Case Study · Insurance Broking
Bringing IT risk under control for a growing insurance brokerage
When we first started talking with the owners of this Christchurch insurance brokerage, the conversation centred on risk and the different ways a business can deal with it.
Some risks are accepted. Others can be reduced through controls, or transferred through insurance and contractual arrangements. Looking at their IT through the same lens raised a useful question: which technology risks had the business deliberately chosen to carry, and which ones had accumulated simply because nobody had reviewed the environment as a whole?
At the time, the brokerage was around three years old with a team of five. Its technology had developed alongside the business, with some things handled internally and outside help brought in when specialist support was needed. That approach had kept the business moving, but there was nobody looking across Microsoft 365, devices, backup, account access, email security and governance as one environment, or turning what they found into a longer-term plan.
The team was already relying heavily on Microsoft 365, alongside its CRM, phone system and a number of automation services managed internally. As more systems, users and suppliers had been added, the technology environment had become more complex without the same structure developing around how it was managed.
Reviewing how your brokerage manages IT risk?
If you are looking at your current arrangements, tell us what has prompted the review and we can talk through where things stand.
Prefer to choose a time? Book a 15-minute IT Fit Check
Getting the foundations in place
Our initial review found gaps across backup, account and device security, email protection and governance, along with the absence of a technology roadmap.
We have deliberately kept the technical detail of those findings out of this case study. Publishing a list of a client's historical security weaknesses would add very little for a prospective client and could create unnecessary exposure for the brokerage.
We dealt with the highest-risk areas first. Backup protection was put in place, security around Microsoft 365 accounts was strengthened, the computers staff relied on were brought under managed endpoint protection, and additional email security was introduced.
This work formed part of ITstuffed's Security and Productivity Kick Start, which is how we begin managed-services relationships when the existing environment needs work before ongoing management starts.
The Kick Start gives us a defined point at which to bring the environment up to a comfortable baseline, covering the fundamentals around security, backup, devices, Microsoft 365 and configuration before moving into day-to-day management. Any remaining improvements can then be documented, prioritised and planned rather than dealt with as isolated jobs whenever somebody happens to notice them.
Once that work was completed, the brokerage moved onto ITstuffed's Advanced managed IT service.
From there, the relationship became less about bringing the environment up to standard and more about keeping it there, supporting the team and planning for what came next.
When something needs sorting, they call us
The brokerage now uses several systems from different providers, and the source of an IT problem is not always obvious from the user's side.
Microsoft 365 sits alongside the CRM and phone system, while the business also operates automation services internally. An issue can start in one system and depend on another, or require input from a supplier the owners would otherwise have to coordinate themselves.
The day-to-day relationship is fairly simple now. If something needs sorting, they call us.
We work out whether the problem sits within the environment we manage, belongs with another provider or crosses several systems, then handle the technical side from there.
The brokerage continues to manage the automation and business processes that sit within its own expertise. ITstuffed manages the IT environment around them and gets involved when those processes depend on accounts, devices, Microsoft 365, connectivity or other services under our management.
The owners can stay involved in decisions about the business without needing to diagnose the technical problem first or work out which supplier should receive the initial call.
Email security is something we deal with regularly
This brokerage receives a comparatively high level of suspicious email activity and produces some of the strongest phishing signals among the environments we manage.
That activity continues well beyond the initial onboarding work.
Suspicious messages are regularly identified and removed, while the surrounding Microsoft 365 environment and account activity remain under management alongside the controls introduced through the Kick Start.
Despite the level of phishing activity we see against the brokerage, there has been no detected breach to date.
Staff still have an important part to play in recognising unusual requests and reporting anything that does not look right, but they are no longer the only layer standing between a convincing phishing message and the business.
Building some structure around future decisions
The original review also highlighted the lack of a technology roadmap.
Technology decisions had been made as they came up, which is workable in the early stages of a business but becomes harder to sustain as more systems, staff and suppliers are added.
We now review what is coming up across the environment so that device replacements, licensing changes, security work and larger projects can be discussed with the owners and budgeted for ahead of time.
That also gives us context when something new is being considered.
A new system may depend on Microsoft 365 identities. An automation may require access to existing services. A staffing change may affect devices, licences, permissions and several applications at once. Looking across the environment makes it easier to see those dependencies before a change is made.
The owners remain involved in priorities, investment and technology decisions that affect the direction of the brokerage. Routine support, security maintenance, backup oversight, account administration and the technical coordination around other suppliers sit with ITstuffed.
Where the brokerage is now
The relationship began with a conversation about risk and a closer look at how the brokerage's technology was being managed.
That review identified areas where the business needed stronger controls and more structure. The Security and Productivity Kick Start brought the environment up to the baseline we wanted before ongoing management began, and the move onto the Advanced plan gave the brokerage someone responsible for maintaining that environment afterwards.
The practical outcome is fairly straightforward.
When the owners need something sorted, they call us. When technology changes are coming up, there is somebody looking at how they fit with the rest of the environment. When suspicious activity appears, there are controls and people in place to respond to it.
The owners can concentrate on running and growing the brokerage while retaining oversight of the technology decisions that require their input.
If your brokerage has reached a similar stage
Tell us what has prompted the review and we can talk through where things stand. You do not need to diagnose the problem or prepare a technical summary before getting in touch.
Start the conversation
Prefer to choose a time? Book a 15-minute IT Fit Check
You can also read more about IT support for professional services, which is where our work with insurance brokers now sits.