Data Breach Archives - �ǿմ�ý �ǿմ�ý Title Insurance Co.

Stop Risking Your Sensitive Docs

Bryan Johnson — Fri, 24 Apr 2026 15:50:11 +0000

Prevent data leaks and ensure version control by ditching PDFs for a more modern approach.

By Bryan Johnson, IT Director, �ǿմ�ý

Although the risks of our digital-first economy are becoming increasingly well known, many people still are not sharing information safely. Far too many businesses rely on email and PDF attachments when sending transaction information, despite the problems they can pose for organizational security and efficiency. Thankfully, there is a better way forward: portals, permissions, and link expirations. These can all go a long way toward tightening your agency’s information controls while improving workflows at the same time. Here’s what that can look like in practical terms for your team.

What counts as sensitive info?

First, let’s dig into what counts as sensitive information that should NEVER go into emails or attached PDFs. Some of the common examples include:

Anything that could be construed as non-public personal information (NPI), like social security numbers (SSNs), dates of birth (DOB), bank information and more.
All wire instructions, payoff information, or disbursement data.
Any statements from lenders or closing documents.
All information that could be leveraged to impersonate transaction stakeholders, like signatures, account numbers, or scanned copies of IDs.

A common rule of thumb is this: If it could possibly harm someone or derail your transaction, find a different way to share it.

Pursue a portal-centric approach

Rather than risk compromising your security or efficiency with PDF attachments, pursue implementing a document-sharing portal for your agency. These portals can be broken down into two buckets. There are industry-specific document-sharing portals offered by brands like Qualia and SoftPro. And there are general document-sharing portals such as ShareFile, Dropbox, Google Drive and Microsoft OneDrive.

The portal type you choose should come down to your businesses needs. If you are a high-volume agency with multiple offices and large coordination needs, you’ll likely benefit the most from a more tailored solution. Custom platforms like these often excel at unifying document versions and creating a single source of truth to move transactions faster at scale.

On the other hand, if you are a small shop, a more generalized portal may be sufficient. Either approach involves tradeoffs, but you can benefit from looking inward and carefully assessing your team’s needs before pulling the trigger.

Implement best practices with your portal

After making your decision on a document-sharing portal, you should establish safeguards around permissions and links. Title agents are busy people, so implementing built-in guardrails is important.

Keep things simple: while employees can still use email to coordinate around closings, links—not attachments—should be how important or sensitive information is shared. The beautiful thing about links is that they are endlessly customizable with today’s modern tools. Consider establishing the following defaults for your links:

Make each link “View only” as its default setting. Avoid allowing downloads unless completely necessary.
Refrain from setting a link’s permissions to “anyone with the link.” This is critical for sensitive information.
If your platform allows it, prohibit resharing links and require recipients to be invited users.
DO NOT leave links live indefinitely. Consider a 7-day limit for IDs and wires and 2-4 weeks for other documents.

Taking these steps ensures you will be getting the most value out of your portal. And more importantly, it guarantees that you are using all available means to protect your customers’ transactions and guard your company’s reputation.

Become a more secure and reliable title partner

Amid the hustle and bustle of a transaction workflow, it can be tempting to attach important documents and send an email. But believe me when I say that you want to resist that impulse. While email and attachments are convenient, they can pose real risks to your agency’s security and long-term viability. Implementing and optimizing a modern document sharing platform with the right permissions and guardrails can help you work more safely and efficiently. Making this investment in your document sharing practices also demonstrates a real commitment to the security of your customers and partners. This will translate not only into satisfied customers but also solidify your reputation as a reliable title partner.

The post Stop Risking Your Sensitive Docs appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Deploy Passkeys in 2026 for Better Security

Bryan Johnson — Thu, 19 Mar 2026 20:24:16 +0000

Make your agency more phishing-resistant in 2026

By Bryan Johnson, IT Director, �ǿմ�ý

Keeping your agency’s data and digital assets safe these days can often feel like a never-ending battle. Unlike you and your team, fraudsters and other criminals never take a day off. They don’t go on vacation, and they never get sick. Because of this, your agency needs a cybersecurity policy that is also always-on. While this requires many moving pieces all working harmoniously together, today we are going to focus on just one important element: passkeys.

What are passkeys and why do they matter?

You may already be familiar with passkeys. If you have an iPhone, you may have seen prompts to save a passkey for a supported app or website. If you choose to do so, you often won’t need to enter your password again on that device. Instead, you approve the sign-in with Face ID, Touch ID, or your device passcode, and the passkey authenticates you to the app or site.

Passkeys use what is known as “public-key cryptography.” In plain English, that means that passkeys create two linked digital keys—a public key, stored by the website or app, and a private key, which stays safely on your device. These keys work together upon sign-in to verify your access, all while never exposing a password that a hacker can pick off and weaponize.

