From Manual Fire Drills to Agentic Security: How Coterie Insurance Scaled Security Operations With BlinkOps

Coterie Insurance is built around speed, simplicity, and service. The technology-enabled company helps small businesses find the right coverage and get bindable quotes for eligible businesses far faster than traditional carriers.

Their security team wanted to operate the same way. Instead, they were spending their days on manual reviews, handoffs, and investigations strung across multiple systems — stretched between keeping the lights on and the higher-level projects they actually wanted to build. So they changed it. That's where BlinkOps came in.

The Challenge: A Small Team Covering Every Corner of Security

Coterie's security team is lean by design. That doesn't shrink the surface area they own: security operations, security engineering, architecture, and identity and access management.

"We're a lean team and have to focus on many different areas of security."  Brandon Kern, Senior Director of Information Security and Technology Operations, Coterie Insurance

Most of those processes ran the same way — pull data from one source, check it against another, validate the results, decide what happens next. Hours of work, repeated constantly. Coterie wanted the time back, but not at the cost of how well the work got done.

"When we thought about evolving our security with automation and agents, we wanted to focus on quality and not just the fact that we needed to automate something," Kern said.

Deciding on BlinkOps

What They Tried First

Coterie started with in-house tooling, including Azure Logic Apps. While the automation was technically possible, the time and resources required to build them was longer than the Coterie would have liked.

"Not being able to test specific steps within a workflow was very difficult," said Sean Lee, Security Engineer at Coterie Insurance. So the Coterie team turned to the Microsoft Partner ecosystem to find a solution that would work with their existing environment, but give them greater speed and control over their automations. That's where BlinkOps came in.

What They Needed

The team's criteria were straightforward:

• Integrate with the tools they already ran
• Support both deterministic workflows and agents
• Let engineers move fast without giving up control over what gets decided

What Changed

With BlinkOps, Coterie was building on day one — workflows and agents that absorbed recurring work across incident response, IAM, offboarding, and vulnerability management. With that work off the team's plate, their attention moved to the part that actually needs a human: the quality of the decision.

The Results: 50% Faster Resolution, No New Headcount

In the SOC

An agent now handles initial triage — pulling the right logs, layering in historical context, and compiling notes before an incident ever reaches a person. Analysts open a case that's already been worked.

Mean time to resolve SOC incidents dropped roughly 50%.

In Vulnerability Management

In a given week, about 600 alerts are automatically triaged, researched, categorized, and routed to the team that owns the fix. Ownership used to take hours to untangle. Now engineering teams get a clear action item: the repository, the CVE, the affected package, and the recommended update.

Work That Never Would Have Happened Manually

Coterie also pointed agents at problems no one could justify staffing. One agent audited their conditional access policies against real authentication activity and surfaced roughly 12,000 login attempts that would have been blocked under recommended configurations — a finding that simply doesn't exist in a world where someone has to review it by hand.

"The agents are almost like having another person on our team."  Sean Lee, Security Engineer, Coterie Insurance

Control at Speed — Which Matters More in a Regulated Industry

For a team covering this much ground, the compounding effect is significant. Coterie expanded what their security function can do while holding onto quality and control, and did it without hiring.

"The biggest benefit I've seen from working with BlinkOps comes down to control with speed," Kern said. "Insurance is a highly regulated industry, and now, anytime an auditor comes in, we're able to point back to exactly what was done with our automated processes and our agents and have full control over that."

The outcome isn't just fewer manual steps. It's a security team with room to work on governance, architecture, and building a stronger security operations program — while the daily work keeps moving.

What's Next: Scaling Security Operations and Beyond

BlinkOps has become more than a way to automate recurring security work at Coterie. It changed how the team approaches problems in the first place, giving them somewhere to build a permanent solution as each new need shows up.

"Having a system that automates those communications and allows higher fidelity alerts to come out has increased the trust and the reliability between our teams," Lee said. "The teams know that we are trying to build out solutions that are ultimately going to make everybody's lives easier."

As Coterie builds on the workflows and agents already in place, they see BlinkOps as a way to keep expanding what security can support without adding friction — stronger communication across teams, and a security program that moves at the pace of the business.

"The value of BlinkOps is that it elevates the team. BlinkOps allowed us to move with speed and simplicity to ultimately provide better service for our company." Brandon Kern, Senior Director of Information Security and Technology Operations, Coterie Insurance