IT support answers for Northeast Florida businesses

• Check which printer is selected. Windows changes the default on its own, particularly after an update. Look at what is actually highlighted in the print dialog rather than assuming.
• Clear the queue. One stuck job blocks everything behind it. Open the printer from the taskbar, cancel all documents, then send a single test page.
• Power cycle the printer, not the computer. Off, thirty seconds, back on. Network printers lose their address more often than anyone admits.

One thing worth working out before you call: does it fail from every computer, or just one? If one computer cannot print and others can, the problem is that computer. If nobody can print, it is the printer or the network. Saying which saves us a step.

If you are a managed client, do not spend twenty minutes on this. Call us. That is what the agreement is for.

Two things to check before anyone spends money:

• Is it a spinning hard drive or an SSD? Open Task Manager, go to Performance, and look at the disk. If it says HDD and sits near 100 percent while the computer crawls, that is your answer. Replacing a mechanical drive with an SSD makes a five year old machine feel new for a fraction of the cost of replacing it.
• What starts with Windows? Task Manager, Startup tab. Years of installed software each adding themselves is a real cause, not a myth.

Two things that are usually not the answer, despite what people assume: the machine being "full of files", and needing a registry cleaner or optimization tool. Those tools range from useless to actively harmful, and we would ask you not to install one.

If it is slow only inside one application while everything else is fine, that is a different problem and points at the network, the server, or that application's database rather than the computer.

A machine that got slow suddenly, rather than gradually, is worth flagging. That can indicate a failing drive or an infection, and both want looking at rather than living with.

Three checks, in order:

• Is anything happening at all? Lights, fans, any noise. Nothing at all points at power: the cable, the outlet, the power strip, or the power supply. Try a different outlet directly rather than through a strip.
• Does it power on but show nothing? That is usually the monitor, the cable, or the input source rather than the computer. Check the monitor is on, check the cable at both ends, and check the monitor is on the right input.
• Hold the power button for ten seconds to force it fully off, wait, then start it again. On laptops, unplug and, if the battery is removable, take it out first. This clears a surprising number of stuck states.

What not to do: if there is any burning smell, or the machine is making a repeated clicking or grinding noise, stop and unplug it. Running it further can turn a recoverable situation into a data recovery job.

If there is work on that machine that exists nowhere else, say so when you call. It changes what we do first, because the priority becomes getting the data off before anything else is attempted.

A computer that will not start usually has a perfectly intact drive. The data is generally recoverable by connecting that drive to another machine, which is routine work rather than a specialist job.

What makes it harder or impossible:

• Continuing to run a failing drive. If it is clicking or the machine keeps freezing, every additional hour of power reduces what can be recovered. Turn it off.
• Someone reinstalling Windows to "fix" it. This is the single most common way recoverable data becomes unrecoverable. If a repair shop suggests it before recovering your files, say no.
• Drive encryption without the key. If BitLocker is on, which it increasingly is by default, the recovery key is required. It is usually in the Microsoft account the machine was set up with. Find it before handing the drive to anyone.

Physically damaged drives, meaning dropped, burned, or water damaged, are a different and considerably more expensive category handled in a clean room. We will tell you honestly when that is what you are facing rather than running up a bill first.

For business machines under our management, this rarely comes up, because the data is already backed up.

Send us the name, start date, what access they need, and who they are similar to. "Same as Dave" is the fastest possible description of a permission set and we mean that seriously.

What we set up: their account and mailbox, group membership and file access, multi factor authentication, the machine itself with your standard software, printers, shared drives, Outlook including any shared mailboxes, and phone setup if they need mail on a mobile.

The bottleneck is hardware. If they need a new machine and we do not have one on hand, that is ordering and configuration time, so a week of notice helps considerably. For clients who hire in groups or seasonally, we keep spares staged.

Two things worth building into your own process. Tell us at the same time you tell payroll, because that is the step nobody forgets. And tell us the leaving date at the same time for anyone temporary or seasonal, so access ends automatically rather than being remembered.

New user setup is covered by your agreement. Some providers bill per setup, which adds up quickly if you hire often, so it is worth asking anyone you are comparing.

The specification that serves most office staff well right now:

• Business line, not consumer. The business ranges from the major manufacturers cost somewhat more and are built differently: better warranty terms, onsite service options, no preinstalled consumer junk, consistent parts so we are not learning a new machine every time, and longer availability of the same model so your fleet stays uniform.
• 16 GB of memory. 8 GB is painful within two years with a browser and Teams open. The upgrade is cheap at purchase and expensive later.
• SSD, always. Nothing affects how fast a computer feels more than this.
• Three year warranty, with onsite if downtime hurts. Match it to how long you intend to keep the machine.

Where to spend more: anyone running design software, large spreadsheets, imaging, or a lot of video calls. Where not to: a machine used for email, documents, and a browser does not need a high end processor.

The false economy to avoid is the retail special. A consumer laptop bought on sale costs less on the day and more over three years in support time, early replacement, and the afternoon someone loses when it dies without an onsite warranty.

Both work and we genuinely do not mind which you choose.

Buying through us: the machine arrives configured, joined to your systems, with your software on it and ready for the user. Warranty claims come to us rather than you sitting in a manufacturer queue. It is one invoice and one relationship.

Buying direct: sometimes cheaper, particularly if you catch a deal or have an existing account with a supplier. We will give you the exact specification to buy and configure it when it arrives.

What we will not do is mark something up and tell you it is the only option. If a machine is cheaper direct from the manufacturer that week, we will say so.

The thing worth paying for either way is the warranty, and specifically onsite next business day where downtime matters. The difference in cost is small. The difference when a machine dies on a Tuesday morning is the whole day.

One practical note: buy the same model across the office where you can. A uniform fleet is faster to support, easier to keep patched, and means a spare machine actually fits anyone.

For managed clients we handle warranty claims start to finish: confirming the fault, establishing the machine is in warranty, dealing with the manufacturer, running whatever diagnostic they insist on, arranging the repair or replacement part, and fitting it.

The reason this is worth handing over is that manufacturer support is designed around a consumer with time. They will want you to run a hardware scan, reinstall a driver, and try safe mode before they will accept there is a fault, and that is forty minutes of your staff member's day, twice, because it rarely completes on the first call.

Three things that make claims go smoothly, all of which we track for managed clients: the serial number, the original purchase date, and knowing what level of warranty was actually bought. That last one surprises people, because a machine can be "under warranty" and still require you to ship it away for two weeks if onsite service was not purchased.

If a machine is out of warranty, we will tell you plainly whether repairing it makes sense. For an older machine, the repair frequently costs more than it is worth.

After a large update, Windows spends a while reindexing, recompiling, and reoptimizing in the background. On an older machine this can take an hour or more, during which everything feels slow. Restarting repeatedly during that window makes it take longer, not shorter.

So the first thing to try is leaving it alone. Let it sit powered on and idle for an hour, then restart once, cleanly.

If it is still slow the next day, that is a real problem rather than the update settling, and the usual causes are a driver that the update replaced with a generic version, particularly graphics or storage drivers, or an older machine that has genuinely run out of headroom for the current version of Windows.

If it happened across many machines at once, tell us rather than working around it. A bad update reaching your whole fleet is something we would want to catch and, where necessary, roll back. For managed clients this is the reason we test updates on a small group before releasing them more widely rather than letting Microsoft decide the schedule for you.

Support ended on 14 October 2025. Machines still running Windows 10 are no longer receiving security patches, which means newly discovered vulnerabilities on them stay open permanently. This is not a future problem.

It also has consequences beyond risk. Cyber insurance applications ask whether your systems are supported, and answering yes when they are not can affect a claim. Compliance frameworks treat unsupported operating systems as a finding. And software vendors progressively stop supporting their own products on it.

What we do, in order:

• Inventory. Which machines, running what, used by whom. Most businesses are not sure of the real number.
• Sort into upgradeable and not. Many machines meet the requirements for Windows 11 and can simply be upgraded at no hardware cost. Others do not, usually for processor or security chip reasons, and need replacing.
• Prioritize by exposure. A machine handling client data or reaching the internet daily matters more than one driving a label printer in a back room.
• Isolate what genuinely cannot move. Occasionally a machine must stay because it runs equipment that will not work otherwise. Those get segregated on the network rather than left in the open.

Paid extended security updates exist as a stopgap, but they cost money annually and buy time rather than solving anything.

We supply and install switches, or install one you already bought. Either is fine.

Three things that decide what you actually need:

• Port count, counted honestly. Every desk, printer, access point, camera, phone, and door controller. Then add a quarter for growth, because you will.
• Power over Ethernet budget. Access points, cameras, and most desk phones draw power from the switch. A switch with enough ports but not enough PoE wattage fails in a way that looks random and is miserable to diagnose.
• Managed or unmanaged. Unmanaged is cheaper and fine for a handful of desks. Once you want your payment traffic, cameras, or guest Wi-Fi separated from everything else, you need managed, and retrofitting that later means replacing the switch.

The unglamorous part matters too. A switch sitting on the floor of a closet with cables hanging off it will cause problems nobody traces back to it for a year. We mount and label as part of the install.

Most bad office Wi-Fi is a design problem, not an equipment problem. Adding a second consumer router to a network that already has one makes it worse, not better, because now two devices are arguing about the same channels.

What we do instead: look at your floor plan and what the walls are actually made of, place business access points where coverage needs to overlap properly, wire them back to the switch rather than meshing wirelessly where we can, and set channels and power deliberately instead of letting every device shout at full volume.

Before you call, two things that help us quote accurately: roughly how many square feet, and whether anything unusual is in the way. Concrete, brick, lead-lined imaging rooms, metal racking, and commercial kitchens all eat signal in ways drywall does not.

We work in UniFi for most clients, and we support other platforms on client equipment.

We size, supply, install, and then manage business firewalls. The management part is where most of the value sits, because a firewall is not a thing you install and forget.

Two things people get caught by:

• The subscription is not optional. The security features that make it a firewall rather than a router, meaning intrusion prevention, web filtering, and threat feeds, run on an annual license. When it lapses, the box keeps passing traffic and quietly stops protecting you. We track renewal dates so this does not happen to you.
• Size it for your internet speed, not your headcount. A firewall inspecting traffic has a throughput ceiling, and an undersized one becomes the reason your gigabit connection feels like 200 megabits.

If you are replacing one, tell us what runs through it now: VPN users, site to site tunnels, port forwards for cameras or a server, anything your line of business vendor required. Those are what break during a swap if nobody wrote them down.

Small jobs, meaning a few drops in an existing office, we do directly. Larger work, a full office fit-out or anything going through walls and ceilings at scale, we bring in a cabling contractor we work with and manage the job so you are not the one coordinating trades.

Two things worth deciding up front, because both are far cheaper now than later:

• Run more than you need. The cable is the cheap part. The labor and the ceiling tiles are the expensive part. Pulling two drops to a location costs barely more than one.
• Put drops where equipment will go, not just where desks are. Access points in ceilings, cameras at corners, a printer alcove, the conference room display. These get forgotten and then get solved badly with a long cable across the floor.

If you are signing a lease, get us in before you sign. What is already in the walls, and what the landlord will allow you to add, changes what a space actually costs to occupy.

A new office network is internet circuit, firewall, switching, wireless, cabling, phones, and printing, in that order of dependency. The part that determines your timeline is none of those: it is the internet circuit.

Fiber installs at a new address routinely take four to eight weeks and sometimes longer if construction is involved. Everything else can be done in days. We have watched businesses move into a beautiful new space and work off cellular hotspots for a month because nobody ordered a circuit until the keys were handed over.

So the sequence we recommend: order the circuit as soon as the lease is signed, or earlier if the landlord allows, then cable, then equipment, then a cutover scheduled outside business hours so your first day in the new space is a working day.

Bring us in during the site visit if you can. Checking what is already in the building, where the demarc is, and whether the ceiling is accessible takes half an hour and occasionally changes which space you pick.

The typical closet we walk into has equipment stacked on a shelf or the floor, unlabeled cables, a consumer power strip carrying everything, at least one device nobody can identify still powered on, and no ventilation.

What a cleanup actually involves: racking and mounting the equipment, replacing and labeling patch cables so every port maps to a known location, putting everything on a proper UPS so a flicker does not take down your server, identifying and either documenting or removing the unknown devices, and checking that the room is not cooking itself in summer.

The payoff is not tidiness. It is that the next problem takes twenty minutes instead of three hours, and that a cable getting nudged during a cleaning stops being a Monday morning outage.

Heat is the part people underestimate. A closet with no airflow in a Florida summer will shorten the life of everything in it, and the failures look random rather than environmental.

An office move is one of the few IT projects with a hard, immovable date, which is exactly why it goes wrong. Our rough timeline:

• Eight weeks out: order the internet circuit at the new address. This is the only step you genuinely cannot compress.
• Four weeks out: cabling and any electrical work, survey the new space, plan where equipment lives.
• Two weeks out: firewall, switching, and wireless installed and tested at the new site while the old one is still running.
• Move weekend: servers and workstations relocated, everything tested before Monday.
• First morning: somebody onsite, because there are always two or three surprises.

Two things that catch people out: phone number porting takes longer than anyone expects and should start early, and your alarm, credit card terminals, and any medical or industrial equipment usually need separate arrangements that nobody remembers until the week of.

Tell your current provider and your landlord your dates early. Cancelling a circuit is easy, un-cancelling one is not.

Businesses often ask for a site to site connection when what they actually want is for staff at both locations to reach the same files, the same email, and the same phone system. If everything lives in Microsoft 365 or a hosted server, you may not need the sites joined at all, which is cheaper and simpler.

You do need them properly connected when there is a server or line of business application at one site that the other site must reach, when printing or scanning has to cross sites, or when your software vendor requires it.

If you do need it, the usual answer is a site to site VPN between the firewalls, which requires compatible equipment at both ends and enough upload bandwidth at the site hosting the application. Upload is what people forget: a connection advertised as fast is often fast downstream and thin upstream, and your remote site experiences that as everything being slow.

Either way, both locations should be on the same identity, the same security standards, and the same support arrangement, so a user at either site is the same user.

The single router that came from your internet provider is designed for a house. A commercial space has more square footage, thicker walls, more devices competing, and neighbors whose networks are bleeding into yours.

Two things to check before you call:

• Where is the equipment physically? In a closet, behind a metal door, under a desk, or in a corner of the building means you are broadcasting through the worst possible path. Central and high is the rule.
• Is it one device or several? If somebody added a second router or a range extender to reach the back, that usually makes things worse. Extenders halve throughput and create a second network that devices cling to long after they should have switched.

The real fix is usually two or three business access points, wired back to the switch, with coverage designed to overlap. That is a half day of work and it solves a problem people have lived with for years.

If your building has concrete, brick, metal racking, or lead lined rooms, say so when you call. It changes the design substantially.

Two different causes that look identical to the person experiencing them.

There is no coverage back there. Signal falls off faster than people expect, especially through a wall with plumbing or electrical in it. Your laptop shows one bar and technically connects, which is worse than not connecting at all because applications hang rather than fail cleanly.

Or your device will not let go. Laptops and phones are stubborn about roaming. They cling to the access point they first connected to, even after walking well past a closer one. This is why the Wi-Fi is fine if you start your day in the back, and awful if you walk there from your desk.

A quick test that tells us which: turn Wi-Fi off and on again on your device once you are in the bad spot. If it becomes fine immediately, it is a roaming problem and it is fixable in configuration. If it is still bad, there is a coverage gap and you need an access point back there.

Both are solvable. Neither is solved by moving the router.

Three steps, in order:

• Establish the scope. Is it everybody, or one person? One person is a device or cable problem. Everybody is the circuit, the firewall, or the switch. Check whether phones are down too if they run over the internet, because that tells us a lot.
• Power cycle in order and wait. Modem or ONT first. Wait two full minutes, which feels far longer than it sounds, then the firewall, then the switch. Doing it in the wrong order or too fast is why this often does not work when people try it.
• Look for lights. If the modem never gets a solid connection light, the circuit is down and no amount of restarting anything inside your building will fix it.