This is obviously a nice thing for consumers from a convenience perspective, but passkeys also hold numerous security advantages. Traditional passwords are more vulnerable to thieves because users often reuse them across sites—making them easier to guess. Passkeys, on the other hand, cannot be reused, rendering that security concern irrelevant.

In addition, passkeys are never “housed” in the systems of a website or app. They stay safe on your local machine. This means that even if a company experiences a data breach (an all-too-common occurrence these days) there will be no sensitive user information to steal.

Perhaps most importantly, passkeys greatly reduce the prospect of a user getting “phished” by a criminal. Phishing is one of the most common cybersecurity concerns out there. It works so well because human error often happens online and hackers have gotten very, very good at tricking people into handing over their sensitive information.

Passkeys largely negate that concern. If a cybercriminal tricks someone into going to a fake website, for example, a user’s passkey will not work on it. Or to put it another way, with passkeys, users are not at risk of accidentally giving away a reusable asset that can be exploited. In fact, they are not giving away an asset at all, but half an asset that requires the other key to work.

Make passkeys central to your cybersecurity approach

Clearly, passkeys can be just as valuable to businesses as they are to individual users, especially businesses like title agencies that must routinely protect sensitive data and user information. There are multiple systems and touchpoints where deploying this technology would reinforce your overall security posture, such as employee email, escrow and transaction systems, document portals, and any client-facing accounts where closing information may be shared.

Once you’ve made the decision to deploy passkeys, the best way to start is with the systems you are using every day. Many agencies, for example, use some variation of Microsoft 365 or Google Workspace to handle employee emails and other business applications. Within these platforms, you can turn on passkey support and then start testing internally to see how it works. Once you get the lay of the land, you can expand it throughout the rest of your team.

You can, of course, build your own system, but it is generally not recommended unless you have strong identity management experience on staff. Creating your own passkey server can be expensive and time-consuming, and unless you know exactly what you’re doing, it can lead to a critical security incident.

Taking the bait

Our digital-first world is an amazing place, but it can also be a fatiguing one. While people can and must take breaks, our security systems cannot afford to. The criminals and hucksters out there are always circling, looking for a weak point in your defenses. While passkeys can’t keep all these threats at bay on their own, they can do a lot of good. Passkeys eliminate some of the most common methods thieves utilize to attack your team, harm your agency and steal your data. They disrupt routine phishing methods. And they ensure that even if you wind up taking their bait once in a while, there is nothing worth reeling in.

The post Deploy Passkeys in 2026 for Better Security appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

In 2025, �ǿմ�ý �ǿմ�ý Agents Took A Stand Against Fraud

Adam Mohrbacher — Thu, 22 Jan 2026 22:40:10 +0000

Vigilant agents across the country are helping create a safer, stronger industry

By Adam Mohrbacher

From the rolling hills of Missouri to the coastal plains of Florida, fraud continues to threaten real estate transactions across the country. In response, an increasing number of �ǿմ�ý �ǿմ�ý agents are answering the call to help identify and stop fraudulent activity. Over the years, these agents have prevented dozens of fraudulent transactions from moving forward, saving millions of dollars in proposed liability. Here, we take a closer look at fraud prevention efforts from the past year, as well as the agencies recognized through �ǿմ�ý �ǿմ�ý’s Crime Watch program.

A problem with a massive scope

Not that anyone really doubts it, but the data continues to confirm that real estate fraud in the United States is pervasive. ALTA’s 2025 Cybercrime Study, for example, showed that over 40% of title companies reported getting at least one email per month attempting to change wire instructions.[i] A survey from the �ǿմ�ý Association of Realtors paints an even more disturbing picture, with 63% of respondents indicating they were aware of deed/title fraud in their markets within the past 12 months.[ii]

In her recent claims wrap-up blog, �ǿմ�ý �ǿմ�ý’s Chief Claims Counsel, Mauri Hawkins, also emphasized that title and real estate fraud is arguably getting worse—not better. “In my opinion, it appears there has been an increase in the number of submitted title claim notices involving lawsuits challenging the validity and veracity of recorded real property instruments or the authority of a person to execute documents on behalf of a person or entity in the chain of title,” she noted.

The sheer amount of fraud is not the only problem the industry is facing. Fraudsters’ increasingly advanced methods also pose a clear threat. They are “leveraging social engineering and devices to manipulate, influence and deceive; they continue to prey on what they see as a lucrative market and a quick payday,”[iii] said Hawkins.

The role of �ǿմ�ý �ǿմ�ý agents

Many �ǿմ�ý �ǿմ�ý agents have continued to push back against this ever-rising tide of fraud across the United States. In 2025, their vigilance resulted in $1.6 million in savings. �ǿմ�ý �ǿմ�ý helped support and incentivize these efforts through its Crime Watch program. The program issues $1,000 each time an eligible agent who meets the program criteria discovers and prevents fraud. The program awarded $11,000 to agents in 2025 alone, reinforcing �ǿմ�ý �ǿմ�ý’s commitment to proactive fraud prevention.

