Pipes or Harmony
An analysis of APIs, RPA and Agentic AI: insurer-broker integration, infrastructure security, consumer protection and the protection gap.
· FRANK · English
Download PDF"The risks that an API infrastructure poses to the insurer-broker symbiosis, turning it into a commodity, potentially harming the consumer by incentivising comparison tools and a wider protection gap. A brief overview of the benefits that a new Agentic infrastructure promises to deliver."
An Analysis of APIs, Agentic AI, and Ecosystem Stability
The Strategic Triangle and the Operational Efficiency Crisis: The Context of the Protection Gap
The contemporary insurance ecosystem rests on a delicate balance between three fundamental actors: the insurer, the broker, and the client. However, this "strategic triangle" currently faces an existential threat known as operational suffocation. Analysis of the insurance market, particularly in the European and Portuguese context, reveals that a disproportionate share of human and financial resources is consumed by low-value tasks, such as manual form-filling, exhaustive data duplication, and complex administrative navigation across multiple portals.¹ This bureaucratic burden is not merely a logistical inconvenience; it is the primary driver behind the widening of the protection gap, as significant resources end up devoted to back-office work rather than risk advisory. The protection gap is technically defined as the disparity between total economic losses and the portion of those losses that is effectively covered by insurance.³ In 2017, the global natural catastrophe protection gap reached $195 billion, representing approximately 59% of total economic losses.³ In Portugal, the Insurance and Pension Funds Supervisory Authority (ASF) has issued warnings about critical vulnerabilities, particularly regarding seismic risk and extreme weather events.⁴ Only 19% of Portuguese homes have coverage against seismic events, and Portugal's natural catastrophe protection gap is the fifth largest in the European Union.⁵ Closing this protection gap requires insurance brokers to strengthen their role as risk advisors. A broker who acts merely as an administrator loses the ability to identify complex needs and provide dedicated client follow-up.⁶ Technology must therefore serve the social purpose of "streamlining to bring closer", as ASF President Dr. Gabriel stated at APROSE's 50th anniversary, freeing up human capital for the specialised advisory work that can, in practice, mitigate the under-protection of families and businesses.⁵
The Technological Duality: The Role of APIs and the Risk of Reverse Engineering
Digital integration between insurers and brokers has historically been presented as a binary choice between developing Application Programming Interfaces (APIs) and using insurer portals. While APIs are often described as the "gold standard" of technical integration, their widespread implementation has surfaced data sovereignty and intellectual property risks that were previously underestimated.⁹ APIs allow insurance products to be "embedded" directly into broker workflows, facilitating real-time quoting and instant policy issuance.¹¹ However, this exposure of business logic through programmatic endpoints has opened the door to reverse engineering of pricing models. Competing entities or sophisticated aggregators can employ "Functionality Stealing" techniques, using the API to extract information through carefully crafted queries.¹³ By analysing the probability distributions and confidence scores of thousands of quotes, these actors can map the decision boundaries of an insurer's actuarial algorithms.¹³ This parameter extraction process allows third parties to replicate the behaviour of proprietary models, creating surrogate models that mimic the original pricing logic without the need to invest in underlying actuarial research.¹³ There is also growing concern about large-scale online price comparison, which has contributed to a wider protection gap in several markets by incentivising consumers to purchase insurance products purely on price, often with reduced coverage, undermining transparency and the overall level of consumer protection.¹⁴ Finally, APIs allow brokers to break free from their operational and commercial dependence on insurer portals, effectively turning that relationship into a commodity. This places the current symbiosis between the two parties at risk, making deeper collaboration for the benefit of the consumer more difficult. Historically, the proximity between insurers and brokers has enabled the development of best practices and better products, contributing to stronger consumer protection.