Then call us rather than the provider. We can confirm whether it is truly the circuit before you spend forty minutes in a phone queue, and if it is, we deal with them on your behalf. Managed clients also have monitoring that usually tells us before anyone picks up the phone.

If your business genuinely cannot lose a day, ask us about a cellular failover connection. It is not expensive and it turns an outage into an inconvenience.

Two checks settle it almost every time.

The modem lights. Every modem or fiber box has an indicator for the connection to the provider, usually labeled something like online, internet, or WAN. If that light is off, red, or blinking rather than steady, the problem is upstream of you and nothing in your office will fix it.

The direct test. Plug one laptop straight into the modem with a cable, bypassing your firewall and switch entirely. If the internet works, your circuit is fine and something inside your network is at fault. If it still does not work, it is the provider. Put things back the way they were afterward, and do not leave a machine connected directly for longer than the test.

Worth knowing: providers will often insist the problem is your equipment, because from their end they can see the modem and it looks healthy. A circuit can be up but degraded, losing packets in a way that makes everything feel broken while every light stays green. Proving that takes specific testing, and it is one of the more useful things we do on your behalf.

A predictable time of day pattern is a useful clue, because it means something scheduled or behavioral is causing it rather than a fault.

The usual suspects:

• Backups or antivirus scans running during business hours. Extremely common, and easily the most fixable. These should run overnight, and on a lot of the environments we take over they are running at 1pm because that is when they were set up.
• Cloud file sync. Everybody arrives, opens their laptop, and OneDrive or Dropbox starts syncing at once. This bites hardest on connections with thin upload speed.
• Actual bandwidth saturation. More people working, video calls running, someone streaming. If your connection was sized three years ago and you have grown, you may simply have outgrown it.
• A database that has never been maintained. If the slowness is specifically your line of business application and it builds through the day, this is often it.

Worth checking yourself: does it get slow at the same time every day, or after a certain number of people arrive? Those two answers point in different directions and it is genuinely useful to know which before we look.

Three things before you call:

• Confirm your internet works. Open a website. It sounds obvious and it is the answer surprisingly often, particularly on hotel and coffee shop networks where you have not accepted their terms page yet.
• Try a different network. Your phone's hotspot is the fastest test. Many public, hotel, and some home ISP networks block the ports VPNs use. If it connects on the hotspot, the problem is the network you were on, not your laptop or our equipment.
• Restart the machine, properly. Not sleep and wake. VPN clients get into a stuck state that a genuine restart clears, and it takes two minutes.

If it fails on every network, or it fails for everyone at once, that is ours and we want to know immediately.

One thing worth asking anyway: if people are using a VPN mainly to reach files, there may no longer be a reason for it. A lot of businesses still run a VPN out of habit years after everything moved to Microsoft 365. Fewer moving parts is better.

We run UniFi networks day to day: switching, access points, gateways, and the controller behind them. If you already have UniFi equipment installed by someone else, we can usually adopt it into our management rather than starting over, which saves you the hardware cost.

Common things we get called about:

• A controller nobody has access to any more, because the person who set it up has gone
• Devices showing as disconnected or stuck adopting
• Firmware that has drifted badly out of date across a site
• Wireless that was never properly designed, just added to until it sort of worked

The controller access one is worth calling out. If your UniFi setup lives in a personal account belonging to a former employee or a previous IT provider, that is a real business risk and it is fixable. Sort it out before you need to change something urgently.

We support other platforms on client equipment too. UniFi is simply what we standardize on when the choice is ours.

We manage firewalls from the main business vendors, and we work on whatever you already have rather than insisting on a replacement.

What we usually find when we take one over:

• An expired subscription. The single most common finding. The device still passes traffic so nothing looks wrong, but the protection you are paying for has been off for months.
• Firmware years behind. Firewalls sit at the edge of your network, which makes unpatched ones a genuinely serious exposure rather than a housekeeping item.
• Rules nobody can explain. Port forwards opened for a camera system replaced two years ago, a rule added for a vendor who no longer works here. Each is a hole, and cleaning them up is careful work rather than a quick delete.
• Default or shared admin credentials. More common than you would hope.

If you do not know whether your subscription is current or who has admin access to your firewall, those are worth finding out this week, whether or not you call us.

The equipment your internet provider supplies is built to get you online cheaply. It is not built to protect a business, and it is worth being clear about what it does not do.

It generally cannot inspect traffic for threats, filter web content, separate your guest or camera network from everything else, give you usable logs when something goes wrong, or support remote access securely. It is also managed by your provider rather than by you, which means you often cannot change what you need to change.

Where the provider's router is genuinely fine: a very small office, everything in the cloud, no servers, no sensitive data, no compliance obligations, and nobody working remotely.

Where it is not: you take card payments, you hold health or financial records, you have staff connecting from outside, you have cameras or a server, or your cyber insurance application asks what firewall you run. That last one catches people, because answering it inaccurately can affect a claim.

A rough starting point rather than a rule: one business access point covers about 1,500 square feet of open office space well. Divided space with solid walls brings that down, sometimes considerably. A 5,000 square foot office is usually three or four, not one.

Three things that change the number more than square footage does:

• Construction. Drywall is forgiving. Concrete, brick, plaster with metal lath, and anything lead lined are not. One wall can cost you an entire room's coverage.
• Device count, not headcount. Everybody has a laptop and a phone, and a lot of businesses now have tablets, scanners, and payment terminals on wireless as well. Count devices.
• What people actually do. Video calls and large file transfers need far more than email and browsing, and a room where twelve people simultaneously join Teams calls is a different design problem from twelve people typing.

More access points is not automatically better. Too many, badly configured, interfere with each other and produce worse results than fewer placed properly. Placement and channel planning matter more than count.

This is the most common complaint we hear from businesses whose network is managed by their internet provider, and it is worth understanding why it happens, because the reason tells you whether it will ever get better.

The delay is structural. A carrier supports an enormous number of customers with a process designed to be consistent across all of them. That means your request enters a queue, gets worked by whoever reaches it, and is handled by someone who has never seen your site, does not know what that application is, and has no way to judge whether the change you are asking for is sensible or alarming. They are not being obstructive. They are following a process that cannot afford to make exceptions, because at their scale exceptions are how outages happen.

A local provider is not better at firewalls because of some technical advantage. It is faster because the person who picks up already knows what is behind that rule, remembers installing it, and can make a judgment call without escalating.

What to ask them, and get it in writing. We are not going to tell you what your provider's turnaround is, because that is theirs to state and yours to hold them to. Ask these five, and ask for the answers in the contract rather than from a salesperson:

• What is the committed turnaround for a firewall rule change that is stopping people working? Not an average, a commitment, and what happens when it is missed.
• Who will I actually speak to, and will they have seen my network before?
• Can we make an emergency change ourselves at six in the evening? Which really means: do we have administrative access to our own equipment, or do we have to ask?
• What happens outside business hours and at the weekend?
• Is there anyone who will come to the building?

For comparison, ours. A firewall change that is blocking people from working is a critical issue here, which carries our one hour response commitment. Standard requests are four business hours and low priority is next business day. Our hours are Monday to Friday, 8 AM to 5 PM Eastern, and after hours coverage is written into the agreement for businesses that need it rather than left as an informal favor. You should hold us to those numbers exactly as hard as you hold anyone else to theirs.

If their answers come back strong, that is useful information and you should weigh it. Our experience is that the question is rarely asked before signing, and the answer is rarely what people assumed.

People underestimate this because a firewall feels like something you set up once. In practice, at a business of twenty or thirty people, something needs a rule changed every few weeks. The list from an ordinary year:

• A new cloud application staff cannot reach. You bought it, everyone is signed up, and it does not connect from the office. Work stops for the people who were supposed to start using it today.
• A vendor needs a port opened for their equipment. The alarm company, the camera installer, the time clock, the payment terminal, the access control system. They are onsite, they are billing you for the visit, and they are standing there waiting.
• A device that sends data outside. Dental and veterinary imaging going to a lab or a specialist, a backup appliance replicating offsite, a monitoring system reporting in.
• A connection to a second location or a partner. New office, new warehouse, a client who requires a dedicated link.
• Content filtering blocking something legitimate. A supplier's portal, a bank, a government filing site, a training video. Someone needs it right now, not tomorrow.
• A copier that stopped scanning to email after the vendor updated it, which is a firewall and mail flow question combined.
• Guest Wi-Fi for an event, usually needed this afternoon.
• Someone traveling or working from home who needs to reach something inside the office.
• Blocking something urgently, during a security incident. There is a separate article on that one, because it is the version where hours genuinely cost you money.

None of these are complicated. Most are ten minutes of work for someone who knows the network. The question is never whether the change is hard, it is how long it sits before anyone looks at it, and whether the person who looks at it understands why you asked.

The practical test before you sign anything. Count how many of the items above happened to you in the last twelve months. If the answer is none, a carrier managed network may suit you perfectly well and there is an article in this knowledge base that says so. If the answer is six or eight, that is six or eight occasions a year where the turnaround commitment is the whole value of the service, and it is worth getting that number in writing before you commit.

Check these three before anyone calls anyone, because they take two minutes and they decide who you should be calling.

• Is it everyone or one person? If one machine cannot reach it and the machine next to it can, the firewall is almost certainly not your problem. Look at that computer, its browser, or that user's account instead.
• Does it work on a phone with Wi-Fi turned off? This is the single most useful test there is. A phone on cellular is not behind your firewall. If the application works there and fails on the office network, the problem is inside your building. If it fails on both, the problem is at the vendor and no firewall change will help.
• Check the vendor's status page. Takes ten seconds and regularly ends the conversation. If their service is down, everyone everywhere has the same issue.

If it is the firewall, what you need next is somebody who can change a rule quickly and who understands what they are being asked to allow.

What happens here. People unable to work is a critical issue, which means our one hour response commitment, Monday to Friday, 8 AM to 5 PM Eastern. In practice most of these are resolved on the first call, because the person you reach can open the firewall configuration while you are still on the phone and has usually seen your network before. If it needs the vendor's requirements, we will deal with the vendor directly rather than relaying technical details through your office manager.

What to expect elsewhere, and how to find out before you need to know. We are not going to characterize anyone else's response times. What we would say is that this is a bad moment to discover them. If your network is managed by your internet provider, find out now what the committed turnaround is for exactly this scenario, get it in writing, and find out whether you have administrative access to make the change yourself if their answer is not fast enough.

One thing worth doing in advance either way. When you buy a new application or sign up a new vendor, ask them for their network requirements and send them to whoever manages your firewall before the install date rather than on it. Most of these emergencies were scheduled weeks earlier and nobody told the person who needed to know.

This is the question underneath the complaint about slow changes, and it is worth separating from it, because the answer matters even when response times are good.

The principle: the business should always have a route to its own equipment. Not necessarily you personally clicking around in a firewall, which is how most self-inflicted outages happen. But there should be at least one party you can reach, at a time you can reach them, with the access and the competence to make a change. If the only route runs through a queue you cannot escalate, you have a single point of failure that has nothing to do with the hardware.

The questions to ask whoever manages your firewall, including us:

• Is the equipment registered to our organization or to yours? On cloud managed platforms like Meraki, devices belong to an organization in the vendor's dashboard. If that organization is your provider's, your gear is inside an account you do not control, and that has consequences well beyond change requests.
• Can we be given administrative access if we ask, and is there a charge? A reasonable provider will say yes. Watch for the answer that it is not possible, which usually means not possible for them rather than not technically possible.
• If we are not given access, who can act and when?
• Do we get a copy of the configuration and the documentation? This one is a good test of a provider generally.

What we do. You own your equipment and the account it lives in. If you want administrative access, you get it, at no charge, and we will tell you honestly which changes are safe to make yourself and which ones are how people take their own office offline on a Friday afternoon. The documentation is yours and you get a copy. If you leave us, you take all of it, and there is a separate article on exactly what that looks like.

Our strong preference is still that you call us rather than making changes yourself, not because of control but because an undocumented rule somebody added at 7pm is genuinely difficult to unpick two years later. The point is that the ability exists and the business is never stuck.

The shape of it, for a typical small business:

• Before anything moves: we confirm who owns your domain, decide licensing, and inventory what is actually in the old system. Shared mailboxes, distribution lists, calendars, and aliases are what get forgotten and then cause complaints in week two.
• The bulk copy: mail, calendars, and contacts copy across while everyone carries on working in the old system. Depending on volume this takes hours to a few days, and nobody notices it happening.
• Cutover: we change where your mail is delivered, usually in the evening. A final catch-up sync brings across anything that arrived during the copy.
• The next morning: Outlook reconfigured, phones reconnected, and somebody available for the inevitable three people whose setup is unusual.

Two things that decide how smooth it is. First, whether you control your own domain, because if it is registered to a former web designer or an old employee's personal account, that becomes step zero. Second, how much mail there is. Fifteen years of a 40 GB mailbox is a different job from a tidy 3 GB one.

Back up your new tenant from day one. Microsoft keeps your service running, it does not keep your data safe from deletion or ransomware.

Moving from a basic email host, a web host's bundled mail, or staff using personal Gmail accounts for work is one of the most common jobs we do, and it is a genuine upgrade rather than a lateral move.

What makes it awkward is rarely technical:

• Domain control. Your domain is frequently registered to whoever built your website years ago, sometimes to a former employee, occasionally to a company that no longer exists. Establishing control is step one and can take longer than the migration.
• Personal accounts holding business mail. If staff have been using their own Gmail for work, that mail legally sits in their personal account. Moving it requires their cooperation, which is straightforward now and impossible after a bad exit.
• Whatever else is on the old host. Old hosting often bundles mail with the website and sometimes a database. Cancelling the mail can take the website with it if nobody checks first.

The mail migration itself is routine. We copy it across, cut over in the evening, and reconnect everyone's devices the following morning.

This is one of the highest value projects a small business can do, and one of the easiest to do badly.

The mistake is treating it as a copy job. Most file servers have fifteen years of accumulated structure, folders nested nine deep, three versions of the same folder, and permissions nobody has reviewed since the person who set them up left. Copying that into SharePoint gives you the same mess with a new address, plus new problems, because SharePoint has path length limits and dislikes certain characters that Windows tolerates.

What we do instead: look at what is actually being used, agree a flatter structure, clean up permissions to match how the business is organized now, then migrate. The tidy-up is the work. The copy is the easy part.

Two things worth knowing before you start. Some line of business applications cannot use SharePoint for their data files and need to stay on a server or move to hosted, so check before assuming the server goes away entirely. And files that are constantly open by multiple people, particularly large Excel or Access files, behave differently in SharePoint than on a file share and need testing rather than assuming.

We set up, migrate, and manage Google Workspace as well as Microsoft 365, and we move businesses between them in both directions.

When Google to Microsoft makes sense: your line of business software expects Office files, your clients send you complex Excel and Word documents that need to survive round trips, you want desktop Office applications, or you are heading toward compliance work where the Microsoft security tooling is easier to evidence.

When Microsoft to Google makes sense: your team genuinely lives in Docs and Sheets, you want simpler administration, or your staff are largely on Chromebooks and phones rather than Windows desktops.

When staying put makes sense: most of the time. A migration costs money and disrupts people, and "the other one is better" is rarely worth it on its own. We will tell you when we think you should stay where you are.

The one thing that genuinely does not transfer cleanly in either direction is complex shared calendars and the permissions on them. Everything else moves well.

Plenty of businesses have one application that genuinely requires a Windows server, while everything else has moved to cloud services. Buying and housing a physical server for that one thing rarely makes sense any more.

A hosted server puts that workload somewhere properly run, with backup, patching, and monitoring included rather than depending on a box in your closet surviving a Florida summer. You stop replacing hardware every five years, and a power cut at your office stops being a server problem.