�ǿմ�ý �ǿմ�ý’s 2025 Crime Watch Award Recipients:

AGENT	STATE	PROPOSED LIABILITY AMOUNT OF THE TRANSACTION
Alpha Title Guaranty, Inc.	Missouri	$ 30,000.00
Aransas County Title /Texas Lone Star	Texas	$ 245,000.00
Ellis County Title	Texas	$ 240,000.00
First International Title	Florida	$ 300,000.00
First International Title	Florida	$ 350,000.00
First International Title	Florida	$ 70,000.00
Michigan Investment Title	Michigan	$ 20,600.00
Saint Lawrence Title, Inc.	Florida	$ 125,000.00
Sovereign Title Services	Oklahoma	$ 165,000.00
Texas Secure Title Company	Texas	$ 80,000.00
Tropics Title Services Inc.	Florida	$ 23,500.00

What agencies can do

There are many lessons agencies can draw from these real-world experiences. Aransas County Title’s Brooke Turner, who prevented a nearly $250K transaction from going forward, explained that: “We look at everything associated with identities and banking accounts—including handwriting. If the handwriting on recorded documents doesn’t match the contract or wiring instructions, it’s a huge red flag.”[iv]

Tropics Title Services’ Jean Thomas, who blocked a fraudulent $23K transaction, echoed Turner’s comments on the importance of being comprehensive, as well as having strong internal protocols in place. “I followed my gut, adhered to best practices and followed our tried-and-true policies for dealing with suspicious activities,” Thomas reflected. “Fraud is not going away in this industry, unfortunately,” she continued. “We must ensure that we thoroughly investigate any deals that carry sufficient red flags.”[v]

These efforts align with �ǿմ�ý �ǿմ�ý’s new Verify, Then Trust initiative—designed to raise awareness and reinforce best practices that help stop fraud before it becomes a claim. Agents are urged to Verify, Then Trust on every file, every party, every time.

Additional best practices aligned with a “Verify, Then Trust” mindset include:

When possible, always speak to the customer directly rather than relying on digital communication.
Always encrypt sensitive information such as wire instructions.
Foster a highly collaborative agency culture to ensure collective expertise is brought to bear on suspicious transactions.
Stay up to date on the latest news and trends related to real estate fraud and title claims. The �ǿմ�ý �ǿմ�ý website blog remains a phenomenal source of information on everything from claims and cybersecurity tips to how to prepare for a data breach.
Take advantage of continuing education classes offered through that focus on fraud, cybersecurity and compliance.
Remember: when something feels off with a transaction, it probably is. Trust yourself and take action. As they say, it’s always better to be safe than sorry.

Make this a year of anti-fraud activity

Whether your agency is well-versed in addressing fraud or just beginning to put formal policies in place, now is the time to act. Working collaboratively with �ǿմ�ý �ǿմ�ý can help support your efforts to identify and respond to potential fraud. Let’s continue working together to promote a safer and more successful industry—by remembering to Verify, Then Trust. Want to learn

[i]

[ii]

[iii] Claims: A Look Back At 2025 – �ǿմ�ý �ǿմ�ý Title Insurance Co.

[iv] Texas Title Agent Spots Red Flags, Stops Dubious Deal – �ǿմ�ý �ǿմ�ý Title Insurance Co.

[v] Two �ǿմ�ý �ǿմ�ý Agents Take the Fight To Fraudsters – �ǿմ�ý �ǿմ�ý Title Insurance Co.

The post In 2025, �ǿմ�ý �ǿմ�ý Agents Took A Stand Against Fraud appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Seize Upon Cybersecurity Awareness Month This October

Bryan Johnson — Fri, 24 Oct 2025 02:56:58 +0000

Make sure to get your cyber house in order ahead of the holiday season.

By Bryan Johnson, IT Director, �ǿմ�ý

It’s that time of year again. Another summer has come and gone. The days are getting shorter. And soon, we will all be caught up in the hustle and bustle of the holiday season. That’s why it’s important to embrace Cybersecurity Awareness Month while we still can. For 20 years each October, Cybersecurity Awareness Month has served as an important moment for businesses to stop and assess their current cybersecurity setup. Follow along to see how you can use this moment to reduce your risk exposure. That way, you and your business can be on a better footing as we approach the new year.

Building a cyber strong America

One of the best ways you can become more cyber secure this October is by checking out the U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA). Each year during Cybersecurity Awareness Month, This year’s topic is “Building a cyber strong America.” Although geared specifically toward businesses that deal with “critical infrastructure” like telecommunications, energy, and transportation, the campaign is packed with helpful safety tips that are relevant for the title industry as well.

