Most agency owners I talk to feel like they are in pretty good shape when it comes to IT and cybersecurity.
They have Microsoft 365. They have antivirus. They may have backups. They may have an IT vendor or someone they call when things break.
But from what I have seen after more than three decades of working in and around the insurance agency world, most agencies are more exposed than they realize.
I do not say that to scare anyone. I say it because I see it literally every day.
Insurance agencies are trusted advisors for their clients. Because of that, they hold a large amount of sensitive client data: personal information, policy documents, financial details, claims information, carrier communications, email conversations, and more.
That makes agencies a valuable target.
At the same time, carrier requirements are getting tighter, cyber insurance applications are asking more detailed questions, and compliance expectations are starting to catch up with the reality of today’s threats.
Here are five of the biggest cybersecurity risks I am seeing right now across insurance agencies.
1. Shadow AI Is Already Happening Inside Agencies
Almost every agency owner I talk to says some version of this:
“We are not really using AI yet.”
But when we talk to the staff, the answer is usually different.
Employees are using AI to rewrite client emails, explain coverage, summarize documents, clean up proposals, or make their work sound more professional. Some may even be pasting client information, policy details, or internal documents into AI tools that were never approved by the agency.
The issue is not AI itself. AI can be incredibly helpful for agencies when it is used correctly.
The issue is casual AI use with no policy, no training, no visibility, and no guardrails.
That creates real risk. Sensitive client data may be going into systems the agency does not control. Employees may be using different tools in different ways. Ownership may not even know it is happening.
From what I am seeing, AI is not a future risk. It is already inside most agencies whether ownership has officially approved it or not.
2. Microsoft 365 Is Often Not Locked Down Properly
Almost every agency today runs on Microsoft 365 in one way or another.
But having Microsoft 365 and having Microsoft 365 properly secured are two very different things.
When we review agency environments, we often find default settings still in place, security features not fully configured, limited visibility into login activity, weak identity protection, and inconsistent multi-factor authentication.
That matters because attackers have changed the way they go after agencies.
They do not always need to “hack the network” anymore. In many cases, they just need to get someone’s password and log in.
Once they compromise one email account, they may have access to client communications, attachments, files, contacts, carrier conversations, and internal agency information.
For most agencies, Microsoft 365 has become the front door to the business. If that front door is not secured properly, it becomes one of the biggest weaknesses in the agency.
3. Basic Security Is No Longer Enough
A lot of agencies still have what I would call basic protection.
They may have antivirus. They may have a firewall. They may have email filtering. They may have backups.
Those things are important, but they are not a complete cybersecurity strategy anymore.
Today, agencies need layered protection. That means protecting email, users, devices, cloud applications, credentials, backups, and remote access. It also means having monitoring, training, reporting, and response procedures in place.
What I often see is not that agencies are doing nothing. It is that they have pieces of security in place, but those pieces are not connected into a complete plan.
That is where the gaps happen.
And cybersecurity usually fails in the gaps.
4. Backups Are Not Always as Reliable as Owners Think
Almost every agency owner will tell me, “We have backups.”
That is good, but it is only the first question.
The real questions are:
- Have they been tested?
- How fast can you restore?
- Is Microsoft 365 backed up?
- Are your critical files, agency systems, and cloud data covered?
- If ransomware hit tomorrow, how long would your agency be down?
- How simple would it be to get everyone working again?
That is your Recovery Time Objective, or RTO. In plain English: how fast can you get your agency back up and running?
There is also Recovery Point Objective, or RPO. That means how much data you can afford to lose. If your last good backup was from yesterday, can your agency live with losing today’s work? If not, your backup strategy needs to match that reality.
Backups are not really about whether something is being copied somewhere. Backups are about whether you can actually get your agency restored, how fast you can do it, and how painful or simple that process will be.
That is why for our agencies, we manually test backup restores every week.
I cannot tell you how many new customers we have gotten over the years because they had a problem, went to restore their backup, and found out it could not actually be restored. At that point, they were in trouble. And they did not call the IT person who never checked the backups. They called us.
A backup that has never been tested is not a recovery plan.
It is a hope.
5. Compliance Is Moving Faster Than Many Agencies Realize
A few years ago, compliance did not come up nearly as often in cybersecurity conversations with agencies.
Now it comes up all the time.
Carriers are asking more questions. Cyber insurance applications are getting more specific. States are paying more attention to data protection. AI is creating new concerns around how client information is being handled.
Many agencies still assume they are probably fine because they have an IT provider or a few security tools in place.
But compliance is not just about having tools. It is about being able to show that security controls are in place, that employees are trained, that data is protected, and that the agency has taken reasonable steps to reduce risk.
This is becoming more than an IT issue. It is becoming an ownership issue.
It affects coverage, liability, carrier relationships, reputation, and client trust.
What This Really Comes Down To
Most agency owners are not ignoring cybersecurity. They are busy running their agencies.
They are dealing with renewals, producers, clients, carriers, staffing, service issues, and all the moving parts that come with running an insurance business.
The problem is that many agencies think they are further along than they really are.
- They have IT support, but not a full security strategy.
- They have Microsoft 365, but it is not fully secured.
- They have backups, but they have not tested recovery.
- They have employees using AI, but no policy around it.
- They have cyber insurance, but may not meet every expectation on the application.
That is where the exposure lives.
And after working with insurance agencies for as long as I have, I can tell you this: agencies do not need more complexity. They need a practical, layered, agency-focused approach to security that actually fits the way they work.
How Security+ Helps Put a Stronger Layer Around the Agency
That is why we built Security+.
Security+ is designed specifically to help agencies move beyond the basic level of protection that many are operating with today. It adds a stronger security layer around the agency, the users, the email, the data, and the day-to-day workflows that attackers are targeting.
Security+ includes multi-factor authentication, dark web monitoring, phishing simulations, employee security training, email encryption, email archiving, intelligent threat detection, vulnerability assessments, certified data destruction, and ongoing security awareness.
The goal is not to make cybersecurity overwhelming.
The goal is to help agencies put the right protections in place, reduce risk, better protect client data, and be more prepared for the security and compliance expectations that are already here.
Cybersecurity is no longer something agencies can treat as “good enough.”
The agencies that take action now will be in a much better position than the ones that wait until a breach, a carrier requirement, a failed cyber insurance application, or a compliance issue forces the conversation.
Security+ helps put that next layer of protection around the agency so owners can focus on what they do best: serving clients and growing the business.
About the author
Jerry Fetty is the Founder of SMART Services and has spent 35+ years helping independent insurance agencies modernize their technology, strengthen cybersecurity, and operate more efficiently. Today, his focus is helping agencies adopt AI the right way, with a secure foundation, clean data structure, clear policies, and real-world training that produces measurable ROI.