A managed SOC and EDR rollout for a 1,200‑endpoint insurer: from alert noise to a clock it can meet

A regional property and casualty insurer had antivirus on most machines, a small IT team and thousands of unreviewed alerts every week. State insurance data security law, most of it based on the NAIC Insurance Data Security Model Law, expected a written information security program, a risk assessment and an incident response plan, and asked for notice to the insurance commissioner within 72 hours of determining that a cybersecurity event occurred. The board wanted to know how quickly the company would know about an attack, and nobody could say.

We began with a gap assessment against the insurer's own program and the statute that applies to it, and then rolled out endpoint detection and response (EDR) to about 1,200 endpoints and 150 servers in rings. A pilot group ran in monitor mode while we tuned exclusions for claims software and scanners, then each department moved to blocking mode on a schedule that avoided month-end. Servers followed laptops. At the end, every managed machine reported to one console, and an unmanaged machine could not reach the claims systems.

A managed security operations center now watches the environment around the clock. Logs from identity, email, firewalls and the EDR flow into one platform. The funnel merges duplicates, suppresses known-good behavior, such as a scanner that always runs at night, and escalates a short list of cases to named people with a timeline and a recommended action. Detections target the things that hurt insurers: stolen credentials used from a new country, forwarding rules created in a mailbox, unusual administrative activity and lateral movement toward the claims database.

Patching moved from a monthly habit to a clock. Vulnerabilities in CISA's Known Exploited Vulnerabilities catalog get a short deadline, in the spirit of Binding Operational Directive 22-01, and the team reports days to patch each week. Email moved to SPF, DKIM and DMARC enforcement, administrators and claims staff signed in with phishing-resistant methods, and a vendor register recorded which third parties hold policyholder data, which the model law's oversight section asks a licensee to manage.

The incident response plan turned the 72 hours into a decision tree: who determines that an event occurred, who calls counsel, who notifies the commissioner and which facts to gather first. We ran two tabletop exercises, one with the board, using a ransomware scenario built from the insurer's own systems. The insurer files its own certifications, and our job was to supply the controls and evidence behind them. Counts and times in this illustrative case are modeled for an engagement of this kind. See our guidance on cyber insurance readiness and ransomware response.