| API Exposure Threat | Attack Mechanism | Strategic Consequence | ||||||
| Model Reverse Engineering | Mass queries to map decision boundaries.¹³ | Replication of products | ||||||
| by competitors without | ||||||||
| R&D investment. | ||||||||
| Model Inversion | Reconstruction of training data from outputs.¹³ | Privacy breach and | ||
| exposure of trade | ||||
| secrets. | ||||
| Comparison tools widen the protection gap | APIs can enable mass quoting and broader online comparison. | Comparison tools | ||
| incentivise reduced | ||||
| levels of coverage. | ||||
| Commoditisation of insurer/broker integration | Creation of separate information systems for operational and commercial purposes. | Reduces operational and | ||
| commercial | ||||
| collaboration between | ||||
| parties. | ||||
The Problem of Uncontrolled Automation: RPA and Crawlers as Threats to the Infrastructure
In the absence of robust APIs, or in response to their implementation complexity, many brokers and aggregators have turned to Robotic Process Automation (RPA) and crawlers to extract information directly from insurer portals. While these tools may reduce manual workload in the short term, their uncontrolled use has caused severe stability and security problems for insurers' digital infrastructures.¹⁵ RPA bots function by mimicking human actions, but at a speed and frequency that the original systems are often not built to handle. Bot traffic can represent a critical share of server consumption, generating traffic spikes that compete for the same limited resources as legitimate human users.¹⁶ Technical reports indicate that, in certain digital ecosystems, bots account for only 35% of page views but are responsible for 65% of the most computationally expensive server requests.¹⁶ This phenomenon can lead to performance degradation or even full portal outages, particularly during periods of high demand such as mass renewals or catastrophic claims surges.¹⁶ Beyond instability, the use of RPA introduces significant security vulnerabilities. The common practice of sharing credentials between brokers and aggregators creates exposure points that can be exploited by malicious actors for Account Takeover attacks or payment fraud.¹⁷ Historical cases, such as the Target breach in 2013, demonstrated how access through a supplier portal with limited security controls can enable lateral movement within a network and the exfiltration of data belonging to millions of customers.¹⁹ In the insurance sector, Erie Insurance suffered widespread operational disruptions for nearly a month in 2025 due to a cyber attack that forced the closure of client portals, illustrating the danger posed by infrastructures that become targets due to the constant noise of automation traffic.²⁰
| Technical Impact of | Description | Operational | ||||||
| Automation | Consequence | |||||||
| Excessive server consumption | Mass requests from scrapers overload the network.¹⁶ | Increased costs and | ||||||
| latency for legitimate | ||||||||
| users. | ||||||||
| Uptime and stability risk | Consumption spikes cause server failures.¹⁶ | Portal unavailability for | ||||||
| brokers and clients. | ||||||||
| Layout fragility | Portal changes break RPA scripts ("Version Drift").¹⁵ | Business process | ||||||
| interruption and | ||||||||
| maintenance costs. | ||||||||
| Security risks | Bot traffic masks | Difficulty detecting real | ||||||
| intrusion attempts and | ||||||||
| attacks in real time. | ||||||||
| probing.¹⁶ | ||||||||
The Online Comparison Paradox: Price vs. Protection and the Impact on Consumers
The exponential growth of price comparison websites (aggregators) has profoundly transformed consumer behaviour in the insurance sector. While these platforms promise transparency and ease of choice, evidence gathered by regulators such as the Financial Conduct Authority (FCA) and EIOPA suggests that an exclusive focus on price has had a negative impact on consumer protection.²³ Aggregator architecture favours "price prominence distraction", where fundamental product characteristics, coverage exclusions, and indemnity limits are pushed into the background in favour of the premium value as the primary decision criterion.²⁴ Qualitative FCA research revealed that many consumers use these tools to simplify a complex decision, actively avoiding reading policy details and frequently, and incorrectly, assuming that all insurance products are broadly identical.²³ This behaviour is reinforced by visual elements such as green ticks used to denote included coverages, leading consumers to believe they are fully protected without understanding what those ticks actually mean in contractual terms.²³ This market dynamic has incentivised practices such as "price walking", where insurers offer artificially low initial prices to appear at the top of aggregator rankings, by reducing coverage levels and raising excesses, before applying significant, risk- unrelated price increases at renewal.²⁶ The net result is a widening protection gap: the consumer buys the cheapest product, only to discover at the time of a claim that high excesses or specific exclusions negate the financial benefit of the initial saving.²³ It is estimated that, in the UK home insurance market alone, these practices have caused £750 million in consumer detriment.²⁷
| Behavioural Bias in | Mechanism of Influence | Impact on Protection | ||||||
| Aggregators | ||||||||
| Price anchoring | The lowest price sets the | Lower willingness to pay for quality coverage. | ||||||
| expectation for the | ||||||||
| entire market.²³ | ||||||||
| Present bias | Prioritisation of immediate savings over future security.²³ | Selection of policies with | ||||||
| critical exclusions left | ||||||||
| unread. | ||||||||
| Standardisation illusion | Belief that all policies work the same way.²³ | Discovery of coverage | ||||||
| gaps only at the time of a | ||||||||
| claim. | ||||||||
| "Stacking" effect | Dominance of certain brands occupying top positions.²⁶ | Reduced product | ||||||
| diversity and real | ||||||||
| competition. | ||||||||
Comparative Analysis: APIs, RPA, and Agentic AI
The choice between these three technologies should not be arbitrary, but grounded in the complexity of the process and the need for resilience. While all three aim for efficiency and error reduction, their operating mechanisms and risk profiles are distinct.
