Mutual insurers hold sensitive policyholder data and real funds, and they face rising expectations from Boards, regulators, reinsurers and members, usually with a lean IT team. ABISOL provides experienced technology, cybersecurity and transformation leadership without a full-time executive team.
Small and mid-size mutuals carry many of the same technology risks as large insurers, with a fraction of the people.
of Coalition's 2024 cyber-insurance claims started with business email compromise or funds-transfer fraud.
Source: Coalition 2025 Cyber Claims Report (2024 claims)average cost of a data breach for Canadian organizations in 2026, up from CA$6.98M in 2025.
Source: IBM Cost of a Data Breach Report 2026, as reported by BNN BloombergRegulatory context: federally regulated insurers must meet OSFI Guideline B-13 (Technology and Cyber Risk Management, in effect since January 2024). Mutuals incorporated in Ontario answer to FSRA, whose IT Risk Management Guidance (in effect since April 2024) expects insurers to meet its outcomes and to notify FSRA of a material IT incident within 72 hours; FSRA describes its practices as aligned with B-13. B-13's three domains (governance and risk management, technology operations and resilience, and cyber security) are a practical, well-defined benchmark for any mutual's Board. Read our guide to meeting B-13 and FSRA's expectations with a lean IT team.
Tickets get closed, but nobody sets technology direction or challenges the provider.
Capable people, fully consumed by keeping systems running.
Directors hear about technology when something breaks or a budget is due.
Core-system upgrades and digital initiatives drift without clear ownership.
Instead of a business risk with owners, priorities and investment decisions.
ABISOL works alongside your people, MSP and vendors. We provide executive direction, governance and advocacy, and we don't replace anyone. Lead the IT team? See how we work with you.
Technology and cyber posture benchmarked to the B-13 domains, plus a core-system and vendor review.
Fractional CIO and CISO at management and Board level, with a 12-month technology and cyber roadmap.
Modernized claims and policy workflows, automation of manual intake, and cloud with Canadian data residency.
Core-system RFPs, vendor selection, implementation governance and project recovery.
Risk register, Board reporting, policies, incident response, continuity and vendor oversight.
Executive ownership of your technology strategy, budget, vendors and Board reporting.
Learn moreA security program, risk register and Board cyber reporting, benchmarked to OSFI B-13.
Learn moreKnow your real exposure and what to fix first.
Learn moreA defensible, documented choice of policy-admin, claims or billing platform.
Learn moreManual intake and routing automated, often on Microsoft 365 you already own.
Learn moreRecovery targets and tested plans for claims, billing and member service.
Learn moreService levels, scorecards, renewal dates and exit plans for critical providers.
Learn morePrivacy, acceptable-use, AI and security policies, plus a one-page Board dashboard.
Learn moreYours to keep, whether or not you continue.
Fractional CIO, CTO & CISO · CISSP · CISM · PMP · MBA
Mohammad has led technology in the insurance sector, including architecting and delivering a digital insurance rating engine. He has built cybersecurity programs aligned with OSFI B-13, ISO 27001 and NIST CSF 2.0, from policy through Board reporting.
More about MohammadA focused conversation with your general manager and operations lead, so the Board can decide based on facts.
Your team keeps systems running. ABISOL provides the executive direction, Board reporting and cyber governance they usually don't have the time or mandate for. We work alongside them and advocate for them; we don't replace them.
No. They do different jobs. Keep a good MSP for the ticket queue. ABISOL governs above it, sets the strategy and holds the provider to clear service levels.
That's the gap fractional leadership is designed for: senior judgment for an agreed amount of time each month, without an executive salary or a long-term hiring commitment.
Attacks are largely automated, and mutuals hold real funds and sensitive data. Business email compromise and payment fraud in particular don't depend on an organization's size.
B-13 itself applies to federally regulated insurers. If your mutual is incorporated in Ontario, FSRA's IT Risk Management Guidance applies, and FSRA describes its practices as aligned with B-13, so B-13 is a clear, well-structured benchmark either way. Using it helps you answer questions from your Board, regulator and reinsurer with confidence. Read our B-13 guide.
That's fine, and often wise. We start with fundamentals: governance, data and security. AI only comes in where there's a measurable, low-risk use, such as routing emailed claims.
We work with least-privilege access, avoid holding your sensitive data wherever possible, and sign an NDA. You keep ownership and control throughout.
A no-obligation conversation about where you stand and what to do first.
Prefer slides? View the presentation version · All services
