Because criminals care about you. A lot. Your client database contains names, addresses, National Insurance numbers, bank details, and policy information. To a hacker, that's worth more than your annual turnover. In 2023, the Financial Conduct Authority reported that financial services firms faced an average of 2,847 cyber incidents per organisation. Insurance brokers weren't singled out, but they weren't spared either.
You probably already know this. What you might not know is that most breaches don't happen because of some Hollywood-style hack through your firewall. They happen because someone clicked a link in an email that looked like it came from your bank. Or because a staff member left a laptop open in a cafe. Or because your team used 'password123' for the shared client portal.
The good news is that most of this is preventable.
Your Biggest Vulnerability: Your People
Here's a scenario that plays out regularly in small brokerages. A client calls asking you to update their payment details. You verify their identity, take their new credit card information over the phone, and email it to your back office. Someone opens that email on their personal phone at lunch. Their phone is connected to the cafe wifi. The email sits in their inbox, then their deleted items, unencrypted.
Any of those steps could be your weak point.
Your team members aren't the problem. They're just human. According to research from the Security Awareness Training provider KnowBe4, 85% of breaches involve human error. The solution isn't to blame them. It's to set them up to succeed.
Start with training that actually sticks. Not a mandatory video no one remembers. Real, scenario-based training that shows your staff what a phishing email looks like, how to spot a dodgy link, and what to do when they're unsure. Run mock phishing campaigns quarterly. Make it low-stakes and educational, not punitive. When someone falls for a fake phishing email, they get a quick training reminder, not a disciplinary note.
Second, enforce password discipline. Not because you're obsessed with security theatre, but because weak passwords genuinely cost businesses money. Your client portal shouldn't accept 'Avengers2024' as a password. It should require at least 12 characters, a mix of upper and lower case, numbers, and symbols. Better still, use a password manager like Dashlane or 1Password across your organisation. It costs around £3 per person per month and eliminates the problem of people using the same password everywhere or writing them on Post-it notes.
Encryption: It's Not Optional
Client data in transit needs to be encrypted. That means if someone intercepts an email between your office and a client, they see gibberish, not policy details and payment information.
Most email providers offer encryption tools. Microsoft 365 (which many small brokerages use) includes built-in encryption. Gmail does too. Use them. Particularly for anything containing financial information, NI numbers, or personal details.
Your client portal should run on HTTPS, not HTTP. Check the URL in your browser. See the padlock icon? That's HTTPS. No padlock, no transmission. Many older brokerage management systems weren't built with this in mind. If yours doesn't support HTTPS, it's time to look elsewhere. This isn't a nice-to-have. The ICO takes dim view of organisations transmitting sensitive data over unencrypted connections.
Multi-Factor Authentication Stops Most Attacks
If a criminal has your staff member's password, they can log in to your systems and download everything. Multi-factor authentication (MFA) stops that. When someone logs in from an unfamiliar location or device, they get a second verification. Usually a code sent to their phone or generated by an authenticator app.
MFA is built into most software now. Microsoft 365, Salesforce, QuickBooks. Turn it on. Yes, it adds 20 seconds to the login process. Yes, it's annoying when someone forgets their phone. It's also the difference between a login attempt and a breach.
For your client portal, MFA should be non-negotiable. Clients can use their smartphone to generate codes through Google Authenticator or Microsoft Authenticator. It's free for them and makes their account significantly harder to compromise.
Backups: Your Insurance Against Ransomware
Ransomware locks you out of your own systems until you pay. It's become the weapon of choice for cybercriminals targeting professional services. A recent survey by Sophos found that 66% of organisations were hit by ransomware in 2022. Insurance brokerages were represented in that number.
The only reliable protection is automated backups that aren't connected to your main network. If everything is backed up and you can restore from a clean copy, the ransom demand becomes worthless.
Use cloud backup services like Veeam, Acronis, or Backblaze. They automatically copy your data off-site, encrypted, every few hours. Cost varies, but you're looking at £50 to £200 per month depending on how much data you need to protect. When you're holding client data worth potentially millions, that's a bargain.
Test your backups monthly. Don't just assume they work. Restore a sample of files. Run a drill where you pretend your main system has been encrypted and you're recovering from backup. You'll find problems before they cost you money.
The Basics That Most Brokerages Skip
Keep your software updated. Your operating system, your brokerage management system, your antivirus software. Updates often patch security vulnerabilities. Yes, they sometimes break things. That's why you test them first on non-critical machines, not by forcing them on your entire operation at once.
Use antivirus software. Sophos, Norton, Kaspersky, Windows Defender. All of them work. Pick one that integrates with your systems and keep it running. Don't disable it because it's slowing things down. That's like removing the seatbelt in your car because it's uncomfortable.
Lock your physical office. It sounds stupid, but a USB drive left on a desk or a laptop taken from an unlocked room causes real damage. Security isn't just digital.
Where to Start
If you're reading this and thinking your brokerage does none of these things, don't panic. You don't need to overhaul everything next week. Start with three changes this month.
One: turn on MFA for everything important. Two: run security training for your team. Three: set up automated backups.
Do those three things and you've already prevented the majority of common attacks. Everything else is layering on protection as your budget and circumstances allow.
Your clients trust you with sensitive information. Taking basic cybersecurity seriously isn't about impressing anyone. It's about keeping that trust intact.
Trending articles
