Insurance Agency Trendsetters

There are a handful of genuinely useful tactical tidbits - mxtoolbox.com for DMARC verification, the Microsoft MFA enforcement timeline, the ransomware/terrorist-watchlist insurance catch - but they are buried in significant filler: jokes about satellites and clouds, the Suanne anecdote, the wildfire story, and general validating banter that consumes large portions of the episode.

“their cyber insurance could not pay the ransom because they were on the, the ransomware group was on the terrorist watch list”

“Microsoft, I believe in May is going to be requiring that you've got MFA for all of your users and that you don't allow those users to turn off mfa”

The cybersecurity content is almost entirely standard industry advice circa 2022 - DMARC, MFA, phishing awareness, don't click suspicious links - and the AI section borrows its best framing from a third party ('it solves the blank page problem' attributed to Steve Anderson). There is no contrarian or first-principles argument anywhere in the episode.

“he said it solves the blank page problem. And I never heard it expressed that way, but that's one of the big ways that we're using AI”

“Chubb got hacked. CNA got hacked. These are big organizations with large IT departments and big security budgets”

Brad Rubin is a genuine niche practitioner - 38 years supporting insurance agencies exclusively, ~368 agency clients, ~90 staff - which is exactly the right profile for the target audience; he has clearly done the thing at scale. The ceiling is limited because his insights on the episode don't fully leverage that depth, and he positions himself modestly as 'the least technical person in my company.'

“we support about 300 and I think, last count, 368. Independent agencies all over the country”

“I was building computers in my garage 38 years ago in Reseda, California”

The episode provides a few concrete specifics - mxtoolbox.com as a free diagnostic tool, named vendors (SolarWinds, Microsoft 365, Citrix, AWS, HubSpot, Vidyard, Loom), the Lockbit/terrorist-watchlist anecdote, and the SolarWinds supply-chain attack mechanism - but almost no outcome data, dollar figures, or agency-level metrics to substantiate claims about effectiveness.

“there's a website called mxtoolbox.com where you can go there, you can type in your domain name, uh, and do what's called an MX lookup and an SPF lookup”

“hackers got into their update service. So if you were one of those IT companies that was doing the right thing and updating your SolarWinds all the time, the updates had a hack in them”

The hosts ask a few reasonable clarifying questions (Charlotte's DMARC-for-bulk-email follow-up, her question on technology adoption comfort) but George spends most of his airtime validating, adding personal anecdotes, or finishing Brad's sentences rather than probing for deeper specifics or challenging any claims. No productive pushback occurs.

“Brad, When I first heard about this, it was for those that were sending bulk emails, marketing companies that were sending a lot of emails. But from what you're saying, this is important for everybody to do”

“George knows this, but six years ago, my home burned down in a wildfire out in Southern California”