What to check before moving:

• Your software vendor's position. Most support hosted environments. A few have specific requirements or licensing implications, and it is better to ask them before than after.
• Your internet connection. The server is now at the other end of it. This is usually fine and occasionally is the deciding factor, particularly if your upload speed is thin or you have no failover.
• How your staff will reach it. Sometimes a published application, sometimes a full hosted desktop, and that choice affects both experience and cost.

We size it for what you actually use rather than copying your existing specification, which is frequently oversized because it was bought to last five years.

A hosted desktop means your staff log into a full Windows desktop that runs in a data center rather than on the machine in front of them. The local device becomes little more than a screen and keyboard.

Where they work well: multiple locations needing identical setups, heavy use of an application that is happier close to its database, staff who move between machines, high turnover where fast setup and shutoff matters, or compliance requirements where keeping data off local devices is valuable.

Where they work badly: anything needing serious graphics performance, businesses with unreliable internet, and heavy use of specialized peripherals, since scanners, signature pads, label printers, and imaging hardware are the usual friction points.

The honest tradeoff: your internet becomes the single point of failure for everything, rather than just for cloud services. When it goes down, nobody works at all rather than working locally in a degraded way. If we set them up, we will push hard for a failover connection, and that is not an upsell.

We work in Azure for hosted servers, identity, backup targets, and the pieces that genuinely benefit from it.

The thing worth saying plainly: Azure is frequently oversold to small businesses. A ten person company does not usually need a complex cloud architecture, and we have inherited environments running eye-watering monthly bills for resources that were spun up for a project years ago and never turned off.

Where it genuinely earns its cost for a business your size: hosting a server that must be Windows, identity and conditional access that you may already be paying for inside your Microsoft licensing, and sometimes backup or disaster recovery targets.

Where it usually does not: rebuilding things that work perfectly well as ordinary services, or any architecture that requires a specialist to change a setting.

If you already have Azure and nobody is sure what is running or why the bill is what it is, that review on its own is often worth the call. Unused resources are the single most common finding, and switching them off is free money.

SharePoint is included with most Microsoft 365 business licenses, which means nearly everyone has it and very few have set it up deliberately. The usual state is a default site nobody uses, files scattered across individual OneDrives, and a Teams channel that quietly became the real file server.

Setting it up properly means deciding a few things before touching anything:

• What belongs to the company versus an individual. Work files in personal OneDrive accounts leave when the person does, and that is the single most common cause of lost documents we see.
• Who should see what. Finance, HR, and client files usually need to be separated. Getting this right at the start is far easier than unpicking it later.
• How it maps to how you work. By department, by client, by project. There is no universal right answer, but there is a wrong one, which is replicating a folder tree that grew by accident over fifteen years.

We also set up sync properly so people get their files in File Explorer and never have to think about the web interface, which is the thing that makes staff accept it.

The usual symptoms: nobody knows where the current version of anything is, the same document exists in four places, people email attachments to each other rather than sharing links, files are sitting in the OneDrive of someone who left, and external sharing links were created years ago that nobody has reviewed.

How we untangle it:

• Find out what is actually in use. Usage data tells us which locations matter and which are abandoned, which stops the cleanup becoming a debate about opinions.
• Rescue orphaned content. Files belonging to departed staff get moved into company ownership before those accounts are removed. Do this before deleting accounts, not after.
• Audit external sharing. Almost every cleanup turns up links shared with people who are no longer clients, vendors, or employees. Some of them are years old.
• Agree one place for each thing, then actually move it. This is where the time goes, and it needs someone from your side who can make decisions.

The part we cannot do for you is decide what matters. The part you should not do yourself is the permissions and the migration.

For managed clients this is not really a task. A new starter signs into their machine and Outlook configures itself, along with their shared mailboxes, calendars, and signature. Nobody types a server name.

If you are not set up that way, we will do it, and while we are there the things worth doing properly:

• Shared mailboxes added correctly rather than as a second full account. Done the common wrong way, replies go out from the wrong address and sent items vanish into personal folders where nobody else can see them.
• Calendar permissions that match how you work. Most offices want colleagues to see free and busy but not the details, and the default is often not that.
• Signatures applied centrally so they are consistent and can be changed for everyone at once.
• Phones connected properly using modern authentication, so a lost phone can be cut off without changing anyone's password.

The shared mailbox one causes more day to day annoyance than anything else on this list, and it is a ten minute fix.

Signatures managed individually drift immediately. Within a year you have four font sizes, two logos, an old address, a phone number that changed, and at least one person with a quote at the bottom.

Applied centrally, the signature is added as mail leaves, which means it is identical for everyone, updates for the whole company in one change, and works from phones as well as desktops. That last point matters more than people expect, because mobile is where signatures usually fall apart.

Things worth deciding while we set it up: whether replies get the full signature or a shorter version, whether individuals can add anything of their own, and whether you want any disclaimer text. If you are in a regulated industry, this is also the mechanism for any required notice.

Small detail that matters: images in signatures should be hosted, not attached. Attached logos show up as paperclip attachments on every message you send, which looks unprofessional and irritates recipients whose mail clients flag them.

Permissions in most small businesses grew by exception. Somebody needed access to one folder, it was granted at whatever level was convenient, and nobody revisited it. Multiply by a decade and you get a structure where nobody can say with confidence who can see payroll.

What we do: map what access exists today, which is usually the first time anyone has seen it laid out, then rebuild it around groups rather than individuals. Groups are the key change, because then access follows the job. When someone moves from billing to operations, you change their group rather than hunting through folders.

What we need from you: decisions about who should see what. Finance, HR, client files, and anything legal usually need clear boundaries, and only you can draw them.

One thing we will raise: if a few long-serving people have accumulated access to everything, tidying that up can feel like a statement of distrust. It is not, and it is worth doing anyway. The reason is not your staff, it is that a compromised account should not be able to reach the entire business.

Teams gets switched on by default and then organizes itself, badly. The common end state is dozens of teams created by whoever needed one, files living in channels nobody can find later, and external guests from a project that finished two years ago still having access.

Setting it up deliberately means deciding:

• Who can create a team. Left open, you get a new one per project, per client, and per passing idea. Most small businesses are better with a small number of teams and channels within them.
• What lives in Teams versus SharePoint. They are the same storage underneath, which almost nobody realizes, and understanding that prevents half the confusion.
• How guests work. External access is genuinely useful and needs an expiry habit, otherwise former clients and contractors accumulate quietly.
• Chat retention. If you are in a regulated industry, this is a decision rather than a default.

Worth knowing: files shared in a private chat go into the sender's OneDrive, not into any team. When that person leaves, those files go with them. That surprises people every time.

A shared mailbox is the right answer for info@, sales@, billing@, support@, and anything else where several people need to see and reply to the same mail.

Two reasons to use one rather than the common workarounds:

• It does not need a license up to 50 GB, so you are not paying for an extra user to hold a role address.
• Replies come from the shared address and land in a shared sent items folder, so your colleagues can see what was already answered. Forwarding to everyone's personal inbox, which is the usual workaround, means three people answer the same customer and nobody knows what was said.

Things worth setting up at the same time: who has access, whether they can send as the address or only on behalf of it, and whether anyone should get a notification rather than having to remember to check.

One thing to avoid: converting a departed employee's mailbox into a shared mailbox and leaving it forever. It is a reasonable short-term step and a bad permanent filing system. Move what matters somewhere sensible within the first few months.

The default configuration of a Microsoft 365 tenant is built to work for everyone, which means it is permissive. The settings that matter most are not on by default and cost nothing to enable.

What we look at first:

• Multi factor authentication with no exceptions, and legacy authentication protocols disabled so it cannot be bypassed. An exception for one executive or one service account is where attackers get in.
• External auto-forwarding blocked. This is how a compromised mailbox quietly exfiltrates mail, and it is a single tenant-wide setting.
• Who holds administrative rights. Frequently more people than anyone expects, sometimes including a previous IT provider.
• Audit logging on and retained, because without it you cannot answer what happened after an incident.
• Sharing defaults, particularly whether anyone can create links that work for anyone on the internet.

Most of this is included in licensing you already pay for. When we do find something genuinely worth buying, we will say so and say why, but the first pass is usually about turning on what you own.

Three checks, in this order:

• Try webmail from your phone on cellular data. Not office Wi-Fi, cellular. If webmail works, your mail is fine and the problem is your computer or your office network. If webmail also fails, it is your account or the service.
• Ask a colleague. If everyone is affected, stop troubleshooting and call us. If it is only you, it is your account or your device.
• Check whether you were prompted for a password recently. A sudden password prompt that you clicked through, or a multi factor request you did not expect, matters and is worth mentioning when you call.

Take that last one seriously. If you received a multi factor prompt you did not trigger, someone has your password and is trying to get in. Do not approve it, and tell us the same day. This is the single most common way a business email compromise starts, and the prompt is your warning.

Otherwise the mundane causes are an expired password, a device that needs reauthenticating after a policy change, or a mailbox that has filled up.

Teams is sensitive to connection quality in a way that email and browsing are not. A connection that feels fine for everything else can be unusable for calls, because what matters is consistency rather than speed.

Two quick tests:

• Plug into a network cable. If calls are stable on a cable and drop on Wi-Fi, the problem is wireless, which is a fixable design issue rather than something wrong with Teams.
• Notice when it happens. If it is always mid-morning or always when several people are on calls at once, you are running out of upload bandwidth. Most business internet is advertised on download speed while calls are limited by upload.

Other things we check: whether a VPN is routing your call traffic the long way round, which is a very common cause and entirely avoidable; whether your firewall is inspecting call traffic it should be letting through; and whether the laptop is simply old enough that video is overwhelming it.

If it is only one person, start with their Wi-Fi and their machine. If it is everyone, it is the network and we should look.

Without turning this into a licensing lecture, the practical shape for a business under 300 users:

• Business Basic: email and web versions of Office. Fine for frontline staff who do not need desktop apps.
• Business Standard: adds the desktop Office applications. The default for most office staff.
• Business Premium: adds the security and device management pieces. This is the one most small businesses should be on, and the difference in cost is smaller than most people assume.

The Premium argument is straightforward: it includes device management, conditional access, and advanced threat protection that you would otherwise buy separately or, more commonly, go without. For a business handling client data or facing any compliance requirement, it is usually the cheapest way to get controls you actually need.

The other half of this question is what you are paying for now. Almost every tenant we review has licenses assigned to people who left, duplicate subscriptions bought at different times, or a mix of plans nobody planned. That review takes an hour and frequently pays for itself.

License drift is universal and nobody notices because the bill arrives monthly and looks roughly the same as last month.

What a review typically turns up:

• Licenses on departed staff. The mailbox was converted or left alone and the license was never removed. We have found businesses paying for a third more users than they employ.
• Duplicate or overlapping subscriptions bought at different times by different people, sometimes through different resellers.
• Standalone products already included in a plan you own. Paying separately for something bundled in Business Premium is common.
• Annual commitments nobody tracks, renewing silently on dates nobody has in a calendar.

Two practical notes. Annual-term licenses cannot be reduced mid-term, only at renewal, so timing the cleanup to your renewal date matters. And before removing any license, the associated data needs handling, because removing a license starts a deletion clock on that mailbox and its contents.

If you buy licensing through us it is one invoice and we track the renewal dates. If you buy direct, we will still do the review.

Email attachments fail above about 20 to 25 MB depending on both mail systems, and even when they work they create copies you no longer control.

The right method, which you already pay for:

• Right click the file in OneDrive or SharePoint and choose share
• Set the link for specific people rather than anyone with the link, when the content matters
• Set an expiry date, particularly for anything client related
• Send the link rather than the file

Why it is better: the recipient always gets the current version, you can revoke access later, and you can see that it was accessed. None of that is true of an attachment.

What to avoid: personal Dropbox, WeTransfer, or Google Drive accounts for company files. It works, which is why people do it, but the file is now outside anything you control or can revoke, and if it contains client data that may be a problem you have to explain later.

If your staff are routinely reaching for consumer tools, that usually means sharing has been locked down too far or never explained. Both are worth fixing, because people will always route around friction.

A sudden increase usually has one of a few causes:

• An address appeared in a data breach somewhere else and has been sold on. Role addresses such as info@ and sales@ get hit hardest because they are public by design.
• Your domain is being spoofed. If people tell you they received mail from you that you did not send, your domain is being impersonated, and SPF, DKIM, and DMARC records are the fix.
• Someone's mailbox is compromised. If spam appears to come from a colleague, treat it as urgent rather than annoying and call us the same day.
• Filtering was never really configured. The default protection in Microsoft 365 is decent and is frequently left at defaults that let far too much through.

What not to do: never use the unsubscribe link on mail you did not sign up for. It confirms your address is live and read by a person, which makes it more valuable, not less.

What to do instead: report it as phishing or junk using the button in Outlook rather than deleting it, because that trains the filter for your whole organization, not just your mailbox.

Same product, different name. Microsoft rebranded Office 365 to Microsoft 365 some years ago and most people still say Office 365, which is fine and we know what you mean.

What we do with it: migrations onto it, licensing so you are on the right plan and not paying for people who left, security configuration which is where most tenants are weakest, backup of your mail and files because Microsoft does not do that for you, and day to day support for the staff using it.

The most common reasons people call:

• Moving to it from an old email host
• Somebody cannot get into their mail
• Setting up SharePoint or Teams properly after it was switched on and never configured
• Working out which licenses they actually need
• After a security scare, wanting somebody to check the tenant over

If you have a tenant nobody has administered since it was set up, which is extremely common, a review on its own is worth the call. Dormant accounts, unused licenses, and missing security settings turn up nearly every time.

Microsoft's built-in protection is decent and it is not enough on its own, because the attacks that actually cost small businesses money are the ones that look completely legitimate: a real message from a real compromised supplier, with no attachment and no malicious link, asking you to update payment details.

We use Avanan, now branded Check Point Email Security, on top of Microsoft 365. The difference that matters is where it sits. Traditional filtering sits in front of your mail and inspects messages on the way in, which means it never sees internal mail. Avanan sits inside the mailbox, so it also catches messages sent from one compromised colleague to another, which is exactly how an attacker moves once they are in.

What it adds over the defaults: better detection of business email compromise and lookalike domains, account takeover detection based on behavior rather than just content, the ability to pull a malicious message back out of mailboxes after delivery, and protection for files shared through SharePoint and Teams rather than email alone.

None of it removes the need for the human control on payment changes. Verify by phone, to a number you already had, every time.

The classic version arrives as a short message, apparently from the owner, to whoever handles payments. Urgent, brief, often mentioning being in a meeting so a phone call is inconvenient. The address is either a lookalike domain or a free mail account with the right display name.

What actually reduces it:

• SPF, DKIM and DMARC configured properly. These make your domain substantially harder to forge outright, which pushes attackers to lookalike domains instead, and those are easier to spot.
• External sender marking. A clear banner on mail from outside your organization means a message claiming to be from an internal colleague, arriving from outside, is visibly wrong.
• Lookalike domain monitoring, so you know when somebody registers a domain one character off your own.
• Display name rules that flag external mail using the names of your executives.

The control that actually stops the loss is procedural though. Nobody changes payment details, sends a wire, or buys gift cards on the strength of an email, ever, regardless of who it appears to be from. Verify by phone to a number already on file.

Tell your staff explicitly that you will never ask for that by email, and that checking will never annoy you. The attack depends on people being reluctant to question the boss.

Managing computers is a specific set of things rather than a vague promise, so here is the actual list:

• Operating system and application patching on a tested schedule, not whenever Microsoft decides
• Next generation endpoint protection, monitored rather than just installed
• Health monitoring, so a failing drive or a machine running out of space is caught before it stops someone working
• Unlimited remote support for the people using them
• An inventory that stays current, including age, warranty status and what is on each machine
• Standard setup for new machines so every one is built the same way
• Secure disposal when they are retired

What changes for you: your staff have a number to call instead of asking whoever seems most technical, you stop being surprised by machines dying, and you get a replacement plan with numbers in it instead of unplanned purchases.

