Partner Success
How FusionRed Helped a Leading Accounting Firm Build the Cybersecurity Posture Their Reputation Demands
A Case Study with Clear Path Accounting’s Executive Assistant & Practice Manager, Sharon John.
Company
SherpaTech
Industry
Cyber Insurance
Services
Cyber insurance program placement, risk guidance and mitigation strategies, and claims management.
Location
North Sydney, NSW
The story in short
SherpaTech spend their days asking clients how well their data is protected. When they asked it of themselves, nobody could give a clear answer.
SherpaTech is an insurance company based in North Sydney, NSW, providing professional indemnity, public and products liability, IT liability, and cyber insurance to businesses across Australia. The firm is backed by decades of combined insurance experience and is a member of NIBA, the National Insurance Brokers Association.
Working with FusionRed, they started with a full data audit rather than new software, and ended up with a documented picture of their own exposure for the first time.
The background
The firm that asks other businesses how they protect their data
When a business buys cyber insurance, it hands over a detailed picture of itself. Systems, exposures, financials, client lists. That information has to live somewhere.
SherpaTech holds exactly that for businesses across Australia. Their work is assessing how well other organisations manage cyber risk, which puts them in an unusual position. The credibility of the advice they give is inseparable from the integrity of the systems they run themselves.
The challenge
They asked clients where their data lived. They could not answer it themselves.
The question SherpaTech puts to clients every day turns out to be a hard one to answer about yourself. Tim could not say with certainty where all of the firm's client data sat. Their previous IT provider could not give a clear answer either. This was not negligence. The setup was never built to provide that kind of visibility in the first place.
Client information spread across systems no one had mapped
Security sitting outside the team's own area of expertise
An IT provider without the security focus the business needed
The risk you cannot see is the one you cannot price
A single mishandled record can mean a lost client, a privacy breach, or a much harder conversation with your own insurer. Undocumented risk cannot be priced. For a firm whose product is risk assessment, that gap sits close to the core of the business.
In their words
“It was a really reassuring feeling to actually have a true audit of where we sat. I was most surprised by the sprawl of data in locations that I hadn't expected it to be. People emailing around spreadsheets, hidden OneDrive files, local copies of documents.
The solution
Fortify AssessThe first step was not new software. It was finding out what was already there.
Fortify Assess ran as a full data audit before anything was installed or changed. It mapped where client information actually sat, including the places it should not have been.
For the first time, SherpaTech had a documented picture of their own exposure rather than an assumption about it.
Fixing how data is stored, not just where it sits today
An audit is a snapshot. The lasting change was to how data gets stored going forward.
- New information lands in the right place, and old copies get cleared instead of quietly accumulating
- Staff are trained to spot and report threats, so security is not one person's responsibility
- Support works around the team's schedule rather than the other way around
We just felt that the previous providers didn't really have the lens over security that we needed. When we can point to a partner like FusionRed that has set that up for us, they really are our internal IT team and compliance partner.Tim Stevenson · Insurance Broker and Specialist, SherpaTech
The transformation
A firm that can now answer its own question
The change is easiest to see in what is no longer happening.
- Tim is not guessing where client data sits
- Security is actively managed rather than assumed
- The team is not working around their IT to get through the day
- The business is not carrying risk it cannot see
What this means for a firm whose product is risk
For an insurance company advising others on exactly this, the advice given and the systems behind it now line up. That puts SherpaTech in a stronger position when their own cover comes up for renewal and when clients run their due diligence. It also means they can keep growing without wondering whether their systems will carry it.
Start with knowing what you are holding
You probably cannot say where all of your customer data lives right now. Most businesses cannot, until someone looks. Start with a data audit that shows you exactly what you are holding and where, so you can fix it before it becomes a problem.
