Story · Security · Device management
Every laptop managed, every login checked, without anyone noticing
The agency had thirty laptops, half of them at kitchen tables, and no way to know whether any of them were patched, encrypted or still in the right hands. The cyber insurance renewal asked. Nobody could answer.
Three companies, three accounting systems, nineteen years of records. The plan that worked was the one written for the client, not for a vendor.
The three-company merger Gold Star survey"Tyler's response time was quick and he solved the problem easily."
Stephanie, Visit Lake GenevaMeet TylerThe situation
Every laptop had been set up by whoever was free that day. Some had disk encryption, some did not. Multi-factor authentication existed on email but not on the remote desktop gateway, which was the door an attacker would actually use.
The owner's worry was practical: a producer's laptop left in a car, or a password phished on a Friday afternoon, and the agency's whole book exposed.
What we did
Matt enrolled every device in Intune in stages, one department at a time, so nobody lost a morning. Compliance baselines went on: encryption required, patches within a window, screen lock, no jailbroken phones reaching email.
Then conditional access: a login is allowed only from a managed, compliant device, with multi-factor authentication, from a plausible location. A phished password on its own no longer opens anything. A lost laptop is wiped remotely and the replacement is enrolled before the producer's next appointment.
"The goal is that nobody notices. The producers log in the same way they always did. The attacker is the only one who has a worse day."
How the engineer on this one puts itWhat changed
ResolvedThe insurance questionnaire answers are all yes, with evidence. Two laptops have since been lost and neither was a breach. The owner can see every device's status on one screen.
The guide behind this story
GuideAnswering the cyber insurance questionnaire honestly
What the questions actually mean, which controls insurers now require, and how to turn a no into a yes before renewal.
Read the guideOrder the internet circuit the week the lease is signed. Carriers take six to twelve weeks. Nothing else on a move fails as often.
The relocation checklist Did you knowA backup that has never been restored is a hope, not a plan. Ask for the date of the last tested restore.
What to actually testQuestions people ask about this
What is conditional access, in plain terms?
Rules that decide whether a login is allowed based on more than the password: which device, is it managed and healthy, where from, was multi-factor completed. It turns a stolen password into a dead end.
The full answerWill this slow my staff down?
Set up properly, no. They log in from their own managed device with the multi-factor prompt they already use. The friction lands on people who are not your staff.
"Thanks for the hard work. I was kept informed with regular updates until the concern was resolved."
Jeff, insurance brokerageMore from the survey wall- A technician who knows your setup takes every request. Not a dispatcher, not a queue.
- Every closed ticket is surveyed and a partner reads every response.
- 99.5% of surveys come back positive.
- Family-owned since 2005. 21 years in the same corner of Wisconsin, not going anywhere.
"Thanks for the hard work. I was kept informed with regular updates until the concern was resolved."
Jeff, insurance brokerageCan you say where every laptop is right now?
If not, that is a two-week project, not a crisis. Call us.
Talk to a partnerTalk to a partner, not a sales script.
Tell us what is going on. A partner will call you back the same business day, look at what you have, and tell you honestly whether we are the right fit. No pricing pressure, no pitch deck.