Pricing is per user rather than per machine, which matters if your staff have both a laptop and a desktop, since you are not charged twice for one person.

Network management covers the equipment most businesses only think about during an outage: the firewall, switches, access points, and the connection itself.

In practice that means firmware kept current, which matters most on the firewall since it sits at the edge of your network; configuration backed up so a failed device can be replaced in an hour instead of rebuilt from memory; monitoring that alerts us when something goes down or degrades rather than when someone calls; documentation of what is plugged in where; and dealing with your internet provider on your behalf.

The configuration backup point is the one people underestimate. When a firewall dies without one, somebody is rebuilding every rule, VPN, and port forward from scratch while your business waits. With one, it is a swap.

What we find on takeover, almost every time: firmware years out of date, no configuration backups anywhere, and rules nobody can explain. That first cleanup is usually where the immediate value sits.

Most businesses have a Microsoft 365 tenant that someone set up years ago and nobody has administered since. Managing it properly covers:

• Users and access. Joiners, leavers, group membership, shared mailboxes, permissions that reflect current roles.
• Security configuration. Multi factor authentication enforced, legacy authentication disabled, external forwarding blocked, admin rights limited to who needs them.
• Licensing. The right plans, no seats for people who left, renewal dates tracked.
• Monitoring. Alerts on the activity that indicates a compromised mailbox, which is the single most valuable thing on this list.
• Backup. Included in the per-user fee for managed clients, because Microsoft keeps the service running and does not protect your data from deletion or ransomware.

You keep ownership of the tenant throughout. We hold administrative access to manage it, which is not the same thing, and if you leave, it stays yours.

If nobody currently administers yours, a review is worth doing on its own. Dormant accounts, unused licenses, and missing security settings are near universal.

Server management covers patching on a schedule that accounts for your business hours rather than interrupting them, monitoring of the things that predict failure such as drive health, capacity, memory pressure and services stopping, backup with monthly restore testing, and the vendor coordination when your line of business application needs work done on its host.

Two things worth stating plainly.

Server backup is billed separately, per server, with up to 1 TB of storage included for each. It is not folded into the per-user fee because a business with no servers should not subsidize one with three. Separately billed does not mean optional, though. We will not take on a managed client whose servers have no working backup.

We will tell you when you no longer need it. Plenty of servers we inherit exist to share files, which Microsoft 365 does better and cheaper. If yours only exists for one application, hosting that somewhere else is often the better answer than replacing hardware every five years. We would rather advise that than manage a box you do not need.

Managed backup means someone is accountable for the restore working, not merely for the job completing. Those are different things and the gap between them is where businesses get destroyed.

What is covered: Microsoft 365 and Google Workspace backup, included in the per-user fee for managed clients, covering mail, calendars, contacts, OneDrive or Drive, SharePoint and Teams. Server backup is quoted separately per server with up to 1 TB of storage included for each. Everything we back up gets a test restore monthly, with results in your reporting.

Why the cloud part matters: Microsoft and Google keep the service running. They do not protect you from an employee deleting a folder, a ransomware event syncing to the cloud, or a mailbox emptied by an attacker. Retention and recycle bins are not backups, and finding that out during an incident is a bad day.

If you already have backups and just want to know whether they work, ask us to restore something. That question answers more than any report does, and the hesitation in a provider's response tells you the rest.

Security management for a business your size means layers that each catch what the previous one missed, plus somebody watching.

In the base agreement: multi factor authentication enforced, next generation endpoint protection, patching, firewall management, and email protection. Those are the floor and we do not sell them as an upgrade.

Above that: security log monitoring across workstations, servers, firewalls and Microsoft 365, with detections written for the things that actually indicate a compromise rather than generic noise. Mailbox rules created quietly, multi factor settings changed, shadow copies deleted, sign-ins from places you do not operate, administrative privilege granted unexpectedly.

We built and run that platform ourselves rather than reselling a vendor dashboard, which means detections can be written for your specific environment. It also means we are not passing your alerts to a third party to triage.

What we cannot do is make you immune. What we can do is shorten the gap between something happening and somebody noticing, which for most small businesses currently measures in months.

Patching sounds like the most boring thing an IT provider does and it prevents more incidents than anything else on the list. Most successful attacks use vulnerabilities that were fixed months earlier on machines that never received the fix.

How we handle it: updates released to a small pilot group first so a bad patch is caught on two machines rather than forty; scheduled outside your business hours, and outside your busy season entirely if you have one; applications patched as well as Windows, since browsers, PDF readers and Java are attacked at least as often; and compliance reported per machine rather than as an aggregate percentage that hides the three servers nobody touched.

That last detail is worth insisting on with any provider. A reported figure of 97 percent compliance sounds excellent and can mean your domain controller has not been patched since March.

Where a vendor forbids updating, which happens with imaging and industrial equipment, we document the exception and isolate that machine on the network rather than leaving it exposed and hoping.

Monitoring covers server and workstation health, disk space and drive failure prediction, backup job results, network devices and internet circuit, critical services, and security events.

The measure of whether it is worth anything is simple: how often do you find out about a problem from us rather than from an employee. For clients where it is working properly, most issues are resolved before anyone notices, and the visible result is that quiet months stop being luck.

Alerts reach us at any hour, which matters because things fail overnight. A backup that fails at 2am, a drive that starts throwing errors on Saturday, a circuit that drops at 4am, all get seen when they happen rather than on Monday when somebody cannot work.

What we will not do is forward you every alert to prove we are working. You hear from us when something needs a decision, needs money, or is something you would want to know about even though it is already handled. A provider who copies you on everything has moved the workload to you rather than taking it.

Vendor management means when something involves a third party, we open the ticket, provide the logs and diagnostics they ask for, stay on the call, and chase it. Your office manager stops being the person in a queue explaining a problem she did not cause.

The vendors this usually covers: your line of business software, internet provider, phone system, copier and print vendor, camera and access control, and any specialist equipment on your network.

The most valuable part is the argument. When a vendor says the problem is your network and we believe it is their software, we produce evidence rather than opinions and take it up their escalation chain. You should not be adjudicating a dispute between two technical vendors, and without someone doing this the default outcome is that you give up and live with the problem.

We also keep the list itself: what each vendor does, what it costs, who owns the relationship, and when it renews. That inventory alone frequently finds auto-renewals nobody remembers agreeing to and subscriptions for services you stopped using.

Most businesses that call us do not have an IT person. What they have is an office manager or an owner who has been holding it together, a folder of passwords, and a growing sense that this is not sustainable.

You do not need to prepare anything or tidy up first. We start with a conversation about what is not working, then a free assessment: a look at your network, systems, security posture and backups, and a written summary of what we found. You get that summary whether or not you hire us.

What that usually surfaces, and none of it is a criticism: nobody is certain whether backups work, there are accounts for people who left, multi factor authentication is missing somewhere it matters, and at least one thing the business depends on is running on hardware nobody has looked at in years.

The findings come sorted into fix now, budget this year, and when you get to it. Almost nobody does all of it at once and we do not expect you to.

The practical first step is a phone call. 904-204-6870.

We price on a floor plus per-user model. There is a monthly base that covers the infrastructure side of your business (servers, firewall, network, the tools we run) and a per-user amount that covers the people. That structure keeps small offices from paying enterprise minimums and keeps growing offices from getting a surprise bill.

Backup sits partly in each. Microsoft 365 and Google Workspace backup is included in the per-user amount. Server backup is a separate line, quoted per server, with up to 1 TB of backup storage included for each one. A business with no servers should not be paying toward somebody else's.

We do not publish a single number because a ten-person law office and a ten-person manufacturer are not the same job. We will give you a fixed monthly price in writing after a short assessment, and that price does not move because you had a bad month for tickets.

Included in every managed agreement:

• Unlimited remote help desk for your users
• Proactive monitoring and patch management on workstations and servers
• Next generation antivirus and endpoint protection
• Firewall management
• Microsoft 365 and Google Workspace administration
• Microsoft 365 and Google Workspace backup, with monthly test restores
• Network management and documentation

Billed separately: server backup, which is quoted per server and includes up to 1 TB of backup storage each; hardware and software you buy; one time projects such as a server replacement, an office move, or a migration; and third party subscriptions we pass through. All of those get a quote up front, not a surprise invoice.

Server backup is the one people are most often surprised by, so we say it plainly during the quote rather than leaving it in the fine print. It is a real cost with real storage behind it, and pretending otherwise just means the number changes later.

We do not use three year agreements. If we are doing our job you will not want to leave, and if we are not, a contract should not be what keeps you here. Give us 30 days notice and we will hand off cleanly.

Ask every provider you talk to what their term is and what the early termination penalty looks like. It is the single most common thing buyers regret not reading.

Onboarding is real work: deploying our tools to every machine, documenting your environment, standing up backups, reviewing security settings, and cleaning up whatever was left behind. We charge for it as a fixed fee project rather than burying it in the first few months of your monthly rate.

You will see that number before you sign anything. Be careful with providers who advertise free onboarding, because it is usually recovered somewhere less visible.

Add three people and you pay for three more users. Lose three and it comes back off. We true up rather than holding you to a headcount you no longer have. Seasonal businesses should tell us about the swing during the quote so we structure it correctly from day one.

If your business is down at 9pm, we are not starting a billing conversation. That is what the agreement is for.

Planned work that happens outside business hours because you asked for it to (a cutover on a Saturday so nobody loses a workday) is scheduled project work and is quoted in advance.

We publish both rates to our clients so nothing is ambiguous when a project comes up. Managed clients get the reduced project rate on planned work, and most projects are quoted as a fixed price anyway so you are approving a number, not an estimate.

Covered by the monthly fee, with no per incident charge: unlimited remote help desk, monitoring, patch management, endpoint protection, firewall management, Microsoft 365 or Google Workspace administration, Microsoft 365 and Google Workspace backup with monthly test restores, network management, new employee setup, and after hours emergencies. Onsite labor is covered for managed clients, with a flat trip charge per visit at every managed level.

Quoted separately and never buried: server backup, which is priced per server and includes up to 1 TB of backup storage each; hardware; software you purchase; third party subscriptions we pass through; and one time projects such as a server replacement, an office move, or a migration. Those are priced before work begins, usually as a fixed amount. Managed clients also get a lower project rate than our standard hourly rate, and both numbers appear in your proposal.

When you compare providers, the exclusions are where the difference hides. Look specifically for per incident onsite charges, new user setup fees, after hours surcharges, and language like "included up to a set number of hours per month." A cheaper base rate with those attached usually costs more by March.

We do not ask for a multi year term, so we do not need to offer a 90 day escape clause from one. If you are unhappy in month two, give us 30 days notice. We transfer your documentation, credentials, and administrative ownership on the way out, and there is no early termination fee.

We think that is a stronger commitment than a satisfaction guarantee bolted onto a three year contract, because it still applies in month fourteen and month thirty. A provider who has to keep earning the relationship every month behaves differently from one who has you signed for three years.

The one thing that is not refundable is the onboarding project fee. That work is real, and the results stay with you: documentation you own, security gaps closed, and a cleaned up environment that goes with you wherever you land.

When you evaluate other providers, read the termination clause before the pricing page. It tells you more about how they operate than the marketing does.

The same handful of things, at almost every business we take over:

• Licenses for people who left. Seats accumulate because nobody audits them. We have found businesses paying for a third more users than they employ.
• Overlapping tools. Backup running in three places, two antivirus products fighting each other, a security product that duplicates something already included in your Microsoft licensing and switched off.
• Reactive hardware. Emergency replacements cost more than planned ones and always land in your worst week.
• Consumer gear in a business. A cheap switch or access point gets bought three times and eats labor every time.
• A plan sized for a bigger company. Paying for capability that does not apply at your scale.

We look for all of it during the assessment, and the savings sometimes cover a real portion of the monthly fee. Every provider claims they will save you money. Ask them to name exactly where.

Anybody who has done this for years and says no is either new or not being straight with you. It happens on projects where something surfaces that could not be seen from outside: undocumented cabling, a system that turns out to be load bearing, a vendor dependency nobody mentioned.

Our rule is simple. If we misjudged the scope, that is ours to eat. If the scope genuinely changed or we found something new, we stop, tell you what we found, and give you a revised number before continuing. You do not get a surprise on the final invoice.

Ask any provider this question. How a company handles being wrong is something you will eventually need to know, and it is better to hear the answer before you hire them.

Bundled network and IT services are frequently sold on a multi-year term, and the term is usually the part that gets least attention during the sale because it is not the exciting bit. It is also the part you live with.

The four things to establish, in writing:

• The term. How many years, and does it start at signature or at installation, which can be months apart.
• The early termination charge. Often expressed as a percentage of the remaining monthly fees, which on a long term can be a substantial number. Get the formula, not a reassurance.
• The auto renewal clause and the notice window. This is the one that catches people. A contract that renews automatically unless you give notice in a specific window means you can decide to leave and still be locked in for another term because nobody diarized a date. Find the window and put it in a calendar on the day you sign.
• The price at renewal. Promotional pricing that steps up is normal and fine as long as you know the number. Ask what it becomes.

Two more worth asking: whether adding a location or users changes the pricing structure or restarts the term, which it sometimes does, and whether the agreement is tied to the circuit, so that leaving the managed service also means leaving the internet service or paying separately for it.

Ours, for comparison. Month to month, 30 days notice, no early termination charge and no auto renewal trap, because there is no term to renew. We think a provider should have to keep earning the work every month, and it also means an agreement signed by one owner does not bind the next one. If onboarding goes badly you are not stuck, and there is a separate article on that in this topic.

We are not going to pretend a term agreement is always wrong. A long term can buy a genuinely better price, and for a business with a stable network and a clear budget cycle that can be a sensible trade. The problem is not the term itself. It is signing one without knowing the exit number, and that is entirely avoidable by asking four questions before the pen comes out.

Backup is priced in two parts, because it protects two different things that cost very different amounts to protect.

• Microsoft 365 and Google Workspace data: included in the per-user fee for managed clients. Mail, files, SharePoint, OneDrive or Drive, and Teams data for every user on your agreement.
• Servers: quoted separately, per server, with up to 1 TB of backup storage included for each one. No servers means nothing on this line. Four servers means four lines.

We price it this way on purpose. Rolling server backup into a per-user rate means clients with no servers quietly subsidize the ones with several, and it buries what becomes a real cost the day you add a server. You should be able to see what you are paying for.

If a server outgrows its included terabyte, additional storage is quoted. You will hear about it at a review while there is still room, not after.

Hourly and monitoring-only clients do not get backup by default. It is available as a separate purchase and we recommend it, because the businesses that call us hourly are usually the ones with the least protection already in place.

Some businesses genuinely do not need a monthly agreement yet. A two or three person office running entirely in the cloud, with nothing that stops the business if it breaks for a day, is fine on an hourly basis. We work with clients like that and it is not a lesser relationship.

Where hourly stops making sense is the point where downtime costs real money, or where nobody at all is handling security. We would rather tell you that up front than sell you a plan you do not need and lose your trust three months later.

One thing to be clear about: backup is not included with hourly or monitoring-only arrangements. It can be purchased separately and we will quote it, but by default nobody is backing you up under those arrangements, and you should know that rather than assume otherwise.

Break-fix has an incentive problem built into it. Your provider earns only when something is wrong, which means nobody is patching, monitoring, verifying backups, or watching for a compromised mailbox in between. Those are precisely the tasks that prevent expensive events, and in an hourly relationship nobody is paying anyone to do them.

The second reason is financial shape rather than total. Hourly costs arrive in lumps and they arrive at bad times, because equipment fails when it is working hardest. A server dying in your busiest week is a large invoice on your worst possible week. A monthly fee is a smaller, predictable number you can plan around.

The honest counterargument: if your business can lose a day without much harm, and you already have tested backups and multi factor authentication in place, hourly is defensible. If that describes you, we will say so.

Note the condition in that sentence. Backup is not included in an hourly arrangement, so unless you have bought it separately or set it up yourself, that counterargument does not apply to you.