Don’t get phished

One of the first tips mentioned in CISA’s campaign is to avoid phishing. Data suggests that phishing email activity has grown by nearly 18% in 2025, with insurance being one of the primary industries targeted by scammers. Phishing attacks aren’t just growing in quantity. Their cost is similarly skyrocketing, coming in at the hefty average sum of $4.88 million. The silver lining to this gloomy picture is that there are tried and true methods for mitigating such risk. Given that 90% of attacks involve human error, educating your staff on the perils of phishing can go a long way toward keeping your business safe.

Require MFA and strong passwords

It may seem simple, but one of the best ways to protect your organization still comes down to strong passwords. The CISA campaign rightfully points out that password best practices should always include multi-factor authentication as well. Other essential steps to follow include using long phrases, with the minimum being between 12-16 characters. No matter how annoying it is to remember multiple passwords, you should never reuse a password across sites. One breach could set off a chain reaction that leaves your entire system compromised.

In 2025, it’s also wise for title agencies to ditch password recovery questions altogether. Fraudsters have gotten really good at guessing common questions like “What is your mother’s maiden name?” Such information is often readily available online.

You must also secure the password reset process. Use an authenticator or passkey instead of text messages. Also, add a dedicated recovery email and create backup codes to store in your password manager. Attackers, you see, often target resets, so protecting that path is just as important as the password itself.

Additional precautions

Once you’ve mastered the basics, CISA outlines additional safeguards you can deploy to strengthen your cybersecurity position, such as:

Encryption: For many industries, but particularly for data heavy fields like title insurance, encryption technologies are an essential tool for protecting customers and transactions. Ensure you have encryption deployed across your organization, and check out our piece on client-side encryption to learn how it can further reinforce your security.
Data backups: A cornerstone of robust cybersecurity isefficient and consistent data backups, specifically the 3-2-1 backup rule. This data protection strategy recommends keeping three copies of your data: one original and two backups. These backups should be stored on two different types of media, with one copy kept offsite or in the cloud to protect against local disasters. Malware scanning and immutability should also be employed to reinforce your overall strategy.

All of this ensures you can minimize your organization’s downtime, prevent data loss and maintain customer trust. Thankfully, it has become easier than ever to automate your backups, which is great for peace of mind.

System monitoring: To effectively monitor your systems, it is best practice to deploy a multi-level approach involving robust threat intelligence, detection and incident response. Putting up multiple layers of defense ensures that even today’s most insidious attackers will face an uphill battle to breach your systems.

Take action now for a cyber strong agency

By the time you read this, you will probably already be putting plans in place for your holiday season. Maybe those involve shopping or cooking. Maybe they involve booking a flight or two. But as important as those plans are, the cybersecurity of your agency is equally pertinent. Act now by following the advice detailed on CISA’s website and on this very blog. Then you can put your feet up during the holidays and congratulate yourself on a job well done.

The post Seize Upon Cybersecurity Awareness Month This October appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Make Cybersecurity Simpler: Three Habits For Better Business Security In 2025 And Beyond

Bryan Johnson — Fri, 26 Sep 2025 03:27:25 +0000

By habitually practicing these three things, you’ll be on your way to greater cybersecurity success

By Bryan Johnson, IT Director, �ǿմ�ý

What exactly is success’s secret sauce? Well, Malcolm Gladwell would say that repetition is the key. The writer and public intellectual once famously claimed that it takes 10,000 hours of practice to master something. I don’t know if that specific number is accurate or not, but I do know that repetition is integral to a successful cybersecurity posture for any business. One thing that makes cybersecurity so tough to get right is that an effective strategy hinges on many moving parts. Not only do you need the right technical solutions, you also must ensure employees understand the risks and practice secure habits online. Having standardized, repeatable processes can go a long way toward mitigating this complexity and keeping your business safe from harm. From my perspective, these are the top three you should focus on at your agency.

1.) Review system updates

Keeping your systems, programs and applications religiously up to date is one of the best ways to avoid compromising your business’s security. Although it seems like it should be common sense in 2025, many companies still do not do this consistently. A recent study, in fact, showed that nearly 8 out of 10 companies are running on some form of outdated technology, which can lead to significant consequences. System updates often include critical security patches. If left uninstalled, your company can become a prime target for advanced malware and cyberattack strategies. Not to mention, leaving application updates uninstalled can mess with your compliance goals and damage your firm’s reputation.

Now, I’ve been in this game for a long time. I know that keeping your systems continually updated can be an annoying and, if you’re not careful, time-consuming process. According to one report, your average small- to medium-sized business (SMB) utilizes an average of 58 applications, with many requiring continuous updates.[i] That makes it essential to stay on top of this process to ensure that your team is always running the latest versions of their solutions and tools.

