Not every workload belongs in the public cloud. That much is now settled. After years of public cloud-first thinking, organizations are taking a more deliberate look at where their most critical workloads run. For many, the answer is private cloud; not as a fallback, but as a deliberate choice for workloads where security, control, and regulatory compliance are non-negotiable.
For insurers, that balance is particularly hard to get right.
Systems supporting policy issuance, claims processing, fraud detection, and regulatory reporting cannot fail or be breached. At the same time, those systems must adapt constantly as regulations shift and customer expectations rise. That is pushing many insurers to look hard at the foundations their business runs on.
HDI Sigorta is one of them.
A Business Where Downtime Is Not an Option
Operating across Türkiye with more than 4,000 agencies, HDI Sigorta runs its entire insurance operation on infrastructure that must be continuously available and secure. Today it has VMware Cloud Foundation (VCF running across its two data centers, with Istanbul as the primary site and Ankara as disaster recovery, supporting up to 100 million API calls per day across nearly 1,000 virtual servers.
Previously, HDI Sigorta had a VMware-based three tier infrastructure in its single data center in Ankara. It was stable, the team knew it well, and it was doing its job. But as the business grew, it started to show its limits.
Provisioning was slower than the organization needed. Scaling storage meant coordinating across teams. Lifecycle management was fragmented and largely manual. Disaster recovery depended on multiple third-party tools, adding complexity at exactly the moments when simplicity mattered most.
Strict data residency requirements under KVKK (Turkey’s personal data protection law) and SEDDK (the insurance and private pension regulation and supervision authority) ruled out public cloud for critical workloads, making full control over infrastructure and data a non-negotiable requirement.
“The insurance market is intensely competitive,” says Hakan Şatır, Chief Information Officer at HDI Sigorta. “Rules change daily. You must adapt software and hardware quickly. Flexibility at speed is the difference between winning and losing.”
Why VMware Cloud Foundation
HDI Sigorta’s move to VCF was driven by two distinct but connected imperatives: modernizing the infrastructure and modernizing the security model. Working with Bilgi Birikim Sistemleri (BBS), one of Türkiye’s most established IT infrastructure partners, the company built a new private cloud platform in a greenfield environment in Istanbul. HDI Sigorta ran a competitive proof-of-concept, and BBS won it on both the technical and commercial merits.
VCF brought compute, storage, networking, and management together into a single, software-defined platform. VMware vSAN replaced the traditional SAN storage layer, running on NVMe-based disks to deliver immediate performance gains. VCF Lifecycle Manager replaced fragmented, manual upgrade cycles with a single coordinated operation across the entire stack. Third-party disaster recovery tools were retired entirely, replaced by native VCF capabilities. VCF Operations was introduced to provide real-time visibility into performance, capacity, and resource utilization.
Security became an integral part of the platform rather than a layer added on top. Using VMware vDefend and its distributed firewall capability, HDI Sigorta implemented microsegmentation across the environment, enforcing a Zero Trust model at the workload level rather than relying on security solely at the perimeter. Traffic between workloads is now controlled and inspected regardless of physical network boundaries, significantly reducing lateral movement risk.
“Security is no longer applied at the perimeter and hoped for on the interior,” says Kazım Cesur, Architecture and Infrastructure Director at HDI Sigorta. “With vDefend used to strengthen security through advanced microsegmentation, we control what communicates with what, and that is a fundamentally better security posture.”
The Impact
HDI Sigorta reports VCF delivered measurable improvements across the business:
- Application performance improved significantly, with API response times decreasing by approximately 25-30% across an estate processing 100 million API calls per day.
- Virtual machine and service provisioning is more than 50% faster.
- Lifecycle upgrades reduced from close to an hour to approximately one minute.
- Recovery point and recovery time objectives dropped from hours to minutes.
- Full platform migration completed in approximately two months.
- Zero disruption to business users or customers during the migration.
“We are the trusted partner delivering the trusted infrastructure,” says Gokhan Aydın, CTO at BBS. “We were there from architecture through to handover, and we are still there. That is what a strategic partnership looks like in practice.”
What Comes Next
With VCF in place, HDI Sigorta is already planning the next phase of its platform evolution. VCF Automation will introduce self-service provisioning for application teams, with further plans focused on application modernization and strengthening the security layer further. HDI Sigorta has confirmed BBS will remain at the center of its long-term IT strategy.
“In this market, flexibility is everything. Government rules change every day. With VCF, we can adapt quickly, enabling us to rapidly deliver what the business needs on the service side fast. That is one of the real competitive advantages this platform gives us,” says Hakan Şatır.