We quote hourly rates openly, including to people who are not going to sign an agreement. Before you compare providers on the rate alone, understand what surrounds it: nearly every hourly rate has a minimum attached, and travel is handled differently at every company. Ours carries a one hour minimum, a longer minimum for locations well outside Jacksonville, and a higher emergency rate for after hours work that is not covered by an agreement.

For comparison, managed clients pay no hourly labor for onsite support at all, and get a reduced rate on project work. For a business that calls more than a few times a year, that gap is usually what decides it.

We would rather say this plainly now than have you discover it during an outage. Clients with agreements have response times we are contractually obligated to meet, and their monitoring alerts reach us automatically whether or not anyone has called. Hourly work is scheduled around those commitments.

In practice that usually means same day or next day rather than within the hour, and after hours emergency coverage is not guaranteed at all without an agreement.

Any provider who tells you their hourly clients receive identical priority to their contract clients is either not being straight with you, or is not honoring the agreements they have signed. Neither is reassuring.

Plenty of relationships start with one project or a handful of service calls. If you move to an agreement later, we do not charge you again for discovery and documentation already completed. The onboarding fee is adjusted for whatever is already in place.

Starting hourly is a reasonable way to see how we actually work before committing to anything. Since our agreements are month to month regardless, the commitment is modest in either direction.

Do this before you talk to any provider, including us. Pull last year's IT invoices, then add:

• Hours you personally spent on computer problems, valued at what your time is actually worth
• Hours your staff spent, especially whoever has quietly become the unofficial IT person
• Any time the business could not operate, at what an hour of downtime costs you
• Anything you have been putting off because you did not know who to call

Most owners are surprised by the result, because the invoices turn out to be the smallest line. The time is the expensive part and it never shows up on a bill.

Then ask what an agreement would cost. If the numbers do not justify it, we will tell you so. We would rather have an hourly client who trusts us than a managed client who resents the invoice every month.

Response targets are tiered by how badly it hurts:

• Critical, business down: one hour. Server offline, no internet, email down company wide, suspected security incident.
• Standard: four business hours. One user cannot work, a printer is down, an application is misbehaving.
• Low priority: next business day. New user setup, software requests, questions.

Those targets are in the agreement, not just on a website.

We are small enough that the person who picks up your call has probably been in your building. Day to day tickets are handled by our help desk, and your account has a primary technician who knows your setup and sits in on your reviews.

The tradeoff of a very large provider is depth of bench. The tradeoff of a very small one is coverage. We staff so that at least two people know your environment well, which is the answer to the next question.

Everything we manage for you lives in our documentation system: network layout, credentials, vendor contacts, how your line of business application is configured, what we did last time. That is deliberate. Knowledge that only lives in one technician's head is a risk to you, not just to us.

Our phone system routes after hours calls to on call staff, and monitoring alerts reach us around the clock whether or not anyone at your office noticed the problem. A failed backup at 2am gets seen at 2am.

Most issues get resolved remotely because that is faster for you. When something needs hands, we drive. Managed clients do not pay hourly labor for onsite visits under their agreement, only a flat trip charge per visit, and that is the same at every managed level.

We are based in Jacksonville and cover the surrounding area including St. Augustine, Green Cove Springs, Orange Park, and southeast Georgia.

Your staff can call, send an email that opens a ticket automatically, or click the support icon we install on their machines. There is no portal login to remember, and there is no phone tree designed to make you give up.

Most issues are resolved by the help desk. When something exceeds that, it moves to a senior technician, and the handoff is triggered by the ticket's age and severity rather than by someone eventually admitting they are stuck. That distinction matters, because the failure mode at a lot of providers is a junior tech quietly holding a ticket for four days.

You can also escalate it yourself. Say so and it moves. You should not have to be diplomatic about something that has been open too long.

Worth asking any provider: what is the longest a ticket can sit before somebody senior looks at it, and who makes that call.

Send us the name, the start date, what they need access to, and who they are similar to. "Same as Dave" is genuinely the fastest way to describe a permission set. The account, mailbox, permissions, and machine will be ready.

Hardware is the long pole. If the new hire needs a computer we do not have on hand, that is ordering and configuration time, so a week of notice helps. For clients who hire in bursts we keep a spare machine or two staged.

New user setup is covered by your agreement. Some providers bill per setup, which gets expensive fast if you hire seasonally, so ask specifically.

If your technician is unresponsive, something was handled badly, or you simply feel you are not getting what you pay for, that conversation goes to the owner rather than to the person you are unhappy with.

We are small enough that this is a real answer rather than a suggestion box. You will have the owner's direct contact from the first week, and using it does not make things weird afterward.

With larger providers, ask who specifically owns your relationship and whether that person has the authority to change anything. An account manager who can only apologize is not an escalation path.

Response performance is measured and reported to you, which means a miss shows up in your numbers whether or not anybody mentions it. That is the first and most important part, because at most providers you would never know.

A single miss gets an explanation. A pattern is a service credit conversation and a staffing conversation, and we would rather have both than have you quietly start shopping.

The structural protection is stronger than a credit anyway. Your agreement is month to month with 30 days notice, so you are never stuck waiting out a term while performance slides. A credit on a contract you cannot leave is not much of a remedy.

Ask other providers two things: how they define a response, and whether they will show you their misses or only their averages.

Offboarding is the part of the process most businesses handle badly, and it is usually not a technical failure. It is that nobody told IT for a week.

When you tell us, we disable the account, revoke active sessions and tokens rather than only changing the password, remove access to cloud services, wipe or remove company data from any enrolled mobile device, deal with the mailbox according to what you need retained, and free the license so you are not paying for someone who left in March. That is minutes of work, not a project.

For a planned departure, tell us the date and time in advance and we schedule it to the minute so access ends exactly when employment does. For a difficult departure, tell us before the conversation happens rather than after, and we will be ready to act while it is taking place.

Build the habit of telling us as part of the same routine that handles their final paycheck. The accounts we find still active at takeover belong to people who left years ago, and every one of them started with a good process that nobody triggered.

Every provider publishes a response time. Far fewer will tell you what the words mean or what actually happens in the first hour, so here it is.

What counts as business down. This is the definition that matters, because it decides which commitment your emergency falls under. We treat it as business down when a system that stops people working is unavailable: the internet is out, the server is down, nobody can reach email, the line of business software will not load for anyone, a location is offline, or a security incident is in progress. It is about impact rather than about which device broke. One person with a dead laptop is a standard issue even though it is a disaster for that person. The whole front desk unable to take payments is business down even if the cause turns out to be small.

If you are not sure which one you have, call it in as business down and let us sort out the classification. We would rather downgrade it than find out at four o'clock that you had been waiting politely since nine.

The first hour, in order:

• First contact within 15 minutes, for clients on a managed agreement. A person, not an automated acknowledgment. The point of that call is to establish scope quickly: who is affected, when it started, what changed. Break-fix and hourly callers get a real effort rather than a commitment, and contract clients come first when both land at once.
• Work underway within the hour. That is our commitment for anything business down. In practice remote work usually starts on the first call, because the person you reach can get into your environment while you are still on the phone.
• Onsite within one to two hours if it needs hands, for clients on a managed agreement. Most of the time it is inside an hour. There is a separate article on onsite response with the detail.
• Updates on a schedule, not on request. You should not have to chase us for news during an outage. For anything extended, you get a named point of contact and updates at an agreed interval, even when the update is that we do not know yet.

Three things worth doing on your side while you wait, because they genuinely shorten the call:

• Establish who is affected. Everyone, one department, or one person. This single answer eliminates most of the possible causes.
• Check whether it works on a phone with Wi-Fi turned off. A phone on cellular is outside your network. If it works there, the problem is in your building.
• Find out whether anything changed. A power cut overnight, a vendor onsite yesterday, a software update, somebody moving furniture. The honest answer is often yes and nobody connects it.

Afterward. A business down event gets a root cause analysis rather than just a closed ticket, so you find out why it happened and what changes to stop it happening again. That is covered in its own article in the Beyond break-fix topic.

A straight answer, because this question usually gets a vague one.

Managed agreement clients, critical system outage: onsite within one to two hours, depending how far you are from us. In practice most of our clients see somebody inside an hour. We are at 4237 Salisbury Road in Jacksonville, so the drive is shorter for Jacksonville and Orange Park than it is for St. Augustine, Green Cove Springs or Fernandina Beach, and the commitment reflects that honestly rather than quoting one number we could not hit everywhere.

Break-fix and hourly clients: best effort. We will come, and we will get there as soon as we can, and we are not going to pretend that is a commitment. Contract clients come first when both need us at the same time. That is the arrangement they are paying for and we think being clear about it up front is better than discovering it during an outage. If guaranteed onsite response matters to your business, that is one of the better reasons to be on an agreement rather than hourly, and there is a whole topic in this knowledge base on that decision.

Two things worth understanding about onsite, though.

First, the fastest fix is usually remote. Driving to you takes an hour that somebody could have spent fixing the problem. We start remotely while the drive is being arranged, and a fair number of apparent onsite jobs are resolved before anyone arrives. That is a better outcome than a prompt arrival, not a worse one.

Second, onsite labor is covered by your agreement. Managed clients do not pay hourly labor for a visit, only a flat trip charge, so you are never weighing up whether a problem is worth the clock running. We would rather come and look at something than have you talk yourself out of asking.

For scheduled work rather than emergencies, visits are planned around your week rather than squeezed in. Managed clients in the outer counties get scheduled onsite time as part of the agreement so that the routine work is not all done remotely, and there is an article about that in the Nassau County topic.

What we cannot do is be in two places at once, and on the rare day when two clients are down simultaneously, somebody waits. When that is you, you will be told it is happening and roughly how long, rather than left to wonder. We have six people, which is enough to cover a bad morning and not enough to pretend otherwise.

This is one of the questions worth asking every provider you talk to, and one most of them answer vaguely. Here is ours plainly.

Everything you experience as support is our own people. The person who answers the phone, the technician who works your ticket, the senior engineer it escalates to, the one who comes to your office, and the one who picks up after hours. All employees, all here in Jacksonville. There is no white-labeled help desk behind us, no overflow queue, and nobody reading from a script who has never seen your network.

The one exception, stated clearly. Security monitoring runs around the clock, and a team of our size cannot have a human watching a screen at three in the morning every night of the year. So the monitoring platform is ours, running in house, holding your data, with the rules and the tuning done by us. The around-the-clock analyst watch on top of it is a security operations center partner.

What matters about how that is arranged:

• You never talk to them and they never contact you. If something fires at 3am, it reaches our on-call person, and our on-call person contacts you. One phone number, one relationship, one company accountable.
• The platform and the data stay ours. We are not reselling somebody else's service with our logo on it. The logs come into our system, we built the detections, and we can tell you exactly what is being watched and why.
• We would rather tell you this than let you assume. Plenty of providers run the same arrangement and describe it as their own 24/7 security team. It is a reasonable model. It just should not be a surprise to you later.

Why we do not outsource the help desk, since that is the part this question is usually really about. The value of a small local provider is that the person picking up has been in your building and knows that the machine in question runs your practice software. Hand that to an overflow desk and you have the response time of a small provider with the context of a large one, which is the worst of both. We would rather be honest about capacity than quietly paper over it.

What to ask anyone else: are the people answering my calls your own employees, do you use a NOC or SOC and would I ever speak to them directly, is any part of this offshore, and who is accountable when something falls between you and a partner. The answers vary enormously and they are rarely volunteered.

The honest mechanics, because this is the part of a service agreement people only test on the worst night of the year.

How the rotation works. One of our technicians carries the after hours phone on a rotating schedule, and there is a named backup behind them. If the person on call does not pick up, it goes to the backup rather than to voicemail. They are our employees, they have your documentation in front of them, and in a company our size they have very likely worked on your systems in daylight.

What reaches them without anyone calling. Monitoring alerts come through regardless of whether anybody at your office noticed. A server that stops responding, a failed backup, a circuit that drops at 2am. Security alerts from our monitoring platform reach the on-call person the same way, through our security operations center partner, who escalate to us rather than to you.

What counts as an after hours emergency. Business down, essentially: a server or circuit down, nobody able to reach email, a location offline, a line of business system unavailable, or a suspected security incident. There is an article in this topic that defines business down properly. For managed clients that is covered by the agreement rather than being a billing conversation at 9pm, and there is an article on that in Pricing.

A password reset at 11pm is not an emergency. Call it in, it gets handled in the morning, and nobody will be short with you about it.

The honest limitation. We are six people. That is a rotation with a backup, not a staffed overnight desk with someone sitting at a console waiting. On a quiet night, nobody is awake. The phone wakes somebody up, and the commitment is that it is one of us and that we answer. That arrangement covers an enormous amount of what small businesses actually need at night, and it genuinely is not the same thing as a 24-hour manned operations center.

If your business truly requires a staffed overnight desk, a hospital or a round the clock operation where somebody is working at 3am every night, say so when we talk. We will tell you honestly whether what we have fits, and if it does not we will say that rather than sell you something and hope.

One thing to agree in advance, whoever your provider is: who at your company we are allowed to wake up. If we see something at 2am that needs a decision, it helps a great deal to already know whose phone to ring and who can authorize us to take a system offline.

Our clients are mostly Northeast Florida businesses between roughly 5 and 100 employees: professional services, medical and dental practices, construction and trades, manufacturing, nonprofits, and local government adjacent organizations.

If you are a 500 seat enterprise with an internal IT department, we will tell you honestly that you want a different kind of partner.

Every industry has that one application everything depends on: the practice management system, the estimating software, the case management platform. We do not pretend to be the developer of it. What we do is keep the server, workstations, network, and backups underneath it healthy, and deal with that vendor's support on your behalf so your office manager is not the one sitting on hold.

We will try to give you references that look like you: similar size, similar industry, ideally someone who switched to us from another provider so you can hear what the transition was actually like.

A lot of the IT providers in this market have been bought by private equity backed groups over the last few years. What usually follows is the local team getting thinner, support moving to a call center somewhere else, and prices being adjusted to hit someone else's targets.

We are independent. The owner answers the phone and is reachable by clients directly.

• Nobody in house is really an IT person. An office manager or the owner has been holding things together until something stopped working.
• Something broke expensively. Extended downtime, a ransomware event, or a compromised email account that cost real money.
• They outgrew what they had. The setup that worked at eight people does not work at twenty five.

If one of those sounds like you, the conversation is usually short and productive.

This comes up when a business is big enough to justify someone in house but not a whole department. A typical split: your person handles new hire setup, tablets and truck inventory, password resets, and the small daily requests. We handle security monitoring, patching, backups, the server and network, vendor escalation, projects, and coverage for nights, weekends, and vacations.

It works when the boundaries are written down and both sides have the same information. Your person gets access to our documentation and the tools we run, so they are not working blind, and we agree on exactly what gets handed to us and when. Without that, co-managed quietly becomes two parties each assuming the other handled it.

It also protects you from the single point of failure problem. Your IT person can take a vacation, and if they leave, the documentation and the tooling stay.

In most of the businesses we work with, the office manager is the person who actually deals with us. Often that is the owner's spouse. They open tickets, approve routine work, and get direct answers without relaying everything through the owner, which is the whole point of handing it off.

You set the boundary. The usual arrangement is that the office manager approves anything routine, and anything above an agreed dollar amount comes to the owner. We follow whatever you tell us, and we will not quietly route around your office manager to get a faster yes.

We also do not steamroll how they work. If someone's process is unusual but functioning, it stays unless there is a security or reliability reason to change it, and then we explain the reason to them rather than over their head.

Rebooting is a legitimate first step and a terrible ceiling. Firewalls, VLANs, routing, wireless design, and VPNs are routine work here rather than a rare event we outsource.

It shows up in specific places: separating payment or camera traffic from your office network, designing wireless coverage for a shop or warehouse instead of adding another access point and hoping, and chasing an intermittent circuit problem with the ISP so you are not the one sitting on that call with a ticket number.