2.) Review security logs

Just as important as frequently updating your systems is diligently reviewing your security logs. The average organization these days is generating more data and utilizing more network endpoints than ever before, which makes this a particularly important process to run in 2025. Some people don’t know this, but often cyber incidents aren’t immediately obvious. It’s not as if an attack happens and suddenly you’re facing a glitching computer screen or an ominous message shaking down your business for all it’s worth. Most incidents begin in a subtle and almost imperceptible fashion, which is where the utility of checking your logs comes into play. By turning this into a routine activity that you do every week, you’ll be better positioned to spot potential abnormalities and take swift action on worrisome issues before they balloon into a crisis.

3.) Run security trainings

While it may come last, keeping your team current on the latest security changes, challenges and best practices is no less important than the other points on this list. In fact, it may be the most important way to ensure the safety of your entire operation. The data is clear on what can happen if you don’t take this seriously, with some reports listing human error as the origin of 95% of data breaches.[ii]

There are a lot of best practices for running successful cybersecurity trainings. The most critical principle, though, is that they need to be mandatory and consistent. Remember, a strong, solid cybersecurity posture always requires an all-hands-on-deck approach. It only takes one user to click on a phishing email or mishandle a system password and the whole thing can fall apart.

And so, while it is never easy to add another standing meeting to the calendar, especially for busy title insurance folks, establishing a consistent, habitual training schedule is non-negotiable if you want reliable security.

It’s not as easy as 1, 2, 3, but… With something as complex as cybersecurity, can you ensure success by simply making the above-mentioned processes a habitual part of your routine? Not by a long shot. Almost nothing in our digitally connected world is so simple that it can be solved with a mere three-point list. That said, practicing these processes on at least a monthly basis is a great way to be ahead of the curve. They will ensure that you have the latest security patches installed, incidents are caught early, and team members are aware of the latest cyber risks and how to avoid them. And that will put you on a defensive footing that may not be bulletproof, but is certainly better than many organizations out there.

[i]

[ii]

The post Make Cybersecurity Simpler: Three Habits For Better Business Security In 2025 And Beyond appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Look Before You Leap: Assessing Third-Party App Risk

Bryan Johnson — Thu, 24 Jul 2025 20:54:20 +0000

By Bryan Johnson, IT Director, �ǿմ�ý

Aristotle supposedly once said, “It is the mark of an educated mind to be able to entertain a thought without accepting it.” Although the ancient philosopher died nearly 2,000 years ago, his statement remains highly relevant to how businesses should approach security issues today, particularly regarding third-party applications. Digital apps are essential to workplace productivity and profitability in 2025, but that doesn’t mean we can take anything an app vendor says at face value. Rather, businesses that wish to maximize the benefits of their applications while minimizing risk need to deploy a strategic, thoughtful process. Here’s how you can do that in three easy steps.

1.) Initial screening process

Properly vetting a third-party application’s security begins with an initial screening of needs and capabilities. Start by asking yourself a simple question: Is there an actual business need here for this application? Once established, you can start figuring out what the application is (cloud service, browser extension, etc.), which data sets it will touch (financial, personal customer information, etc.) and who is going to end up using it (internal-only versus customer-facing). Answering these questions early helps you gauge risk and define the safeguards you’ll need.

2.) Security, privacy and data access review

Following your initial screening, check if the application you’re considering adheres to reputable security and privacy frameworks like SOC 2 Type II and ISO 27001. These certifications show that the app provider follows industry best practices for controls, monitoring and governance. Don’t stop there, though. To cover all your bases, you will also want to review an app’s:

Penetration test results
Privacy policy
Encryption practices
Data storage and access processes

Finally, round out your investigation by examining whether the app meets any relevant regulatory requirements such as those stipulated in the GDPR, CCPA or HIPAA. For a data heavy industry like title insurance, these expectations should be largely non-negotiable.

3.) Internal governance and continual monitoring

Once you collect and review this information, you can proceed with implementing your app. However, that doesn’t mean you should consider the project complete. Whenever you launch a new IT initiative, there is always the possibility that something may go awry. Continual monitoring can help you quickly remediate any problems that arise with your app down the line. To make this process easier, take the time to determine who owns the relationship with the application vendor ahead of time. Then, establish a process for keeping tabs on updates, misuse, and security vulnerabilities. Performing this due diligence before launching the application can prevent future headaches.

Get the answers you need

To wrap this all up, I want to leave you with another quote from Aristotle, who said, “The roots of education are bitter, but the fruit is sweet.” I think this goes to the heart of what this blog is discussing. Vetting third-party app risk undoubtedly requires effort, but the rewards justify the work involved. And by following the three steps outlined here, I promise you’ll get the answers and results you need.