Fundamental Similarities
All three models share the objective of eliminating repetitive manual tasks and reducing the operational cost per policy or claim. Additionally, all three technologies seek to integrate into existing business environments to accelerate digital transformation, allowing organisations to scale operations without a linear increase in headcount.
Critical Differences and Capabilities
| Characteristic | API | RPA | Agentic AI | ||||||||
| Execution Logic | Based on explicit, rigid technical contracts.³⁸ | Deterministic, | Goal-oriented | ||||||||
| rule-based "if- | with autonomous | ||||||||||
| this-then-that". | reasoning. | ||||||||||
| Data Type | Highly structured data only. | Primarily structured data and forms. | Processes | ||||||||
| unstructured data | |||||||||||
| (images, audio, | |||||||||||
| free text). | |||||||||||
| Adaptability | Requires manual development for any change.³⁸ | Very brittle; fails with minor layout changes. | Adaptive; learns | ||||||||
| from feedback | |||||||||||
| and adjusts | |||||||||||
| strategies in real | |||||||||||
| time. | |||||||||||
| Maintenance | Medium/High | Very high (constant correction of | Low/Self- correcting (self- healing | ||||||||
| (version | |||||||||||
| management and | |||||||||||
| security).³⁸ | |||||||||||
| broken scripts). | capability). | ||||||||
| Primary Risk | Reverse | Systemic instability and infrastructure overload.¹⁶ | Requires guardrails, human oversight, and data quality. | ||||||
| engineering and | |||||||||
| exposure of | |||||||||
| proprietary | |||||||||
| models. | |||||||||
| ROI | High in the long term, but with a high initial technical cost. | Fast for simple tasks, but plateaus after 6– 12 months. | Exponential and | ||||||
| sustainable; 4x– | |||||||||
| 5x superior in | |||||||||
| complex | |||||||||
| scenarios. | |||||||||
While APIs are ideal for system-to-system communication delivering high reliability, and RPA serves "simple" tasks in stable systems, Agentic AI represents the necessary evolution for processes that demand continuous judgement and adaptation, functioning as a "digital collaborator" rather than a simple script.
The Third Way: Agentic AI (Frank) as an Engine of Symbiosis and Efficiency
In the presence of API limitations and the precariousness of traditional RPA, Agentic AI emerges as an innovative technological bridge. Unlike tools that attempt to circumvent insurer systems, Agentic AI, as embodied by platforms such as Frank, "inhabits" the portal, acting as a digital productivity assistant for the broker. It keeps human oversight at the centre of the process while respecting the intellectual property and server infrastructure of insurers.¹¹ Agentic AI uses natural language processing and advanced computer vision to interpret unstructured data, converting it into structured data ready for processing.²⁸ Unlike "blind" RPA, these tools are capable of identifying changes in portal layouts and adjusting autonomously, drastically reducing the maintenance costs associated with the vulnerability of traditional scripts.³⁰ A critical pillar of the Frank model is security and accountability. Through queue systems, Agentic AI manages requests sequentially so as not to overload insurer servers, avoiding the mass-processing of operations and ensuring that the broker's digital behaviour resembles that of a diligent human user.²⁸ Furthermore, full traceability of every action ensures that the insurer maintains visibility over who is consulting their products and how, protecting brand sovereignty and the integrity of the broker distribution channel.³¹ This model of "technological symbiosis" enables brokers to recover 60% to 70% of working hours previously lost to repetitive tasks.³³ This time reclaimed is the catalysing element needed to combat the protection gap. With the support of Agentic AI, brokers can devote themselves more fully to risk advisory, contributing to stronger levels of protection, ensuring that technology serves to strengthen, not cool, the relationship between insurer, broker, and client.¹
Conclusion: Harmony
The future of technological integration in the insurance sector will inevitably be shaped by a regulatory framework adapted to technological evolution. The ASF, in Portugal, and EIOPA, at the European level, have reinforced the need for data governance to ensure that digitalisation does not work against the interests of the client.³⁴ The imminent publication of specific reports on broker activity by the ASF underscores the strategic importance of these professionals in protecting the real economy.⁵ Technological evolution in insurance mediation should not be seen as the replacement of human by machine, but as the creation of an efficiency infrastructure that enables humans to perform their role more effectively. APIs serve the mass processing of simple, standardised operations, separating insurer and broker systems and turning the insurer-broker relationship into a commodity. Agentic AI operates on existing channels, keeping the broker-insurer interaction in control and nurturing the current harmony between them, while achieving a high level of efficiency, security, and adaptability. The right balance between these tools serves the purpose of freeing resources from low-value back-office tasks towards higher-quality risk advisory, contributing to closing the protection gap and ensuring an insurance ecosystem that is resilient, ethical, and genuinely focused on the consumer. The expected outcomes are a stronger level of protection and a more professionalised brokerage sector at the service of the client.