Test this rather than take our word for it. Describe a networking problem you have actually had and see whether the response is specific or generic. That one question separates providers faster than anything else on this page.

We work with businesses from a handful of people up through multi-office organizations with internal IT staff. Somewhere above that there is a size where a dedicated internal department genuinely serves you better, and we will say so rather than take the engagement and struggle.

The questions that actually tell you whether a provider can carry you: what is their largest client by headcount, what is their largest by number of locations, how many technical staff do they employ as opposed to total staff, and what happens when two of your sites have problems simultaneously.

Ask for a reference at your size specifically. A provider whose entire client base is ten-person offices will learn on you, and you will pay for that education.

Some businesses want a face in the building. Staff walk up to a person rather than opening a ticket, and for a multi-office organization with a busy front office that is worth real money in productivity even when the underlying work could be done remotely.

We can staff that: a technician onsite on a set schedule, up to full time, backed by our help desk, our security monitoring, and our senior engineers. You get the presence of an internal hire plus a team behind them, which is the combination a single internal employee cannot give you.

It costs more than a fully remote arrangement, and it should. What it replaces is a salary plus benefits plus the coverage gap when that person is sick, on vacation, or asleep.

The other direction works too. If your staff are comfortable with remote support, we deliver it that way and come onsite on a schedule instead, which is less expensive and for many organizations just as effective.

The person who was the right hire at twenty employees is often underwater at eighty, through no fault of their own. One person cannot cover a help desk, security, servers, network, vendor management, projects, and multiple locations. What that looks like from your chair is someone who has stopped being responsive, and it is genuinely hard to tell apart from someone who has checked out.

If it is capacity, co-managed usually works well. Your person keeps the things that benefit from being in the building and knowing your business, and we take the specialized and after hours load off them. Most people in that position are relieved rather than threatened, because they have been drowning quietly.

If it is capability or engagement, that is a management decision, not a technology one. We can take over fully, and we can do it in a way that does not depend on that person's cooperation.

What usually settles it is the assessment: whether the undone work is the specialized kind nobody could reasonably cover alone, or the basic kind that should have been happening all along.

Worth setting out fairly, because a carrier managed network is a legitimate product and plenty of businesses are content with one. These are the structural differences, and you should check each of them against whatever you are being offered rather than taking our word for it.

• Who answers. A queue staffed by whoever is available, versus a small team who have been to your office. Neither is inherently better at firewalls. One of them knows that the rule you are asking about is for the imaging machine in room three.
• Context. This is the one that costs the most time. Explaining your environment from scratch on every call, to a different person, adds more delay in practice than the queue does. It also means nobody is in a position to notice that the thing you are asking for this week contradicts what was set up last month.
• Onsite. Carriers will generally roll a truck for their circuit. Whether anyone will come and look at a switch, trace a cable, or help the office manager with a device that will not join the network is a separate question, and the answer is frequently no. Ask it directly.
• Scope boundaries. The network is managed. Your computers, your Microsoft 365, your email, your backup, your printers and your line of business software are not. When something sits on the boundary, and a surprising amount does, you are the one holding both ends.
• Escalation. Ask what happens when the first answer is wrong, how you escalate, and whether there is anyone you can call by name.

What is genuinely good about the carrier model, because this should be said: the monitoring is real and runs around the clock, the hardware is enterprise grade, patching gets done without you thinking about it, and there is one bill. For a business whose network rarely changes, that is a reasonable package and the criticisms above may never affect you.

What we would actually suggest, rather than a straight either or. Plenty of businesses keep their circuit with their provider, which is where the carrier genuinely belongs, and have the network equipment and everything behind it managed by somebody local. You get the circuit SLA from the people who own the fiber and a response time on everything else from people who know your building. There is an article in this knowledge base about working alongside a provider you have already signed with.

If you have a term agreement for a managed network, you are not stuck with nothing until it expires, and you should not feel you have to justify the decision to us. Carrier managed networks get bought for sensible reasons and the hardware is generally good.

What we cover alongside it: your computers, your Microsoft 365 or Google environment, email security, backup, your line of business software, printers and copiers, phones, the user support that your staff actually generate day to day, security awareness training, documentation, and the planning and budgeting side. That is the large majority of what an office experiences as IT, and almost none of it is in a managed network contract.

What we do about the boundary, which is the part that needs attention in a split arrangement:

• We talk to your provider so you do not have to. With your authorization on the account, we raise the tickets, provide the technical detail, and chase. Your office manager relaying packet details between two companies is how these arrangements go wrong.
• We document what they manage as well as what we manage, so there is one picture of your environment rather than two partial ones.
• We agree the incident plan in advance. Who declares, who can authorize a containment change, how everyone reaches each other out of hours. This genuinely matters and almost nobody has it written down.
• We will tell you when something is their problem rather than quietly absorbing it, because you are paying them for it.

And when the term ends, you have a real choice rather than an automatic renewal. Tell us three to six months out and we will price the alternative properly, tell you what the equipment situation is, and lay out the honest tradeoff. Sometimes the answer is to renew, particularly for a multi-site business that values the circuit and the network coming from one place. Our job is to make it a decision rather than something that happens to you.

One practical note: find your renewal date and the notice period now, and put them in a calendar. Auto renewal with a notice window you missed is the single most common reason businesses stay on an arrangement they had already decided to leave.

There is no single product that stops ransomware. What works is layers that each catch what the previous one missed:

• Multi factor authentication on email and remote access, no exceptions
• Next generation endpoint protection that watches behavior, not just known signatures
• Email filtering and protection against lookalike domains and forwarding rule abuse
• Patching on a schedule, because most successful attacks use known holes
• Least privilege on accounts so one compromised user is not the whole network
• Backups that are isolated and actually restore
• Log monitoring so a compromise gets noticed in hours, not months

We will not take on a client who refuses multi factor authentication and working backups. Those two are the floor.

Endpoint protection, patching, firewall management, multi factor enforcement, and Microsoft 365 or Google Workspace backup are in the base package for every managed client. We do not sell those as an upgrade, because a client without them is a client we cannot defend.

Server backup is quoted separately, per server, with up to 1 TB of storage included for each. Separately billed does not mean optional in any way that matters: we will not take on a managed client whose servers have no working backup. If the budget is not there yet, we will say so during the quote rather than after an incident.

Higher tiers add depth: log monitoring and alerting, tighter identity controls, vendor management, and quarterly risk and compliance reviews.

Two different things get called backup and they are priced differently, so it is worth being exact about which is which.

Microsoft 365 and Google Workspace backup is included in the per-user fee for managed clients. That covers mail, calendars, contacts, OneDrive or Drive files, SharePoint, and Teams data. This matters more than most businesses realize, because Microsoft and Google do not back your data up the way people assume. Their retention and recycle bin windows are not a backup, and a deletion or a ransomware event that syncs to the cloud will happily take your files with it.

Server backup is quoted separately, per server, and each server includes up to 1 TB of backup storage. It is its own line on your agreement rather than being folded into the per-user number, because a business with three servers and a business with none should not be paying the same.

Whatever we back up, we test. Managed clients get monthly test restores and the results appear in your reporting. A backup that has never been restored is a guess, and the gap between a job reporting success and the data actually being usable is where businesses get destroyed.

For hourly and monitoring-only clients, backup is not included by default. It can be purchased separately, and we would much rather sell it to you now than explain later that there was nothing to restore from.

Most small businesses find out about a breach weeks or months after it happened. We collect and correlate security logs from workstations, servers, firewalls, and Microsoft 365, and alert on the things that actually indicate a compromise: mailbox forwarding rules being created quietly, multi factor settings being changed, shadow copies being deleted, suspicious administrative activity, impossible travel logins.

We built and operate that platform ourselves rather than reselling someone else's dashboard, which means we can write detections for your specific environment.

Our compliance service is framework agnostic with framework specific deliverables. The underlying work is the same in every case: risk assessments, written policies, evidence collection, training tracking, and audit ready reporting. What changes is which control set we map it to.

Common ones for our clients: HIPAA for medical and dental practices, FTC Safeguards for auto dealers, tax preparers, and other financial adjacent businesses, and CMMC Level 1 for companies handling federal contract information.

Cyber insurance questionnaires deserve a specific warning: answering yes to controls you do not actually have is how claims get denied. We help clients answer those truthfully and then close the gaps.

Your people are the most targeted part of your business. Training is short, recurring, and paired with simulated phishing so you can see who is actually at risk rather than assuming everyone read the email.

We isolate affected systems, preserve what is needed for investigation, work with your cyber insurance carrier and their incident response team if you have coverage, restore from backup, and document the timeline. For regulated clients we help assemble what your reporting obligations require.

The conversation to have before an incident is who makes decisions, who calls the insurer, and how fast we are authorized to take systems offline. We set that up during onboarding rather than improvising it at 2am.

Ask every provider for a certificate of insurance showing general liability, errors and omissions, and cyber liability. A provider with access to your entire network and no cyber coverage is a risk you are absorbing on their behalf.

A disaster recovery plan that has never been executed is a document, not a capability. The gap between the two is measured during the event, which is the worst possible time to find out.

Every managed client gets monthly test restores as standard, covering Microsoft 365 or Google Workspace data and any server on a backup line. For clients where a day of downtime carries serious cost, we go further and run scenario tests: bringing a critical system up from backup in an isolated environment and timing it, so the recovery time you have been quoted is a measured number rather than an estimate.

That testing routinely surfaces things no plan would have caught. A dependency nobody documented, a licensing activation that fails when the hardware changes, a database that restores but needs a step nobody wrote down, credentials that only existed on the machine that is gone.

Ask any provider when they last restored a client's critical system outside of an actual emergency, and what the measured recovery time was. The specificity of the answer tells you whether the testing is real.

Almost every business we take over has a pile of retired equipment somewhere, and almost nobody knows what is on it. Those drives usually hold customer records, financial data, saved passwords, and in a medical or dental practice, patient information. A storage room is not a control, and disposal is an obligation under most of the frameworks our clients fall under.

What we do: drives are wiped to a recognized sanitization standard when they are reusable, and physically destroyed when they are not, with documentation of what was destroyed and when. That certificate is what an auditor or an examiner wants to see, and it is also what turns a lost laptop into a non-event if the drive was encrypted.

The stack you already have gets dealt with during onboarding. It is one of the quickest risks to eliminate and one of the most commonly ignored, because nothing about it feels urgent until a drive walks out of the building.

Two different layers, and it is worth understanding which is which.

At the system level we log authentication, administrative actions, file access on monitored systems, and access to cloud services, and those logs feed our security monitoring. That tells you which account did what and from where.

Inside your practice management, case management, or line of business application, the audit trail belongs to that software. Most business-critical applications have one. What we do is make sure it is switched on, because it frequently is not by default, and that its records are retained long enough to be useful rather than rolling over in thirty days.

Both layers are defeated by the same thing: shared logins. If four people at your front desk use one account, every log you own says that account did it, and you cannot answer the question that matters. That is a common finding and a genuinely awkward one to fix after the fact, because the answer is individual accounts and some staff will initially find it inconvenient. It is worth the friction, and in a regulated environment it is not really optional.

Access should follow the job. The front desk needs scheduling and billing functions and usually does not need clinical records, financial reporting, or the ability to change system settings. Clinical staff need patient records and usually do not need payroll or banking. Whoever handles money needs the accounting system and usually does not need administrative control of the network.

We map roles to what each group actually does during onboarding and then apply it at both layers: in your systems and files, and inside your line of business application where it supports roles. It is rarely as disruptive as owners fear, because most people only use what their job requires anyway. The objections come from a handful of long-tenured staff who have accumulated access over the years.

The reason it matters is not that you distrust your team. It is that one compromised account should not expose everything you hold. Attackers rely on the account they get into being able to reach far more than that person's job required, and that is almost always true in a business that never did this exercise.

The spreadsheet is nearly universal and it is worth being clear about why it is a problem, rather than just saying it is bad practice.

A spreadsheet of passwords can be copied without trace, emailed, left in a Downloads folder, synced to a personal cloud account, and opened by anyone who reaches that file. It does not tell you who looked at what, it cannot be revoked from one person, and it goes stale the moment somebody changes a password without updating it. If it lives on a shared drive, everyone who can see that drive can see everything you own.

We deploy Keeper for clients. What changes in practice: each person has their own vault, shared credentials are shared deliberately rather than by everyone holding the file, access is revoked in seconds when someone leaves, and you get a record of who accessed what.

The rollout is less painful than people expect. Import the spreadsheet, get everyone signed in, set up the shared folders for the credentials teams genuinely need in common, then delete the spreadsheet properly rather than leaving it renamed as old_passwords.xlsx.

Do the deletion part. We still find the original spreadsheet on the drive a year later more often than not.

Shared logins are a fact of life in small business. The bank portal, the state licensing site, the vendor account that only allows one user, the social media accounts. The goal is to share them in a way you can withdraw.

What we set up in Keeper: shared folders organized by function, so the front desk group gets the credentials the front desk needs and nothing else. Someone joining gets access by being added to the group. Someone leaving loses it the same way, in seconds, without anyone changing a password.

Two things to stop doing immediately:

• Emailing or texting credentials. They then live permanently in two mailboxes, in sent items, on phones, and in any backup of those. A compromised mailbox hands over everything ever sent through it.
• Sharing one login for a service that supports individual accounts. If a system can give each person their own account, use it. Shared logins destroy your ability to answer who did something, which matters more than people expect until the day it matters a great deal.

Where a service genuinely allows only one login, a password manager is the right answer. Where it does not, individual accounts are.

Two separate problems, and businesses usually handle the first and forget the second.

Their own accounts. Straightforward. We disable the account, revoke active sessions and tokens rather than only resetting the password, and remove access to cloud services. Minutes of work once we are told.

Shared credentials they knew. This is the hard part. The bank login, the vendor portal, the alarm code, the Wi-Fi password, the account at the supplier. Those do not change when their account is disabled, and in most businesses nobody can produce a complete list of what one person knew.

With a password manager, that list is exact. We can see which shared folders they had access to and change exactly those credentials, rather than either changing everything or hoping.

Without one, the honest advice is to change anything you can think of, accept that the list is incomplete, and use the experience as the reason to fix it before the next departure.

For a difficult exit, tell us before the conversation happens rather than after. We can be ready to cut access while it is taking place, which is a normal precaution and protects the departing person too.

Multi factor authentication protects the accounts that support it, which is mostly your email, your Microsoft or Google tenant, and better modern services. That is genuinely the single most valuable control you can have, and it is not the whole picture.

What it does not cover:

• The accounts with no multi-factor option at all. Vendor portals, older line of business systems, utility accounts, some banking, state and licensing sites. Passwords are the only protection those have.
• Reused passwords. If one password is used in several places and appears in a breach of any of them, every account using it is exposed. A password manager is what makes unique passwords practical, because nobody remembers forty of them.
• Knowing who has what. Multi factor says nothing about which staff can reach which systems.
• Handover. When someone leaves or is unreachable, the manager is where the business finds what it owns.

Use both. Multi factor is the more important of the two and a password manager is what covers everything multi factor cannot reach.

Nearly every small business has credentials that live in one head or one personal account. The domain registrar. The bank. The accounting system. The Microsoft tenant, sometimes registered to a former employee's personal email. If that person is unreachable, the business is stuck, and that risk has nothing to do with anyone's trustworthiness.

What we set up:

• Business ownership of business accounts. Anything the company depends on should be registered to a company address, ideally a shared mailbox rather than an individual, so it survives that person leaving.
• The critical few in a vault the owner can reach. Not everything, just the handful that would stop the business: domain, banking, the tenant, the accounting system, the alarm.
• A break-glass path. Keeper supports emergency access, where a designated person can reach a vault after a waiting period. That covers the situation nobody wants to plan for.

The registrar is the one we push hardest on. A domain registered to a personal Gmail belonging to someone who left in 2019 is a genuine business continuity risk, and it is the kind of thing that surfaces at the worst moment, usually mid-outage.