The post Look Before You Leap: Assessing Third-Party App Risk appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Do You Have A Shadow IT Problem? Here’s Why You Need A Plan

Bryan Johnson — Tue, 24 Jun 2025 23:19:35 +0000

Even when there is no malicious intent, unsanctioned applications can cause major problems for your agency

By Bryan Johnson, IT Director, �ǿմ�ý

Have you heard of shadow IT? The term conjures images of masked criminals poking around on your server or installing dangerous devices. Yet shadow IT is usually more mundane, referring to applications installed without IT’s permission. It’s important to remember, though, that just because something is commonplace doesn’t make it safe. Here, �ǿմ�ý �ǿմ�ý IT Director Bryan Johnson explains the dangers of shadow IT and how you can combat its use.

The phrase “shadow IT” can sound scary. It evokes images of hackers lurking in some dark corner of your technology stack. Shadow IT, though, is often neither clandestine nor malicious. It merely refers to any piece of software or hardware installed by a user without an IT department’s permission. Quite often, this is done merely to gain greater productivity and involves popular applications like Gmail, VOIP apps like Skype (RIP) or even custom Excel documents. But the absence of ill intent doesn’t mean shadow IT is harmless. It can cause security problems and derail compliance. To avoid this, agencies need to understand the problem of shadow IT and have a game plan to curb its use.

Shadow IT is a growing and serious problem

The data shows that shadow IT has become an increasingly prevalent problem in recent years. For instance, one recent study predicts that by 2027, three in four workers will use technology that IT departments can’t technically “see.”[i]

But it isn’t just a quantitative problem. Shadow IT also poses real qualitative issues. Another recent study took a deep dive into “malicious requests,” which occur when someone, usually a hacker, sends a request to a site, server or device with the intention of doing harm. Nearly 31% of the 16.7 billion malicious requests they observed involved unsecured APIs,[ii] which are a common attack vector that can wreak havoc on an agency’s systems.

If that wasn’t bad enough, the numbers also show that shadow IT users often have a bit of a reckless streak. A Gartner study revealed these users are about twice as likely to take risky actions as their co-workers,[iii] posing significant security risks. And with the average cost of a data breach hovering around $5 million,[iv] that’s something you never want to take lightly.

The problems involved with shadow IT go beyond security too. It can also upend your firm’s compliance. Unauthorized apps and programs often bypass normal security measures, potentially exposing sensitive data. That puts you at greater risk of running afoul of industry best practices and privacy laws, not to mention undercutting audit-readiness and increasing your liability. All in all, it can lead to problems that can be very difficult to recover from.

Putting a plan in place

Now that we can see the scope of the problem and the potential consequences involved, we can move on to the more important question: So, what can we do about it? Here are three strategies I think can be most helpful for stopping shadow IT:

Knowledge is power: Like a lot of IT issues, one of the best ways to combat this problem is simply to talk to your employees about what shadow IT is and how it can imperil your business. If you’ve built a good team, they will acknowledge the severity of the issue and take action to prevent it.
Deter don’t punish: Alongside education, take direct action to detect unauthorized applications. Networking monitoring tools, DNS filtering and endpoint security are all invaluable for accomplishing this goal. You can also audit your cloud computing usage for greater visibility. It should be said that this strategy should always be about detecting and deterring—not punishing. As we’ve discussed, shadow IT usage often occurs to help not harm an agency. Always keep that in mind.
Optimize your IT infrastructure: Perhaps the best way to stop shadow IT usage is via continuous improvement of your existing IT stack. Survey your employees to understand which IT tools are helpful and which aren’t and then implement new solutions to make their workflows simpler. Be sure to review your IT governance policies alongside any improvements you’re making. Reviewing and revising these policies can improve understanding and ensure alignment around acceptable use.

Turn on the light to stop shadow IT

With all the security challenges out there, the last thing you need is to worry about what applications your employees are installing without express permission. Yet shadow IT should never be taken lightly, as it can disrupt your security and compromise important priorities, like compliance. The good news, though, is that shadow IT is rarely malicious. With a bit of education, detection, and optimization, you can shed light on shadow IT and discourage its use.

The post Do You Have A Shadow IT Problem? Here’s Why You Need A Plan appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Vendor Security: The Weakest Link?

Bryan Johnson — Thu, 20 Mar 2025 21:09:12 +0000

Vendors carry unique risks; here’s how to address them

Remember the TV show The Weakest Link? Running from 2000 to 2012, the show enjoyed quite a bit of popularity back in the day. Host Anne Robinson’s catchphrase “You are the weakest link-goodbye!” even became part of the cultural lexicon for a moment in time. A business’s cybersecurity strategy will inevitably have its own weakest link. No matter how well designed it is, no system is invulnerable to attack. For many businesses, vendor relationships are the weakest link. There are numerous reasons for that, ranging from third-party data access to weak authentication methods. Let’s explore how you can fortify these relationships and ensure you and your favorite vendors never need to say “goodbye.”