Authors Written by FRANK with the help of Gemini
Works cited
1. Brokering a new path: navigating administrative burdens in the health insurance Marketplaces - PubMed, accessed on February 27, 2026, https://pubmed.ncbi.nlm.nih.gov/41694247/
2. HPM researchers are focusing on burdens that keep people from insurance coverage and health care, accessed on February 27, 2026, https://www.publichealth.pitt.edu/news/hpm-researchers-are- focusing-burdens-keep-people-insurance-coverage-and-health-care
3. Addressing the Protection Gap Through Public/Private Partnerships and Other Mechanisms (December 2019) - Treasury, accessed on February 27, 2026, https://home.treasury.gov/system/files/311/December2019FACI_Protect ionGapPresentation.pdf
4. PLANO DE ATIVIDADES OVERVIEW 2025 - ASF - Portal do Consumidor de Seguros e Fundos de Pensões, accessed on February 27, 2026, https://www.consumidor.asf.com.pt/documents/d/site- asf/paoverview_2025?download=true
5. Início - Site ASF Institucional - ASF, accessed on February 27, 2026, https://www.asf.com.pt/en/
6. APIs and Your Ecosystem: Creating Value in P&C Insurance - Duck Creek Technologies, accessed on February 27, 2026, https://www.duckcreek.com/blog/apis-ecosystems-pc-insurance- revolution/
7. The Rules Every Lender Needs to Make Affiliate Leads Convert—While Protecting IP - Decisions, accessed on February 27, 2026, https://decisions.com/the-rules-every-lender-needs-to-make- affiliate-leads-convert-while-protecting-ip/
8. Insurtech Development Services | Devox Software, accessed on February 27, 2026, https://devoxsoftware.com/industries/insurtech- development-services/
9. Navigating the Competitive Landscape: Brokers in the Embedded Finance Market - Pulse, accessed on February 27, 2026, https://mypulse.io/blog/competitive-landscape-brokers-embedded- finance-market
10. Model Inversion and Extraction Attacks - Rogue Codex - Obsidian ..., accessed on February 27, 2026, https://publish.obsidian.md/rogue- codex/AI+Risk/Model+Inversion+and+Extraction+Attacks
11. How Economic Experts Analyze Algorithmic Pricing in Antitrust Cases - Econ One, accessed on February 27, 2026, https://econone.com/resources/blogs/how-economic-experts-analyze- algorithmic-pricing-in-antitrust-cases/
12. What's RPA in Insurance Claims Processing? Here's Everything You Need to Know - Infrrd, accessed on February 27, 2026, https://www.infrrd.ai/blog/rpa-in-insurance-claims-processing
13. How to Manage the Infrastructure Impact of More AI Bot Traffic - Botify, accessed on February 27, 2026, https://www.botify.com/blog/infrastructure-impact-ai-bot-traffic
14. Price comparison websites failing to meet FCA expectations | FCA, accessed on July 16, 2024, https://www.fca.org.uk/news/press- releases/price-comparison-websites-failing-meet-fca- expectations#:~:text=For%20example%2C%20some%20consumers%20mistake nly,of%20the%20policy%20for%20them
15. Navigating Bot Threats in Financial Services and Insurance Organizations - Radware, accessed on February 27, 2026, https://www.radware.com/blog/application-protection/navigating- bot-threats-in-financial-services-and-insurance-organizations/
16. Target Cyber Attack: A Columbia University Case Study, accessed on February 27, 2026, https://www.sipa.columbia.edu/sites/default/files/2022- 11/Target%20Final.pdf
17. Series of Major Data Breaches Targeting the Insurance Industry | Crowell & Moring LLP, accessed on February 27, 2026, https://www.crowell.com/en/insights/client-alerts/series-of-major- data-breaches-targeting-the-insurance-industry
