How Structured IT Solutions Turned Browser Data Into Client Policy Decisions

Structured IT Solutions is a managed service provider based in Toronto, Ontario, serving small and medium businesses for the past 18 years. The firm runs 10 employees and roughly 50 managed clients across a wide range of industries, with a preference for construction and manufacturing.

Rob Slean, a consultant at the firm, works on the security stack it offers to those clients. Data loss prevention is what drove his most recent addition to it, and the question underneath it: what the people inside a client environment are doing with company data once they open a browser.

A stack with no answer for the browser, and clients who did not believe there was anything to find

Before Atakama, browser security at Structured IT Solutions was not a category the firm had tooling for. A DNS filter handled site-level blocking, and that was the extent of it.

Data loss prevention was what pushed the search forward. Microsoft and Google both ship data protection tooling inside their own suites, but Slean kept running into the same limit: there is still a gap in reaching those tools and those platforms. The browser was the natural next place to look.

Credential hygiene sat right alongside it. The team had spent years encouraging clients onto enterprise password managers and losing the argument to convenience.

Clients, meanwhile, were starting from the position that none of this applied to them. Their staff were doing everything right, so there was nothing to worry about. Structured IT Solutions had concern but not the evidence.

Make the risk visible first, then make it governable

Structured IT Solutions deployed Atakama, a browser security platform that installs a lightweight agent and browser extension, across its client base. Rollout ran through Kaseya VSA, the RMM for the firm already used, with permissions authorized on the Microsoft side in a few clicks. The one wrinkle was coordination with the other security tooling already in place.

The credential data arrived first, and it did the work the team had been trying to do with argument alone. Reused passwords and compromised credentials showed up as specific users on specific accounts rather than as a general warning about hygiene.

Structured IT Solutions enabled it internally before taking it to clients, and the findings did not spare the firm’s own team.

The data loss side produced the bigger surprise. Slean could see how much company data was moving to platforms nobody had authorized, usually driven by a small group of users rather than by widespread misuse, and usually with no intent behind it at all. Staff were sending material to a personal Gmail account because it was easier than the sanctioned route, without registering that anything was wrong.

AI tools fit the same pattern. Most of Slean’s clients have not rolled AI out across their staff, so any ChatGPT or Claude account in use is an individual one, with no way to tell from the outside whether it sits on a paid plan or a free one. Seeing the volume of data going into those accounts is what opens the conversation about making a tool official or restricting it.

Control followed visibility. Before Atakama, blocking large language models meant DNS and URL filtering on whatever firewall a client happened to run, which worked at scale but not at the level of individual people who genuinely needed access.

The firm also uses browser restriction to hold users to Chrome and Edge. Both are built into the standard device image and authenticate through Entra machine ID, so Microsoft conditional access policies apply cleanly. A user on an unmanaged browser gets treated as if they are on a non-corporate device, which is a support ticket waiting to happen. Restricting the browser removes the whole class of problem.

Evidence clients can see, policies grounded in real behavior, and no pushback from users

The most immediate change was in the client conversation. Clients who had assumed their staff were doing everything right could now see exactly what their staff were doing, with the MSP’s long-standing concerns attached to data rather than to opinion.

That changed what the firm could build. Instead of recommending policy in the abstract, Structured IT Solutions can scope controls to behavior it has actually observed in each environment.

User reaction was quieter than expected. A few people asked what the new login was, with an undercurrent of concern about being watched, and the firm addressed it by positioning the tool as what it is. Deployment starts with the default prompt to log in, which is subdued enough that users grow used to it, and enforcement follows later without much notice.

Slean is clear that the firm is early in all of this. Extension management is untouched so far, and the policy work is just beginning. The visibility alone has already justified the deployment.