Vendors: a beneficial but potentially risky relationship

A good vendor relationship can be highly beneficial, bringing cost savings, expertise and innovation that can translate into lasting competitive advantage. However, there is no question that vendors can introduce security risks for a business. One of the most significant is the potential for data leaks. If a vendor doesn’t have good security policies but has access to a business’s critical systems, that can be a potential attack vector for criminals.

But that’s just the tip of the iceberg. Vendors may use third-party tools with security gaps, rely on weak passwords, or fail to meet title industry security standards. Lastly, in the event of a security incident, a vendor may not have a dedicated incident response plan, which could lead to a disruption for your business.

Simple, straightforward security steps can help

While these risks are no doubt significant, there are a lot of simple steps you can take to make your vendor relationship more secure. The most important one is also the most obvious. Only give your vendor access to the systems and data they need to meet the conditions of your service agreement.

Beyond access control, there are several other precautions to take. It is wise to lay out cybersecurity roles, responsibilities and expectations at the start of any vendor engagement. Clear expectations help vendors handle your data responsibly, respond to incidents, and uphold security policies.

You and your vendor should also be on the same page on how you will respond if a security breach unfortunately does occur. Planning ahead can minimize disruptions and long-term damage to your business. Of course, all this hinges on first developing a trusting dynamic with your vendor. If you don’t communicate openly and transparently, it becomes much more difficult to collaborate on security goals and grow together.

Lastly, it is always a good idea to conduct regular security check-ins with your vendors. This is a good way to remain aware of the systems and data your vendor has access to. These meetings can also be a time to quickly and efficiently communicate any changes in your cybersecurity strategy.

The role of vendor security agreements (VSAs)

One of the best ways to make sure you are taking the precautions outlined above is by putting together a comprehensive vendor service agreement (VSA) at the beginning of a new vendor engagement. VSAs are a critical tool for managing security risks in third-party relationships, including data protection protocols, compliance and responsibilities in the event of a breach. Other provisions that are often included in a VSA encompass access controls, encryption requirements and multi-factor authentication (MFA) policies.

Additionally, a good VSA should include your agency’s incident response framework. If you’re considering developing a framework, detail how quickly a vendor must notify you of a security event and clearly list what steps they must take to help fix the issue. This can be an especially important provision. Data shows that the timeline from when an average vendor discovers a security problem to when they notify their client is often quite long. But it can be reduced when there is a contractual obligation to notify.[i]

Lastly, businesses should also explicitly define in their VSA how they want to approach periodic security audits for their vendors. It is perhaps the most effective strategy for ensuring alignment with evolving cybersecurity standards.

Toward an ever more productive and profitable partnership

It is a rotten feeling when a vendor causes a security incident, and you must deliver an Anne Robinson-style dismissal. With a little extra work, however, you can secure these relationships and help prevent security incidents before they start. When your vendor partnerships are safe, an even more productive and profitable dynamic becomes possible.

[i]

The post Vendor Security: The Weakest Link? appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Are You Practicing Good “Cyber Hygiene”?

Bryan Johnson — Thu, 20 Feb 2025 16:06:08 +0000

You know the value of practicing dental hygiene. The same is true for your cybersecurity!

Anyone who has been to the dentist knows the drill. You are in the middle of getting your cleaning, and your hygienist starts asking about your flossing habits and the toothbrush you use. This isn’t mere chit-chat but rather a way for your dentist to gauge your overall oral hygiene. Dentists know that keeping your teeth healthy requires more than an annual cleaning. It is a daily routine, involving consistent brushing, limiting your sugar intake, and replacing your toothbrush regularly.

While it may be tempting to take a “set it and forget it” approach to cybersecurity, resisting that impulse is crucial! Just like oral health requires daily maintenance, cybersecurity needs ongoing attention to prevent vulnerabilities from developing. In this blog, we’ll draw direct comparisons between the two to highlight the importance of good cyber hygiene.

MFA and Password Management = Daily Brushing and Flossing

Dentists will say that the first line of defense against dental problems is consistent, at-home brushing and flossing. Without a good routine in place, problems can quickly emerge. In the short term, this can include plaque build-up and gum inflammation. If neglect continues, tooth decay, cavities, chronic pain, and even systemic health issues can develop.

Weak password strategies and a lack of multi-factor authentication (MFA) often lead to similar outcomes for cybersecurity. Just like plaque builds up over time, the threat of phishing attacks or credential hacking increases without stringent protections. Eventually, the consequences can become severe, including stolen credentials, ransomware attacks, and operational disruptions. These issues can ultimately lead to reputational damage, economic fallout, and even legal penalties.

Just as brushing and flossing protect your teeth, using MFA and strong passwords can prevent cybersecurity issues before they arise.

Avoiding Suspicious Emails and Links = Reducing Sugary Food

Keeping your teeth pearly white also requires making smart choices, such as cutting back on sugar. When people indulge too much in sweet treats, it often leads to tooth decay and other issues like bad breath, gum disease, and even an increased risk of heart disease.

