PlanSource Secures Data and Accelerates AI
About This Project
PlanSource
Client
2002
Established in
Orlando, FL
Location
Partner Technologies Used
Microsoft Purview, Microsoft 365 E5, Microsoft Teams, Microsoft Copilot, Salesforce, SFTP
Project Highlight
PlanSource deployed 100+ security controls across approximately 120 use cases with Microsoft Purview, finishing more than two weeks early with only nine Phase 1 support tickets.
An Organization Built on Trust
PlanSource helps over 1,000 organizations administer benefits programs and manage healthcare-related information for their employees. That role puts them in a very responsible spot. Handling some of the most sensitive data an enterprise can possess makes cybersecurity and data governance strategic business priorities.
Tony Spurlin, the CISO at PlanSource, quickly identified data governance as a foundational challenge after joining the company.
"We are a data company, and what comes with data is a significant amount of trust,” noted Tony. “You have one chance with trust. You break it once and that's it."
So for Spurlin, it’s more than protecting corporate information, it’s about protecting the trust customers place in PlanSource every day.
“You have one chance with trust. You break it once and that’s it.”
Tony Spurlin (CISO, PlanSource)
Spurlin partnered closely with Ernest Byrd, Director of Security Engineering and Operations, to translate strategy into execution. Byrd quickly recognized both the opportunity and the challenge.
"We knew we needed some visibility around AI consumption, with the intent of keeping that data inside of the organization."
As Mr. Spurlin explained:
"It's not really our data, right? It's our client's data. It flows into our system, it flows out the insurance providers. We really look at it as if we're their stewards."
That stewardship mindset would ultimately shape the entire data security program.
AI Raised the Stakes
Like many organizations, PlanSource saw tremendous opportunity in AI. Leadership believed AI could improve employee productivity and customer outcomes, but only if the underlying data was governed appropriately.
Spurlin viewed AI readiness as inseparable from data security.
"AI is just going after data,” Tony stated. “I've got to have things in the proper place so that when our AI agents go to access data, they're seeing the right data. They're not leaking out. They're not hallucinating. They're not providing misinformation."
Recognizing that AI adoption requires clear ownership, business alignment, and strong controls around sensitive information, the organization established both data governance and AI governance councils.
Rather than rushing into automation, PlanSource adopted a practical philosophy: secure the data first, then expand AI capabilities on a strong foundation.
Spurlin viewed AI readiness as inseparable from data security.
“AI is just going after data…”
“…I’ve got to have things in the proper place so that when our AI agents go to access data, they’re seeing the right data. They’re not leaking out. They’re not hallucinating. They’re not providing misinformation.”
Tony Spurlin (CISO, PlanSource)
Establishing a Roadmap
When PlanSource began evaluating solutions, Microsoft Purview emerged as a natural fit due to the company’s Microsoft-centric environment.
Spurlin explained the rationale.
"Purview is native to the Microsoft environment. It's part of our tenant. It's part of our licensing."
But settling on Microsoft was only the beginning. Before implementation started, eGroup worked closely with PlanSource to evaluate risk, identify sensitive information, understand data sharing patterns, and build a practical deployment roadmap.
Reflecting on those early engagements, Spurlin said:
"eGroup helped us with evaluating the solution and measuring it against what it could do based upon our security principles. They actually were building our roadmap for us for DLP."
By quantifying risk before implementing controls, PlanSource created executive alignment and a clear understanding of what success would look like.
Keeping It Simple
One of the most important decisions the team made was resisting the temptation to over-engineer the solution.
Rather than creating dozens of classifications and overwhelming users with complexity, PlanSource adopted a simple four-tier data classification model:
- Public
- Internal
- Confidential
- Restricted
In another nod to simplicity, the team decided that rather than immediately relying on Purview’s auto-classification capability (part of the M365 E5 license), users would be encouraged to manually classify information while automated controls acted as a safety net.
Mr. Byrd explained the philosophy behind the decision.
"Ultimately what we want to see is the organizations grow into this new process and every file ends up with a tag. We’d then rely less on the backstop of the sensors working during data transmission in order to achieve that same outcome."
Said differently, instead of relying solely on technology, sensitivity labeling became an educational tool that helped employees develop stronger data security instincts.
Making Security Work for People
Byrd knew from prior experience that many Data Loss Prevention initiatives struggle because employees view them as obstacles.
He recalled:
“Data loss prevention can be one of those very difficult to implement strategies and can be heavily resisted by the organization if not done right."
To avoid that outcome, PlanSource invested heavily in Organizational Change Management.
The team created eight training videos explaining classifications, labeling, encryption, DLP policies, and user responsibilities. Training was released in waves that aligned with implementation milestones, gradually introducing new concepts while minimizing disruption.
Spurlin viewed communication as a critical success factor.
"We firmly believe we bring the population with us on this journey. If they're with us on the journey, they accept the change much more easily."
Executive updates, board communications, milestone announcements, and mandatory training created broad organizational support. Rather than experiencing security as something imposed upon them, employees became active participants in the transformation.
The benefits extended well beyond compliance.
Spurlin noted:
"We’ve improved their security acumen; it’s so much better than what it was when we started this effort."
Byrd said the key was balancing the user experience with the auditing and labeling process.
