.png)
A regional multi-line carrier had board approval to modernise and no appetite for the risk it carried. With Tezo, it moved three core systems to cloud-native services across nine reversible waves, fixed identity before the first workload moved, and never took the business down.
A carrier where a bad Monday costs agent loyalty, not just uptime.
A US regional carrier writing commercial property, general liability, workers’ compensation and personal lines across 14 states, with around $1.1B in direct written premium and 1,300 employees. Policy administration and billing ran on a heavily customised platform first deployed in 2004, claims sat on a separate system, and a nightly batch held the two together. Roughly 90% of business comes through independent agents.
Twenty years of customisation had made the policy platform effectively unforkable. A rate change touched code, a new state filing meant a release, and the release train ran quarterly. The vendor’s upgrade path had been abandoned three versions back, and fewer than five people understood the billing integration end to end.
Controls assumed everything valuable sat inside the data centre. Seven directories authenticated staff, agents, vendors and service accounts, with no single view of who could reach what, and service accounts carried standing privileges on shared passwords. The examination finding surprised nobody in IT. It surprised the board.
Policy, billing, claims, CRM and the agent portal were linked by roughly 60 point-to-point interfaces and a nightly batch. An agent quoting at 10am worked from data up to a day old, and a failed batch job meant a bad morning for the entire distribution force. That force had somewhere else to place its business.
Every previous proposal had been a cutover: a long weekend, a code freeze and a hope. For a carrier where a bad Monday costs agent loyalty that takes years to rebuild, that risk profile had already killed the programme twice. The technical case had never been the obstacle; the reversibility case was.
NAIC Insurance Data Security Model Law obligations, NY DFS Part 500 requirements on the New York book and contractual data-handling commitments to agents all assumed controls and evidence the estate could not produce on demand. The gap widened with every passing year, whether or not anything was modernised.
Every integration, batch job and data flow was catalogued and dependency-mapped before anything was designed. The output was a wave plan ordered by risk and reversibility rather than by architectural neatness: billing first because it had the cleanest boundary, policy administration last because it had the most. Nine waves, each with a defined rollback position.
The Azure landing zone was deployed entirely as code, with policy guardrails that made a non-compliant deployment fail at deploy time rather than get flagged in a quarterly review. Encryption, key management, network isolation, logging and tagging became platform defaults that nobody had to remember to apply, on any workload that arrived later in the programme.
Seven directories became one identity plane with conditional access, phishing-resistant MFA on privileged roles, workload identities replacing shared service accounts, and just-in-time elevation replacing standing admin rights. This finished before the first workload migrated. Moving workloads onto a broken identity model expands the attack surface exactly when the estate is least understood.
A facade was placed in front of the legacy core so consumers called the new interface while the old system still answered, and behind it the answer moved function by function. Data migrated by change-data-capture with dual-run reconciliation: both systems processed live traffic, outputs were compared record by record, and a wave advanced only when reconciliation ran clean.
The point-to-point interfaces were retired in favour of an event-driven backbone behind an API gateway, and the agent portal, CRM and analytics moved to real-time subscription. The nightly batch window shrank and then stopped being load-bearing at all, which removed the single most common cause of a bad Monday for the independent agents carrying the book.
Legacy components were decommissioned only after a defined period of clean parallel running, with rollback still available. Nothing was switched off to hit a milestone. Security monitoring, threat detection and compliance-as-code checks now run continuously, so the evidence pack an examiner asks for is a by-product of operating the platform rather than an exam-season project.
Three of nine waves rolled back during rehearsal and none in production, so each subsequent wave was approved on evidence rather than on confidence. Standing admin accounts fell from 84 to 6, with everything else just-in-time.
Controls are code and their evidence is generated by the platform, so an examination pack that took around six weeks of manual pulls now takes two to three days.
What this project changed about how we sequence a core migration.
Identity first is not a preference, it is a precondition. Migrating workloads onto a broken identity model expands the attack surface at exactly the moment the estate is least understood, and no later remediation fully recovers that ground.
Sequence by reversibility, not by architectural elegance. The wave order that survives a steering committee is the one where every step has a tested way back, which is rarely the order an architect would choose on paper.
Reconciliation, not a date, is the definition of done. Comparing dual-run output record by record is slower than a cutover and it is the only thing that lets you decommission a legacy system with genuine confidence.
Rehearsal is where rollbacks are supposed to happen. Three of nine waves rolled back in rehearsal and none in production. Teams that skip rehearsal to save a fortnight find out in front of their agents instead.
Compliance-as-code pays for itself on the second examination, not the first. Budget it as an operating capability rather than as a project deliverable, or it gets cut in the round of scope trimming that follows go-live.
Tell us where the work is stuck. We will tell you what we would do, what it would realistically take, and whether we are the right partner for it.
Vasavi Sky City, Telecom Nagar, Gachibowli, Hyderabad, Telangana 500032