Similarly, failing to exercise caution with emails and links can expose your agency to cyber threats. A small lapse here and there may not seem like a big issue. But just as excessive sugar consumption eventually leads to cavities, frequent mistakes in identifying phishing attempts can quickly spiral into a security crisis.

The best way to prevent this is by changing the behaviors that create risk in the first place. Just like education on the dangers of sugar helps people make healthier dietary choices, cybersecurity training and vigilance can help your team operate more safely online.

Software and System Updates = Replacing Your Toothbrush

Good oral hygiene is not just about daily habits; it also depends on using the right tools. Experts routinely advise replacing your toothbrush every few months to maintain optimal dental health.

Like an old toothbrush that has lost its effectiveness, outdated security software may fail to detect emerging threats. Worse still, it can slow down your systems, hinder productivity, and even put your business at greater risk.

The lesson is clear: keeping your software up to date is just as critical for cybersecurity as keeping your toothbrush fresh is for dental health.

Good Hygiene: The Best Thing for Your Teeth and Your Tech!

Practicing cyber hygiene outside of an annual checkup is essential for the long-term health of both your technology stack and your business. Just as strong oral health depends on brushing, diet, and fresh tools, maintaining cybersecurity requires strong passwords, robust email security, and consistent software updates. Neglecting these steps can result in serious consequences—whether that be rotten teeth or IT system vulnerabilities. By taking these simple precautions, you can keep both your smile and your cybersecurity in top shape.

The post Are You Practicing Good “Cyber Hygiene”? appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..

Protect Your Sensitive Data With Client-Side Encryption

Bryan Johnson — Wed, 18 Sep 2024 18:57:18 +0000

As any seasoned title insurance professional will tell you, real estate transactions are complex beasts, requiring different stakeholders to share personal information sometimes across great distances. This presents massive challenges, especially at a time when data breaches seem more common than ever. What can an independent agent do to protect personal and proprietary information? Technologies like client-side encryption (CSE) offer a possible way forward. CSE can reduce your attack surface and limit liability by centralizing key management and strengthening access controls. Let’s see how it can help secure your agency from the threats of both today and tomorrow.

What is client-side encryption?

You have likely heard about encryption and perhaps even use such technology at your agency. After all, encryption technologies have been in place across multiple industries for decades. CSE is a more recent innovation. It offers users greater control over when and where their data is encrypted, and over who can decrypt this information.

How does it differ from traditional encryption?

CSE technology differs from traditional methods of encryption in two key aspects: where the actual encryption occurs and who controls the encryption keys. When using CSE, data is usually encrypted on a user’s local device before being sent to a server or shared over a cloud network. Access to this data is similarly held by the user, which means that the data remains completely inaccessible to a service or network provider.

How CSE can benefit your agency

There are clear security implications for your agency when you choose to implement CSE. CSE can help strengthen defenses against data breaches and other criminal activity. When equipped with this technology, agencies are freed from relying on third-party providers to manage security keys. Even if your network or service provider goes down or is compromised in some way, your data will remain safe and secure. Additionally, CSE gives companies greater control over who can decrypt their data, allowing them to align access permissions with organizational policies or user roles.

For highly regulated businesses like title insurance, CSE may be particularly advantageous. Title agencies are required to meet various compliance obligations, which include taking steps to ensure consumer security and privacy. CSE can directly help with these requirements.

Be future-ready with CSE

CSE doesn’t just have immediate benefits; it can also help your agency prepare for future challenges. For example, data protection laws are expanding throughout the world and the United States, imposing ever-more-stringent regulations on how businesses operate online. Data sovereignty laws are similarly growing, mandating that organizational data stay within a specific geographical location. Lastly, the rise of AI and quantum computing is upending many current encryption methodologies.

CSE holds great promise for agencies looking to navigate these seismic changes. It can ensure data is immediately encrypted at the source where it is created, thus satisfying key data protection provisions. It can empower companies to maintain control over encryption keys and not rely on providers who may be hundreds of miles away. And it provides enhanced security that can help agencies use AI safely while preparing for the next wave of cryptography advances.

Consider CSE for your encryption needs For title businesses, protecting sensitive organizational and customer data is non-negotiable. Encryption has long been the go-to method for accomplishing this goal, but traditional technologies may be insufficient for the changing digital environment. Client-side encryption offers potential advantages by encrypting data right at the source and ensuring that access is strictly maintained. Companies that adopt it no longer need to rely on third parties, can more easily comply with regulations, and are better prepared to leverage emerging technologies. In a competitive business environment like ours, those are benefits worth considering.

The post Protect Your Sensitive Data With Client-Side Encryption appeared first on �ǿմ�ý �ǿմ�ý Title Insurance Co..