“We used a soft hand to guide them into a better process so they could understand themselves. Sometimes if you become too aggressive with data loss prevention programs, organizations fight back. We wanted to make sure we had a good baseline."
From Strategy to Execution
Working alongside eGroup, PlanSource ultimately implemented more than 100 security controls and approximately 120 use cases spanning:
- Data Loss Prevention
- Sensitivity labeling
- Email encryption
- Endpoint controls
- Microsoft Teams protections
- Copilot restrictions
- AI governance controls
- Secure web gateway controls
- Salesforce protections
- SFTP protections
- Data discovery and eDiscovery workflows
Byrd emphasized that the project deliberately started with Purview’s foundational capabilities before progressing toward more complex scenarios involving AI, third-party repositories, and advanced restrictions.
"We definitely didn't eat the elephant all at once."
Instead, the team built confidence, established baselines, and expanded controls iteratively. Starting simple enabled the organization to accelerate adoption while reducing risk and user friction.
Faster Results with Less Friction
Large-scale security initiatives often generate user complaints, support tickets, and operational disruption.
PlanSource experienced the opposite.
“Our largest focus as an IT department and organization is our AI platform, and you all will be our partners in this.”
Byrd highlighted one metric that stood out, saying:
"At the end of our phase one, our greenfield, we ended up with about nine tickets. And to me, that was huge."
Spurlin agreed, describing the outcome simply saying:
"That's a success right there."
The project also finished ahead of schedule. The team initially targeted completion at the end of June but delivered over two weeks earlier than planned.
Spurlin credited Byrd and his team, and Byrd was equally impressed by the pace of execution.
"Based on the number of things that we went through, I would have almost estimated double in terms of time to deliver."
“At the end of our phase one, our greenfield, we ended up with about nine tickets. And to me, that was huge.”
Tony Spurlin (CISO, PlanSource)
The Value of Partnership
Throughout the engagement, both leaders repeatedly emphasized eGroup’s role in accelerating progress.
Spurlin described the partnership by saying:
"eGroup showed us what professional services are supposed to be like,"
adding:
“They were there every step of the way."
For PlanSource, the value extended beyond technical implementation. eGroup helped establish strategy, facilitate governance discussions, quantify risk, build adoption programs, and support operational execution.
Byrd highlighted the depth of expertise he received from the eGroup engineering team.
"Their subject matter expertise was on point. There were times where it just felt their resources were in the room with us right there over our shoulder. The communication was on point as well."
What impressed him most was the persistence when solving difficult challenges.
"When things looked like they couldn't be done,” explained Ernest, “that's when eGroup really showed up. They really worked with us."
The relationship created confidence that complex challenges could be solved quickly and correctly the first time.
Measurable Outcomes
Today, PlanSource has significantly enhanced visibility and control over sensitive information.
According to Spurlin:
"We received a whole host of benefits. We can now see where our data is moving. We can now encrypt our data. We now know when our data is going out and scan it appropriately. We are keeping it secure every step of the way now."
Byrd was again impressed by the ability to deliver results not just on Microsoft devices, but on Mac as well.
“Part of the goal was for parity between the Mac experience and the Windows experience. We wanted to make them a 90% match or better. And ultimately, we were able to accomplish that."
“When things looked like they couldn’t be done, that’s when eGroup really showed up.”
Tony Spurlin (CISO, PlanSource)
The organization also created governance structures that support future AI initiatives, strengthened employee awareness around data protection, and established a scalable foundation for ongoing modernization efforts.
"Our team grew tremendously in terms of knowledge," recalled Byrd, and "eGroup allowed us to go really quickly into operational delivery."
Perhaps most importantly, PlanSource transformed data security from a technology project into an enterprise-wide business discipline.
Implemented 100+ controls across approximately 120 security and governance use cases.
Completed Phase 1 with only nine support tickets and minimal user disruption.
Finished the project more than two weeks ahead of the original target date.
Advice for Other Organizations
For organizations beginning their own data governance or AI readiness journey, both leaders offered similar guidance.
Start with executive alignment. Define security principles early. Keep the initial approach practical. Invest in governance. Train relentlessly. Communicate constantly.
As Spurlin summarized,
"We brought everybody along on that entire journey."
Byrd offered a complementary lesson. Success comes from balancing protection with usability, creating enough control to reduce risk without introducing so much friction that users reject the solution.
The PlanSource story demonstrates that effective data governance is not achieved through technology alone. It requires leadership, education, operational discipline, a willingness to meet users where they are, and patience.
By combining Microsoft Purview, a pragmatic governance strategy, and eGroup’s framework, PlanSource built a scalable foundation for both security and AI while delivering meaningful business value and did so more quickly than expected.
"What more could I ask from a partner than that, right?" summarized CISO Spurlin.
“Our largest focus as an IT department and organization is our AI platform, and you all will be our partners in this.”
Tony Spurlin (CISO, PlanSource)
Strengthen Data Protection Before You Scale AI
PlanSource’s journey shows what can happen when data governance, Microsoft Purview, and employee adoption are addressed together. eGroup helps organizations assess sensitive data risk, define a DLP and labeling strategy, implement Purview controls, and build the governance and training needed to support secure AI adoption.
Whether you are starting with a Purview assessment or preparing for broader AI and data governance initiatives, eGroup can help you build the roadmap and move into implementation with confidence.