18. Insurance Claims & Prior Authorizations Streamlined with AI & RPA - RevCycle, accessed on February 27, 2026, https://www.revcycle.com/2025/03/27/insurance-claims-prior- authorizations-streamlined-with-ai-rpa/
19. AI Agent Spoofing: The Growing Threat to Website Security, accessed on February 27, 2026, https://www.siteguarding.com/security-blog/ai- agent-spoofing-the-growing-threat-to-website-security/
20. Price comparison website: Consumer market research | FCA, accessed on February 27, 2026, https://www.fca.org.uk/publication/research/price- comparison-website-consumer-research.pdf
21. TR14/11 - Price comparison websites in the general insurance sector | FCA, accessed on February 27, 2026, https://www.fca.org.uk/publications/thematic-reviews/tr14-11-price- comparison-websites-general-insurance-sector
22. Thematic Review: Price comparison websites in the general ..., accessed on February 27, 2026, https://www.fca.org.uk/publication/thematic- reviews/tr14-11.pdf
23. Europe's Big Bang on Pricing - Earnix, accessed on February 27, 2026, https://earnix.com/assets/europe's-big-bang-on-pricing.pdf
24. General insurance pricing practices, accessed on February 27, 2026, https://assets.ctfassets.net/mfz4nbgura3g/37JhRnytig5Ybc1UAqJqEf/4 c785e5befb1d2e3981c199fc8201e34/General_20insurance_20pricing_2 0practices_20- _20Citizens_20Advices_20response_20to_20the_20FCA_s_20iterim_ 20report.pdf
25. Automated Insurance Claims: How AI Is Transforming Claims Processing - Druid AI, accessed on February 27, 2026, https://www.druidai.com/blog/automated-insurance-claims
26. Insurance Claims Bot by Tovie AI, accessed on February 27, 2026, https://tovie.ai/insurance-claims-bot
27. AI-Driven RPA: The Trojan Horse Unblocking EHR Integration, accessed on February 27, 2026, https://topflightapps.com/ideas/ai-driven-rpa/
28. Jmix for Insurance Automation, accessed on February 27, 2026, https://www.jmix.io/jmix-for-insurance/
29. Thinking ahead: Top five RPA use cases in insurance - Infosys BPM, accessed on February 27, 2026, https://www.infosysbpm.com/blogs/robotic-process-automation/rpa- use-cases-in-insurance.html
30. Automation in Insurance: Case Studies & Insights - Convin, accessed on February 27, 2026, https://convin.ai/blog/automation-in-insurance- case-studies
31. EIOPA presents its value for money benchmark methodology for unit- linked and hybrid insurance products, accessed on February 27, 2026, https://www.eiopa.europa.eu/eiopa-presents-its-value-money- benchmark-methodology-unit-linked-and-hybrid-insurance-products- 2024-10-07_en
32. balanço da implementação abril 2025 - ASF, accessed on February 27, 2026, https://www.asf.com.pt/documents/d/site-asf/pe-2025_asf
33. Artificial intelligence and the insurance industry - State Bar of Michigan, accessed on February 27, 2026, https://www.michbar.org/journal/Details/Artificial-intelligence-and- the-insurance-industry?ArticleID=4986
34. Your Data, Your Control - Competition Bureau Canada, accessed on February 27, 2026, https://competition-bureau.canada.ca/en/how-we- foster-competition/education-and-outreach/publications/your-data- your-control
35. Steps for Secure Software Development and AI Integration - - Codewave, accessed on February 27, 2026, https://codewave.com/insights/secure- software-development-ai-integration/
www.frankinsurance.ai