed before code reaches production. Every product release is guided by InfoSec guidelines embedded in ACKO’s engineering framework, allowing new features to inherit the same security and privacy standards automatically.

The result? Faster, safer innovation — where compliance and agility go hand in hand.

Cloud-native strength for scale and resilience

As a cloud-born organisation, ACKO doesn’t deal with the constraints of legacy infrastructure. Instead, its architecture is designed for elastic scalability, redundancy, and high availability.

“Our systems are deployed across multiple availability zones, so even if one data centre fails, operations continue without impact,” explains Rama Rao. “We architect our systems to automatically scale up during peak traffic and scale down during quiet hours — optimising both cost and performance.”

This cloud-native approach also underpins ACKO’s disaster recovery strategy. A multi-data-center (multi-DC) setup ensures resilience through hot, warm, and cold standby environments — each ready to take over instantly in the event of an outage.

“Customer experience is paramount. Downtime is simply not an option,” Rama Rao emphasises.

Zero Trust as a security backbone

In the world of interconnected ecosystems — APIs, digital partners, and cloud integrations — Zero Trust architecture has become fundamental to ACKO’s operations.

“Zero Trust is both a philosophy and a pattern,” says Rama Rao. “We assume nothing is inherently secure — every interaction, internal or external, must be verified.”

This means no shared credentials, encrypted communications, and strict key rotations. Internal systems talk through secure, authenticated channels — ensuring that every identity, every access, and every device is verified before trust is established.

ACKO’s partners and third-party systems are also required to comply with these same standards, ensuring trust without assumption across the entire ecosystem.

AI and agentic systems: Security in the new frontier

The rise of AI and agentic systems presents both unprecedented opportunities and new forms of risk. ACKO has embraced the promise of AI — from automating claims to improving customer journeys — but never at the cost of governance.

Rama Rao explains, “We don’t lower the security bar for AI or agentic systems. Even when agents access or process data, they must pass through the same security layers as any other system.”

To minimise exposure, ACKO follows the principle of data minimisation — sharing only the minimum required information with external large language models (LLMs), and ensuring that data is not retained post-processing.

“We run AI-generated code in secure sandboxes, with strict authorisations and frequent audits,” he says.

This cautious yet forward-looking approach allows ACKO to leverage AI’s potential while maintaining control over privacy, integrity, and accountability.

Automation and continuous vigilance

Speed is vital in digital insurance, but so is precision. ACKO uses real-time monitoring, anomaly detection, and automated alerting systems to stay proactive against emerging threats.

The company’s platform continuously tracks data flows, detects unusual activity, and triggers automated responses before they escalate. This AI-driven vigilance helps ACKO maintain both compliance and customer trust in an evolving cyber landscape.

“Once you build the right platform and practices, product innovation becomes fast, safe, and scalable,” Rama Rao notes.

The human side of technology

Despite being deeply immersed in technology, Rama Rao believes that innovation is ultimately human-driven. “Great systems come from empowered teams that understand both speed and responsibility,” he reflects.

When asked how he balances the pressures of leading a digital-first engineering function, his answer is refreshingly grounded. “I love to travel — to drive through India’s landscapes, meet people, explore food, and reconnect with culture. It keeps me balanced and rooted.”

This human connection — between innovation and mindfulness — mirrors ACKO’s broader ethos: move fast, but move responsibly.

The road ahead: Responsible innovation at scale

As digital ecosystems expand and AI reshapes industries, ACKO’s approach offers a blueprint for others in the BFSI sector:

• Embed security early rather than layering it later.
• Adopt Zero Trust as a default, not an afterthought.
• Balance automation with oversight, ensuring transparency and control.
• Invest in people, not just technology.

In a sector where trust defines success, ACKO is proving that speed and safety are not opposites — they are allies.

By building on its cloud-native foundation and embracing secure innovation, ACKO continues to show how an insurer can scale responsibly in the era of AI, agentic systems, and digital-first customer experiences.

“For us, security is not a destination — it’s an ongoing journey of learning, adapting, and innovating,” concludes Rama Rao.