Commercial insurance still operates largely around an annual renewal cycle. A policy is reviewed, information is updated, terms are negotiated and the risk is effectively reset for another twelve months. The business itself does not operate that way.

The growth of the underwriting agency market has been one of the more positive developments in Australian insurance over the past decade. Brokers have more choice, experienced underwriters have greater opportunity to build businesses around the markets they understand, and capacity providers can access specialist distribution and expertise without recreating it internally.

There's a natural pull in growing businesses to keep adding. Another product, another distribution deal, another system upgrade, another hire. On their own, most of these ideas make sense - especially in specialist underwriting, where success tends to breed more opportunity.

**Batch Underwriting has appointed Healix as its new global emergency assistance partner, effective 1 July 2026, in a move designed to strengthen support for policyholders when they need it most.

There is a common misconception that underwriting is primarily about identifying bad risks. In reality, most bad risks are relatively easy to spot. They are the submissions with obvious issues. The poor claims history. The distressed financials. The business operating well outside its area of expertise. The risks that immediately raise questions.

For most of my career, one of the defining questions in insurance has been relatively straightforward: where is the capacity? Entire strategies have been built around answering that question. Markets have expanded and contracted depending on it. Businesses have grown, adapted and occasionally struggled based on their ability to access and maintain capacity. While that remains an important part of our industry, I find myself increasingly thinking that capacity is no longer the biggest challenge facing insurance businesses today, clarity is.

The formula for building a successful underwriting business has been fairly consistent for a long time. Specialist expertise, strong broker relationships, capacity, clear appetite, market discipline. Nobody’s arguing with that, it still holds. What’s changed is everything around it.

For the last few years, underwriting commentary has been dominated by market cycles. Capacity, pricing, hardening or softening. Those conversations have shaped most of what gets written and said across the industry. Understandably so. But those dynamics are becoming less predictive of underwriting performance than they once were.

There’s been a noticeable shift in parts of the Property and Liability market over recent months. Capacity is opening up in some areas, competition is returning and brokers are starting to see more pricing movement than they have for a while. After a fairly challenging period, that should be good news.

There is a quiet shift happening across the underwriting market.

Introduction Over the last decade, Multi-Factor Authentication (“MFA”) has increasingly been held up as one of the most effective controls against cyber-crime. During the ‘hard’ cyber insurance market in Australia in 2020 and 2021, insurers started to focus more closely on cyber security controls because of rising claims and insureds were required to confirm that MFA was implemented on key systems such as remote access and VPN’s. Insurers now expect MFA, as part of baseline eligibility requirements and this is reflected in modern cyber proposal and application forms. Insurers pushed hard for this MFA adoption and with good reason. MFA dramatically reduces losses from basic credential theft and has become a cornerstone requirement of cyber insurance underwriting. Today, however, the threat landscape is shifting. Attackers are no longer simply stealing passwords; they are actively targeting MFA itself. The rise of MFA Phishing techniques is forcing cyber insurers to rethink assumptions about risk, controls and loss prevention. The Rise of MFA Phishing Attackers are adapting quickly. Threat actors are now working around MFA, using techniques such as: • Man-in-the-middle phishing pages that capture credentials and MFA tokens in real time; • Session and authentication token theft, allowing attackers to bypass MFA entirely once a user is logged in. Crucially, many of these attacks succeed even when MFA is technically enabled. What This Means for Cyber Insurers For insurers, MFA Phishing may result in a steady increase in claims driven by Business E-Mail Compromise (“BEC”) and Cloud account takeovers. The implications for cyber insurers may be significant: Additional Underwriting CriteriaInsurers may be required to assess in greater detail how MFA is implemented and how resistant it is to phishing. They may be forced from asking “Do you have MFA?” to questions around Conditional Access, E-Mail protections and phishing-related MFA. In the SME market, which currently places a great emphasis on trying to create a frictionless sales process, such additional underwriting questions will create challenges for insureds and SME-specialist brokers. Vulnerability ScansMany insurers use external attack-surface scanning to automatically scan a business’s external facing assets. Such tools do have a limited use, but these vulnerability scans cannot directly detect MFA phishing tools or techniques. MFA Phishing does not exploit a software vulnerability within the insured’s environment; instead, it relies on external phishing infrastructure and social engineering to intercept user credentials and authentication tokens in real time. As a result, a clean vulnerability scan does not necessarily indicate a reduced risk of MFA-related compromise, BEC or Cloud account takeover. Artificial Intelligence (“AI”)Right now, MFA Phishing tends to be targeted because it’s more complex to set up (reverse proxies), riskier for attackers (short-lived infrastructure) and most profitable when aimed at high-value users (finance or execs), so attackers are picking their targets. However, AI will massively reduce the cost of operating MFA Phishing at scale. AI can already mimic internal tone, formatting and workflows, and personalise lures at scale. That means MFA Phishing does not need to be “handcrafted” per target. Phishing-as-a-Service platforms already exist, but AI will be able to add auto-generated look-alike domains, AI-written login pages that clone real portals and rapid redeployment to evade detection. This will turn MFA Phishing into a volume business, not a bespoke attack. MFA Phishing volume businesses will be able to deploy thousands of highly plausible messages across multiple organisations at once, but each message will still feel targeted to the recipient. Looking AheadMFA remains a critical control but it is no longer the Silver Bullet it once was. For cyber insurers, the rise of MFA Phishing marks a turning point: how do they move from broad, control-based underwriting to a more nuanced assessment of identity resilience. The evolution will also present challenges for brokers, many of whom are still adjusting to understanding basic MFA deployment. Insurers will need to take a proactive role in educating brokers and insureds on the very real risks of MFA Phishing and the value of layered identity defences. Ongoing and upskilling will be critical for all to keep pace.

Extreme weather is no longer an occasional disruption for construction projects. It is increasingly part of the operating environment. Flood, storm and cyclone events are occurring more frequently and with greater severity, and the impact on construction risk is becoming clearer with each major loss event. For brokers placing construction risks, the implications are significant. Extreme weather is reshaping underwriting expectations, programme structure and claims outcomes across the market.****

Natalie, a 38-year-old infrastructure consultant from Sydney, was on assignment in the Middle East, conducting site inspections for a major development project. During her stay, political tensions escalated quickly, leading to violent protests, widespread disruption, and an increasingly unstable security environment.

****An Australian contractor working on a short project in Israel was preparing to return home when regional tensions escalated and commercial flights across the region were suddenly suspended.