When a service your staff used gets breached, the email and password combinations end up circulating. If somebody used their work email to sign up for something years ago, and reused that password, it is potentially in a list being traded right now.

We monitor client domains for credentials appearing in breach data and tell you what turned up, which account, and roughly where it came from. This is the thing usually marketed as dark web monitoring, which oversells it slightly: most of this data is traded in places that are not especially hidden. The name is dramatic, the service is genuinely useful, and it is one of the highest value low cost things you can have running.

What to do when something appears, which it usually does:

• Change that password everywhere it was used, which is the part people underestimate
• Confirm multi factor authentication is on for that account
• Check the account for signs of access: mailbox rules, forwarding, unfamiliar sign-ins

The finding people dislike most is a breach from a personal service a staff member signed up for with their work address. That is not a telling-off, it is exactly why monitoring exists, and it is the most common way a business email compromise starts.

An alert like this means an email address of yours appeared in data from some service's breach. It does not necessarily mean your mail account is compromised, and it does mean somebody now has a known-good address and possibly a password that was reused.

What to do, in order:

• Change the password on the breached service, and more importantly anywhere that same password was used. The reuse is the actual risk, not the original breach.
• Confirm multi factor authentication is on your email. If it is, a leaked password alone is not enough to get in, which is the whole reason it matters.
• Check the mailbox itself. Look for forwarding rules you did not create, rules that move or delete messages, and recent sign-ins from places you do not recognize. We can check this properly and quickly for managed clients.

What not to do: ignore it because the breached service seems unimportant. The service does not matter. The password does, and so does the fact that your address is now on a list.

If you get an email claiming to have your password and demanding payment, that is usually a bluff built on exactly this kind of breach data. Do not pay. Do change the password.

Speed matters far more than blame here, and the person who clicked needs to feel able to say so within minutes rather than hiding it until the afternoon. That culture is worth more than any technical control.

What to do right away:

• Change their password, from a different device. If the machine is compromised, changing it on that machine hands over the new one too.
• Tell us immediately. We revoke active sessions, which matters because an attacker who already signed in stays signed in even after a password change unless sessions are killed.
• Do not delete the email. It tells us what the attack was and lets us find who else received it.
• If they entered card or banking details, call the bank as well.

What we check: mailbox rules created in the last few days, forwarding to external addresses, multi factor settings changed, sign-ins from unexpected places, and whether the same message reached anyone else.

Clicking a link and going no further is often harmless. Entering credentials is not. Either way, tell us. We would rather check twenty false alarms than miss the one that mattered.

Call first. 904-204-6870. What happens in the next hour matters more than anything that happens afterward, and a few common instincts make things worse.

What not to do:

• Do not wipe or reimage anything yet. It destroys what we need to work out how far this went and what was taken, which is exactly what you will later need to answer to an insurer or a regulator.
• Do not just change passwords and assume it is over. Sessions already established survive that.
• Do not email about it from the affected system. If the mailbox is compromised, you are briefing the attacker on your response.

What helps: write down what you saw and when, including anything unusual in the days before. Leave affected machines powered on but disconnect them from the network if you can do that easily. Use phones or a different channel to coordinate.

What we do: contain the accounts, revoke sessions and tokens, preserve logs before retention windows close, establish scope, then clean up. In that order, because doing cleanup first makes the scope question unanswerable.

Immediate actions, in this order:

• Disconnect affected machines from the network. Unplug the cable or turn off Wi-Fi. This stops it spreading to everything else, which is the thing that turns a bad day into a catastrophe.
• Leave them powered on. Turning them off can destroy information useful for identifying the variant and sometimes for recovery.
• Call us. 904-204-6870. Then call your cyber insurance carrier, because most policies require prompt notification and many require you to use their incident response team.
• Do not pay, and do not communicate with them, before anyone has assessed your backups. If your backups are intact and isolated, you likely do not need to.

Do not start deleting the ransom notes or reinstalling machines. Identifying the variant matters, and occasionally a decryptor already exists.

The realistic recovery path, with good backups, is containment, then rebuilding to clean systems, then restoring data. Being able to work again is often same day to next day. Being finished takes longer, because credential resets, determining what was accessed, and any notification obligations all continue afterward.

If you are reading this and it has not happened yet, the question worth answering today is whether your backups could be reached from an encrypted network.

Two things run in parallel and neither waits for the other.

The money, immediately: call your bank and request a recall. Then file a report with the FBI's Internet Crime Complaint Center at IC3.gov. There is a federal process for attempting to freeze fraudulently transferred funds, and it works far better inside the first 24 to 72 hours than after. Notify your insurance carrier promptly as well, since late notice is a common reason claims get reduced.

The systems, immediately: call us. Fraudulent payment instructions usually mean a mailbox was compromised, either yours or the other party's. We contain the account, revoke sessions, look for the rules the attacker created, check whether anything else was touched, and preserve the logs before they age out.

Do not reply to the email thread the instructions came from. If it is a compromised counterparty, you are telling the attacker what you have noticed.

Decide in advance who has authority to make these calls at 6pm on a Friday. We set that out during onboarding, because the delay while people work out who can authorize what is exactly the delay that matters here.

This is the single most valuable security change most small businesses can make, and it is included in the base agreement rather than sold as an upgrade.

How a rollout usually goes: we enable it for a pilot group, communicate a date to everyone, then enforce it tenant-wide with a short window for people to enroll. Most staff set it up in three minutes with the authenticator app on their phone.

Three decisions worth making properly:

• App prompts rather than text messages. SMS codes can be intercepted through SIM swapping, and app-based approval is both safer and faster for the user.
• No exceptions. The account exempted for convenience, usually an executive or a shared mailbox, becomes the way in. If someone genuinely cannot use a phone, there are hardware keys.
• Legacy authentication disabled. Multi factor can be bypassed entirely through older protocols if those are left enabled. Turning it on without this is a false sense of security, and it is the step most commonly missed.

Expect some grumbling for about a week, then nobody mentions it again. It is the cheapest insurance you will buy.

Cyber insurance applications ask specific technical questions: multi factor authentication on email and remote access, offline or immutable backups, endpoint detection, patching cadence, security awareness training, whether you have an incident response plan.

The temptation is to answer the way that gets the policy. Do not. Those answers form part of the contract, and if you claim after an incident and the insurer establishes that a control you attested to was not actually in place, that is a well-trodden route to a reduced or denied claim. The moment you need the policy is the moment those answers get examined.

What we do: go through the questionnaire with you, tell you honestly which answers are currently yes, which are no, and which are partly, then quote the gaps so you can decide what to close before submitting. Some are free and take an afternoon, multi factor being the obvious one.

We will also say when a question is ambiguous, because several are. "Do you have offline backups" means something specific, and the right answer depends on how yours are actually configured, not on the marketing term the vendor uses.

Worth doing this before renewal rather than in the last week, because the gaps you find sometimes take longer to close than you have.

Ransomware gets the headlines because it is dramatic. Business email compromise, usually shortened to BEC, quietly takes far more money, and it is the attack most likely to hit a business your size.

In the FBI's most recent Internet Crime Report, reported losses across all internet crime came to roughly 20.8 billion dollars, with business email compromise alone accounting for about 3 billion of it. Reported ransomware losses are a small fraction of that figure. Ransomware is certainly underreported, so treat the gap as indicative rather than exact. The point stands either way: more money leaves businesses through email fraud than through encrypted servers.

How it actually works, in the order it happens:

• Someone gets into a mailbox. Usually a password that was reused and appeared in a breach, or a convincing fake login page. Often not your mailbox at all, but your customer's, your supplier's, or your bookkeeper's.
• They read, and they wait. This is the part people do not expect. They are not in a hurry. They sit in the mailbox for days or weeks, learning who pays whom, how your invoices look, how your people write, and when money typically moves. A forwarding rule often keeps feeding them mail even after the password changes.
• They pick their moment and send one email. New bank details for an invoice you were already expecting. A wire instruction change before a closing. A request from the owner to buy gift cards for a client. Nothing attached, nothing to click, frequently sent from a genuine account they control.
• The money goes, and it moves fast. Funds are typically pulled out and scattered within hours.

Why it works on sensible people. The email is not suspicious. It arrives in a thread you were already part of, about an invoice that is genuinely due, from an address you have corresponded with for years, written in the tone that person actually uses. Nobody falls for this because they were careless. They fall for it because it looked exactly like the thing it was imitating.

There are three defenses and they work together: controls that make it harder to get into a mailbox in the first place, monitoring that spots a mailbox that has been taken over before the money email is sent, and a verification rule that stops payment changes regardless of whether anyone noticed anything. The last one is the only one that works every time, and it is free. The other articles in this topic cover each.

A compromised mailbox does not look broken. The attacker wants it working normally, because they need to keep reading it. So the signs are small and easy to explain away, which is exactly why they usually get explained away.

The signs worth taking seriously:

• Emails you never saw. Somebody says they replied and you have no record of it. This is the big one, because the most common thing an intruder does is set a rule that files or deletes incoming mail about invoices and payments so you do not notice the conversation they are having in your name.
• Replies to messages you did not send, or contacts mentioning an email you do not remember writing.
• Items in your Sent folder you did not send, or conversely, a Sent folder that looks emptier than it should.
• Sign-in alerts or multi-factor prompts you did not trigger. If your phone asks you to approve a sign-in while you are sitting doing nothing, that is someone with your password trying to get in. Deny it and tell us the same day. Do not approve it to make it stop, which people do more often than you would think.
• Contacts telling you they got something odd from you, especially anything about payment or a shared file.
• Your password stopped working, or you were signed out unexpectedly.

Three checks you can run yourself right now:

• Look at your inbox rules. In Outlook, go to the settings for rules and read every one. You are looking for anything you did not create, particularly a rule that moves mail to a folder you never use, to Deleted Items, or to RSS Feeds. Rules with blank or single character names are a classic sign.
• Check forwarding. In the mail settings, look for forwarding to an outside address. Anything there you did not set up is serious and you should call us rather than just removing it.
• Check recent sign-in activity. Your Microsoft account shows where and when it has been signed into. Sign-ins from countries where none of your staff are, or from several places at once, are the clearest evidence there is.

If you find any of this, do not start deleting things. Call us first. The rule or the forward is evidence, it tells us what they were watching for, and removing it before we have looked costs us the ability to work out what they saw and whether anything was sent in your name.

For clients on a managed security agreement, we are watching for most of this already and you would usually hear from us before you noticed. The checks above are for anyone, including the business that does not have that in place yet.

Nothing breaks during a mailbox compromise, so there is no outage to notice and no alert from the thing itself. Detection has to come from watching the activity record rather than watching for failures.

What we run for clients on a managed security agreement. Your Microsoft 365 sign-in and audit logs are collected continuously into a SIEM, which is a security information and event management platform. The logs exist in your tenant either way, and the difference is whether anyone is reading them. Without this, the record sits there unexamined until after an incident, when it becomes the thing we use to work out what happened rather than the thing that would have prevented it.

The patterns that generate an alert:

• A new inbox rule or forward that sends mail out of the organization, or hides it. This is the single highest value signal there is, because almost every mailbox takeover creates one and almost no legitimate user does.
• Impossible travel. A sign-in from Jacksonville and another from overseas twenty minutes later. One of them is not your employee.
• Changes to multi-factor authentication. An attacker who registers their own authenticator keeps access through a password reset, so this matters as much as the original sign-in.
• Sign-ins from anonymizing services and unfamiliar countries, and sign-ins that succeed after a run of failures, which is a password spray finding its target.
• Someone searching the mailbox for words like invoice, wire, payment or banking, which is what reconnaissance looks like in the audit log and is not what a normal user does.
• Unusual sending volume or patterns, including mail to large numbers of external recipients.

What happens when one fires. We investigate rather than just notifying you. Depending on what we find, that can mean revoking the active sessions, which matters because changing a password alone does not kick out someone already signed in, disabling the account, removing the rule after recording it, and then telling you what we saw and what was likely read.

Two honest caveats. This is detection, not prevention, so it shortens the window rather than closing it. And it is a layer on managed security agreements rather than something every plan includes by default, so if you want to know whether your account has it, ask us and we will tell you plainly. The controls that prevent the compromise in the first place, mainly multi-factor authentication and a password manager, matter more and cost less, and they should be in place before anyone talks to you about monitoring.

This is the question we get after a near miss, and it is a fair one. Here is the honest answer.

Email security works by finding indicators: a malicious attachment, a link to a known bad site, a sender that fails authentication, a domain registered yesterday, content matching a known campaign. Business email compromise is designed around having none of those.

What the message actually is: plain text. A couple of sentences about an invoice. Sent from a real mailbox at a real company with a real reputation and perfectly valid authentication, because the attacker is signed into that mailbox. Frequently a reply inside a thread you have been part of for weeks. There is no technical indicator distinguishing it from legitimate mail, because technically it is legitimate mail. It was sent by an authorized session of a genuine account.

What good email security does still catch, and this is not nothing:

• Lookalike domains. The version where they register a domain one character off yours and send from that is catchable, and we catch it.
• The phishing email that starts the whole thing. The fake login page that harvests the password in the first place is a link to a malicious site, and that is squarely what a filter is for. We run Avanan, now branded Check Point Email Security, which sits inside the mailbox rather than in front of it and sees internal mail as well as inbound.
• Display name spoofing, where the name says your owner and the address does not.
• Anomalies in tone and relationship that newer tools score, which helps and is not reliable enough to bet a payment on.

So the filter is worth having and it narrows the problem considerably. What it cannot do is be the last line, because the final email in a BEC chain is specifically built to pass it.

That is the whole argument for a verification rule. Not a lack of faith in the technology, just an accurate understanding of what it can and cannot see. A callback to a number you already had works on a message that is technically perfect, and nothing else does.

If someone sells you an email product on the promise that it stops wire fraud outright, be careful. It reduces the odds. The phone call is what stops the payment.

This is the most common version of the attack for an ordinary business, and it is the one worth drilling into everyone who touches accounts payable.

What to do, in order:

• Find the supplier's number somewhere other than the email. From a previous invoice, your accounting system, their website that you navigated to yourself, or a business card. Not the signature block of the message, not a number in the attachment, not a number someone texts you. The attacker controls everything inside that email, including the phone number, and will cheerfully answer when you call it.
• Call and ask for a specific person you have dealt with before. Not the main line and whoever picks up. Say that you received a request to change banking details and ask them to confirm the details back to you, rather than reading the new ones out for them to agree with. People say yes to things read to them.
• If anything is off, stop and tell us and tell your supplier's finance contact. If their mailbox is the one that is compromised, you may be the first person to find out, and they will want to know within the hour.

Do not use email to verify an email. Replying to ask "is this really you" goes to the person sitting in the mailbox, and they will confirm enthusiastically. If they have set a rule, your question may never reach the real person at all.

Signs worth a second look, though none of them are reliable enough to use as an all clear:

• A reply-to address that differs from the sender address, or a domain off by one character.
• Urgency or a reason you should not call, such as being in meetings all week or travelling.
• The account name not matching the company name, or the bank being in a different state or country than the business.
• A thread that has been unusually quiet, then resumes with a payment request.

And the point that makes this worth the two minutes: if the money goes to the wrong account, it is almost always your loss. You still owe the supplier, because you did not pay them. Recovery depends on catching it within hours. A phone call before the payment is a great deal cheaper than the alternative, and no legitimate supplier has ever been annoyed by it.

Payroll diversion gets less attention than wire fraud because the amounts are smaller, and that is precisely why it works. One paycheck going to the wrong account is not the kind of number that triggers a review, and it can repeat for several pay periods before anyone realizes.

The setup is the same as every other version. Someone gets into an employee's mailbox, or sends from a free email account claiming to be the employee writing from home. Then they email HR or payroll, usually a few days before the pay run, asking to update direct deposit details. The tone is casual, it is a routine request, and payroll handles routine requests all day.

