October 2026 | Insurance Firm IT Services Utah | Security Culture | Employee Awareness
It's 4:17 on a Friday afternoon at a Salt Lake City insurance agency.
A CSR receives an email that appears to be from the agency owner: "Can you update the routing information for premium payments before you leave? Carrier needs it Monday morning."
The name is right. The tone sounds familiar. It's renewal season, everyone is trying to wrap up the week, and the easiest thing to do is simply handle it. There's only one problem: the owner never sent it.
Your IT security tools can put strong protections in place, but they can't stop every bad click, rushed reply or split-second call. Some decisions still come down to whether the person at the keyboard knows what to do when something feels off. You sell risk management for a living — and you'd be the first to tell a client that an unmanaged risk is an uninsured risk. The same applies inside your own agency.
The Assumption That Leaves Agencies Exposed
Most agency principals believe cybersecurity lives somewhere behind the scenes. The IT provider has tools. The computers have protection. Someone schedules the updates. Cybersecurity is "handled."
In reality, your defenses are tested every time an agent or CSR decides whether to trust an email, link or request — a carrier portal password reset, a DocuSign envelope, a policyholder asking to change their payment method by email. Those decisions happen every day, across every desk. To truly strengthen your agency's IT security, your agents and staff must know what to do when something doesn't look right.
Technology Can't Make Every Call
Good security tools block a lot of attack attempts before your staff ever sees them. But no technology can eliminate every questionable request or make every decision on an employee's behalf.
Today's phishing attacks aren't obvious. They're built to mimic familiar writing styles, reference carriers your agency actually represents and mirror the rhythm of normal agency workflows. When an unusual payment request comes from the owner, a carrier "legitimately" changes commission deposit details, or a producer needs access to a policyholder file they've never opened before — someone must decide what happens next. The CSR at the keyboard has to determine in an instant whether they're looking at a scam or an authentic request.
"Be Careful" Isn't a Cybersecurity Plan
Most agencies tell their agents and staff to watch out for suspicious emails. But what should they do when they find one? Every person in your agency should know:
- Who to contact
- How to verify a request is legitimate — including call-back verification for any payment or banking change
- Not to click links or download attachments from suspicious messages, even ones dressed as carrier communications
- What to do if they already clicked a link or entered carrier portal credentials
- How to report the issue
Telling everyone to simply "be careful" without a clear next step puts the full weight of a high-stakes decision on the person least equipped to handle it in the moment.
Assuming your staff knows what to do is a liability — the kind you'd flag instantly on a client's risk assessment. A CSR who isn't sure whether they're bothering someone may stay quiet. Someone who fears getting blamed for clicking the wrong thing may wait before reporting it. Hesitation is costly: the time lost while someone decides whether to speak up can turn a manageable incident into a reportable breach of policyholder data.
Leadership Sets the Tone
Responsibility starts at the top, because your agents and staff take their cues from leadership. If the owner routinely skips verification steps because a carrier deadline is looming, staff learn that speed matters more than process. If managers make it uncomfortable to flag suspicious activity, people stay quiet. If someone clicks something they shouldn't and gets publicly reprimanded, everyone learns to hide their mistakes.
Fortunately, the opposite is also true. When leadership normalizes verification, staff take it seriously. When a CSR who questions an unusual request is backed up rather than brushed off, the whole agency operates more carefully. When your team trusts leadership, they speak up before a situation becomes a crisis — or a call to your E&O carrier.
Cybersecurity Works Better When Everyone Knows Their Role
Back to that CSR at 4:17 on a Friday afternoon.
The goal isn't to make your team paranoid about every email they receive. It's to make sure that when something feels off, they know exactly what to do, who to ask and how to verify. Speaking up should always feel like the right move.
Your agents and staff don't need to become cybersecurity experts to help protect the agency. They need clear expectations, good habits and the confidence to flag when something doesn't look right — the same way you coach clients to report a loss early instead of hoping it goes away.
Creating that kind of security culture takes more than an annual training session. It requires the right safeguards, practical processes and ongoing guidance to keep your agency prepared as threats change — and as state data security expectations evolve.
Frequently Asked Questions
Do you offer IT support and cybersecurity for insurance agencies in Salt Lake City?
Yes. Qual IT delivers insurance agency cybersecurity in Salt Lake City and across the Wasatch Front, including email security, phishing protection, employee security awareness training, secure configuration of agency systems like Applied Epic, AMS360 and EZLynx, and incident response planning.
What is employee security awareness training for an insurance agency?
It's structured, ongoing education that teaches your agents and staff to recognize phishing, social engineering and payment fraud attempts — including fake carrier notices and spoofed owner requests — and gives them a clear process for verifying and reporting suspicious activity. Done well, it turns your team into an active layer of defense.
Does training help with state insurance data security requirements?
Yes. The NAIC Insurance Data Security Model Law framework adopted by Utah and most states expects licensees to maintain a written information security program that includes staff training and a documented incident response plan. A structured awareness program is a core part of demonstrating that your agency takes its obligations seriously.
You Don't Have to Manage It Alone
That's where the right IT partner comes in. Qual IT helps agencies take the guesswork out of cybersecurity by identifying gaps, strengthening protections and helping every agent and CSR understand the role they play in keeping policyholder data secure.
Cybersecurity is everyone's responsibility — but you don't have to manage it alone. We work with Salt Lake City insurance agencies to protect policyholder data and keep agency systems running. Schedule a 10-minute discovery call with Qual IT to find the gaps in your current approach and how to address them.
Book your discovery call here: https://www.qualit.com/discoverycall/