How to handle it:

• Verify in person if you can. In a business where everyone is in one building, walk down the hall. It takes a minute and it is completely reliable.
• If you cannot, call the number in your HR file, not a number in the email. Same principle as everything else in this topic.
• Never action a banking change on an emailed request alone, however ordinary it looks and however senior the person appears to be.

The better fix, if your payroll system supports it: make employees change their own direct deposit details through the payroll self service portal, with multi-factor authentication on it, and have payroll decline emailed requests as a matter of policy. That removes the decision from a person under time pressure, which is where it goes wrong. Tell staff once that this is the rule and the emailed requests stop mattering.

Worth flagging to whoever runs payroll: if the request comes from a free email address with the employee's name, or says they lost access to their work email, that is the scam almost every time. A real employee who cannot get into their work email has a manager they can call.

Two related ones in the same family, since the same person is usually the target. A request from the owner or a senior person for an urgent wire or gift cards, which is the same trick aimed at a different button. And a request for copies of W-2s or employee records, which happens in the first quarter and is identity theft rather than payment fraud. Same rule applies to both: verify on a known number, no exceptions for seniority or urgency.

Every other defense in this topic reduces the odds. This one, followed consistently, stops the loss even when everything else has already failed and nobody noticed a thing. It costs nothing to implement and most businesses do not have it written down anywhere.

What the rule should say:

• Any change to where money goes gets verified by voice, on a number you already had. New supplier banking details, changed wire instructions, a first payment to a new vendor, an employee's direct deposit. Not a number from the email, the attachment, or a text that followed.
• Email never verifies email. If the request came by email, the confirmation cannot.
• Above a threshold you set, two people approve. Pick a number that fits your business and write it in the policy. What matters is that there is a figure and that everyone knows it, rather than what the figure is.
• Nobody is exempt. Especially not the owner. The most effective version of this attack impersonates the person who can override the rule, and it works because staff are reluctant to question them. If you own the business, say out loud and in writing that you expect to be verified too, and then do not get irritated when it happens. That one sentence from you is worth more than any product you could buy.
• Urgency is a reason to slow down, not speed up. Real transactions survive a ten minute delay. Put that in the rule explicitly, because urgency is the lever every one of these pulls.
• Nobody gets in trouble for checking, or for raising something that turns out to be fine. If people are worried about looking foolish, they stop asking.

Make it one page and get it signed. Not a policy document nobody reads. A page that anyone who touches payments has read and signed, revisited once a year and whenever someone new joins the finance side. The signature matters less for compliance than for the fact that it makes the conversation happen.

Two things that make it stick: give your staff explicit permission to delay a payment, in writing, so that declining to pay something today is clearly the right call rather than a judgment call. And run it once as a drill, so the first time anyone makes that callback is not the day it is real.

We will help you write it, and we will sit with your bookkeeper and go through it. It is the cheapest hour in security and we would rather spend it with you than spend the day after a wire goes out.

Order matters here, and a couple of the instinctive reactions make things worse. If you are reading this during an incident, start at the top.

The first hour:

• Call us. Monday to Friday, 8 AM to 5 PM Eastern on 904-204-6870. A suspected mailbox compromise is a critical issue and gets our one hour response. If money is in flight, say that first, because it changes what we do in what order.
• If a payment has already gone out, call the bank now and in parallel. Do not wait for us. Ask for a recall or a SWIFT indemnity on a wire, and say the words business email compromise, because banks have a process for it. Then report at ic3.gov, which is the FBI's Internet Crime Complaint Center and is what triggers the Financial Fraud Kill Chain for a domestic wire caught quickly. Hours matter, and after about 72 hours the odds fall off sharply. There is a separate article in this topic on a payment that has already gone to the wrong account.
• Change the password, from a different device. If the machine itself might be compromised, changing it from that machine hands over the new one.
• Understand that a password change alone does not evict them. An existing signed-in session keeps working. Sessions have to be revoked and any authenticator they registered has to be removed. We do that, and it is the step most people do not know about.

What not to do:

• Do not delete the rule, the forward, or the emails. That is the evidence that tells us what they were watching and what they likely sent. We record it, then remove it.
• Do not email the affected person to ask about it. The attacker is reading that mailbox. Call them.
• Do not quietly handle it. If their mailbox was being read, your customers and suppliers may be getting mail from them right now.

What we do: revoke sessions and lock the account, pull the sign-in and audit logs to establish when access started and what was accessed, find every rule and forward, check whether anything was sent from the account, check whether other accounts are affected since one compromise is often several, and then tell you plainly what we found, including the parts we cannot determine.

And the part that gets forgotten. If they were reading the mailbox for two weeks, your customers and suppliers were exposed to whatever was in it, and may be targeted next using what was learned. Warning them is uncomfortable and it is the right thing to do, and we will help you write that message.

Most of the time, waiting on a firewall change is an irritation. During an incident it is the difference between one compromised machine and twenty.

What containment actually requires, in the first fifteen minutes:

• Isolating a machine so it cannot reach the rest of the network or the internet, while leaving it powered on, because turning it off destroys evidence and sometimes the only copy of the encryption key.
• Blocking an address or a destination that something inside your network is talking to.
• Cutting a remote access path that is being used right now.
• Occasionally, pulling a site off the internet entirely for a short period while you work out what is happening.

Every one of those is a firewall or network change, and the value of making it decays by the minute. Ransomware moving through a network does not pause while a request is triaged.

So the question to ask before you ever need it: who can make an emergency network change, how fast, and at three in the morning? If the answer involves opening a ticket, that is worth knowing now rather than during the event. And if the answer is that you can do it yourself, confirm that somebody in your business actually has that access and knows how, rather than it being theoretically available.

What we do. A suspected active incident is critical and carries our one hour response commitment, and in practice containment steps start as soon as we are on the call. For clients with after hours coverage written into the agreement, that applies outside our standard Monday to Friday, 8 AM to 5 PM Eastern hours too. We would rather be called at 2am about something that turns out to be nothing than hear about it at 8am.

The related point about split responsibility. If one company manages your firewall and another manages your computers and your Microsoft 365, an incident forces them to coordinate while the clock runs. That is survivable with a plan agreed in advance and it is genuinely difficult without one. If you are going to split it, agree beforehand who declares an incident, who can authorize a containment change, and how they reach each other out of hours. Write it down. The time to find out that two vendors have never spoken is not while something is spreading.

Week one is the security floor: our tools deployed, monitoring live, endpoint protection installed, backups verified, multi factor confirmed, and your staff able to reach us. The remaining weeks are documentation, cleanup, and the list of things your previous setup left undone.

Onboarding is mostly additive, so it does not interrupt work. If something does require a restart or a short outage (removing a previous provider's software, a firewall change), it is scheduled with you in advance, usually after hours.

Ideally the outgoing provider hands over documentation, credentials, and licensing cleanly. Sometimes they do not. We plan for both. We can rebuild access to your own systems, take over domain and licensing ownership, and remove their tooling without depending on their goodwill.

We also recommend you hold off on giving notice until we have talked through the timing, so you are not without support in the gap.

We need a walkthrough of your office, administrative credentials for your systems, a point of contact who can approve decisions, and a short conversation with whoever has been handling IT informally. That person usually knows things no documentation captured.

We document your network, systems, credentials, vendors, and configurations as part of onboarding and keep it current. If you leave, that documentation goes with you. Documentation held hostage is one of the oldest bad practices in this industry.

Larger and multi-site onboarding runs differently from a single small office. The sequence we use:

• Weeks 1 to 2, security floor everywhere. Management tools, monitoring, and endpoint protection deployed across all sites, multi factor authentication verified, backups validated, and your staff given support access. This happens simultaneously at every office, because leaving a location unprotected while you work through a queue is not acceptable.
• Weeks 2 to 6, office by office. Full audit and documentation of each site: network, servers, line of business systems, vendor connections, and the local quirks. We generally start with the office that has the most problems rather than the easiest one.
• Weeks 5 to 8, identity and access. Accounts, permissions, group structure, and access review across the organization. This is where a company your size finds the most surprises.
• Weeks 8 to 10, handover. Documentation delivered, training for staff and any internal IT personnel, and a prioritized remediation plan with costs.

Time from your people: a few hours from a designated coordinator per week, walkthroughs at each site, and a short session for staff. We work around closings, month end, and whatever your busy period is.

The onboarding fee scales with size and number of sites and is quoted in advance as a fixed project.

This comes up more than people expect, and not always with bad intent. Sometimes it is simple reluctance, sometimes it is someone who knows the documentation does not exist and is embarrassed, occasionally it is worse.

Either way we do not build a transition that depends on cooperation. Administrative access to systems your business owns can be recovered through the vendors and through ownership verification. Domains, Microsoft or Google tenants, licensing, and hosted services all have ownership recovery processes, and we run them regularly.

Where there is real concern about conduct rather than just attitude, sequencing matters. Credential rotation and access review happen before any conversation about their departure, not after, and we coordinate that quietly with you. That is a normal precaution in any transition, and it protects the employee too, because a clean cutover means nothing that happens afterward can be attributed to them.

Whatever the situation, the outcome is the same: your business ends up holding administrative ownership of its own systems, documented, which is where it should have been all along.

Not hypothetically. These are what we find at nearly every company of size when we take over:

• Active accounts for former employees, usually including at least one with elevated access, and often licenses still being paid for
• Backups that run but have never been restored, and frequently a system that was never included at all
• A load bearing machine nobody knew about. An old workstation under a desk running a service the business depends on, no backup, no support
• Shared credentials for systems that should have individual accounts, which breaks accountability and any audit trail
• Multi factor authentication with exceptions. Usually a service account or an executive who asked to be excluded, which is precisely the account an attacker wants
• Licensing that does not match reality, in both directions
• Unsupported software still in production because a vendor said it could not be upgraded and nobody revisited it

None of this indicates anybody did anything wrong. It is what accumulates in a business that grew faster than its documentation. You get the list with dates and severity, and you decide what gets fixed and in what order.

Your Microsoft 365 or Google Workspace tenant, your domain names, and your data belong to your business. We hold administrative access to manage them on your behalf, which is not the same as owning them.

Licensing can go either way depending on what you prefer. Some clients buy licenses through us so it is one invoice and one place to call. Others buy direct and give us admin access. Both are fine and we will explain the tradeoffs.

Thirty days notice, and we transfer ownership of everything that is yours, remove our tooling, and brief the incoming provider if you want us to. We would rather leave on good terms and get the referral than make an exit painful.

There is a difference between the tools we use to do our job (monitoring agents, remote access, documentation) and the systems your business runs on (email, files, line of business applications). The first category is ours and gets removed cleanly. The second is yours and is never structured so that only we can operate it.

We can quote and supply hardware, which usually means better business class equipment than a retail purchase and a warranty we handle for you. If you would rather buy it yourself, we will give you exact specifications and make sure you are not buying a consumer machine that will be unsupportable in two years.

They are your systems. You get administrative credentials, and if you want to change something yourself on a Saturday night, you can. We are not going to pretend otherwise or make you ask permission to get into your own network.

The one thing we ask is that you tell us what you changed. Not for approval, for documentation. Most of the genuinely painful troubleshooting we do at technically capable clients traces back to an undocumented change, where something starts behaving oddly three weeks later and we are chasing a ghost nobody remembers creating.

We would much rather work with an owner who does things themselves and tells us than one who feels locked out of their own business.

Owner-written automation is common and frequently better than what it replaced, because the person who wrote it understood the business. We will take it on, document it properly, and maintain it, provided it is built in something we work in and we can read it.

What we will not do is pretend. If something is written in a language or platform we are not strong in, you will hear that up front, along with the options: leave it with you and we work around it, rebuild it in something we can support, or bring in someone who specializes.

Either way it gets documented. Right now it probably exists only in your head, which is fine until the week you are unreachable.

This question gets asked at the end of a contract, which is the worst possible time to ask it. The answer depends on two things that are easy to check at the start and awkward to discover later.

Who owns the hardware. Straightforward enough. Either you bought it, or it is the provider's and comes back, or it was bundled into the monthly fee in a way nobody has thought through. Worth having in writing either way.

Who holds the licensing, which matters more. Cloud managed equipment does not work without an active license. Cisco's own Meraki documentation is explicit about this: on their co-term and per-device licensing models, hardware that is out of licensing compliance becomes non-operational, cannot be configured, and stops passing traffic to the internet. It is not a feature downgrade. The device stops doing its job.

So if the licensing sits with your provider rather than with you, then at the end of the relationship you either hand the equipment back or keep a box that needs a license you no longer have a route to buy at that price. Both are acceptable outcomes if you knew going in. Neither is acceptable as a surprise during a transition.

The related one: whose account are the devices in? Cloud managed platforms organize equipment into an organization in the vendor's dashboard. If the devices sit in your provider's organization, moving them requires their cooperation. A reasonable provider will release them. It is still their decision rather than yours, and that is worth knowing.

What to get in writing before signing anything:

• Do we own the hardware at the end of the term, and is there a buyout figure?
• Are the licenses in our name or yours, and do they transfer?
• Will the devices be released from your dashboard organization to ours on request?
• Do we get the configuration and documentation?

How we do it. You own the hardware, the licensing is in your name, the account is yours, and the documentation is yours with a copy in your hands rather than only in our system. If you leave, you keep all of it and it keeps working, and we will do the handover properly. Our agreements are month to month with 30 days notice, so there is no term to run out and nothing to buy your way out of. There is a separate article in this topic on exactly what you get back if we part ways.

Patching, monitoring, backup verification, security review, license cleanup, documentation, hardware lifecycle planning, and vendor coordination. Most of it you will never see, which is the point. A quiet month is not a month you overpaid for, it is the product working.

Reporting covers ticket volume and response performance, patch compliance, backup and test restore results, security alerts and what was done about them, and asset age. Higher tiers include quarterly risk and compliance assessments.

Reports nobody explains are just PDFs. The review conversation is the part that matters.

You should know in October what you are likely to spend next year. We keep a refresh plan for workstations, servers, firewalls, and switches so replacements land as planned purchases instead of emergencies. Emergency replacements always cost more and always happen at the worst time.

Migrations, office moves, server replacements, and new deployments are project work with a defined scope, a fixed price where possible, and a schedule. Keeping them separate is what prevents a big project from quietly consuming the attention your day to day support is supposed to get.

We handle Microsoft 365 and Google Workspace setup, licensing, and administration, email migrations into and out of both platforms, moving file shares to SharePoint or OneDrive, Azure and hosted servers, and hosted desktops. Moving off a file server sitting in a closet is one of the most common first year projects we do.

We track the age and condition of every workstation, server, firewall, switch, and field device, and keep a replacement plan against it. That means you know in October roughly what next year costs instead of discovering it when something dies.

Reviews cover ticket trends and what is causing them, security posture and what changed, what is aging out and when, and what is coming for your business: a second crew, a new location, a software change, a compliance requirement. The output is a plan you can hand to your bookkeeper, not a stack of charts.

For contractors specifically, the fleet is the part that sneaks up on people. A tablet lives a much harder life in a work truck than a laptop does on a desk, and replacing them reactively one at a time always costs more than replacing them on a schedule.

We handle camera systems for shops, warehouses, and yards, badge or code based door access, and gate controls, and we keep them on a separated part of your network so they are not sitting alongside your office computers and payment traffic.

Two problems we find almost every time we take over an existing setup. First, cameras that stopped recording weeks or months ago because a drive failed and nobody was watching the alerts, discovered only when someone needs the footage. Second, access systems still listing employees who left, sometimes years ago, with working badges or codes.

Both get fixed during onboarding and then monitored the same way we monitor everything else, so a camera that stops recording generates an alert on our end instead of a bad surprise on yours.

Keeping these on one provider also means there is no argument about whether a problem belongs to the camera company or the IT company.

Where it genuinely earns its place today, in our hands: triaging security alerts so the real ones surface quickly out of a large volume of routine noise, spotting account behavior that does not fit the pattern, and speeding up our own documentation and research. That runs in the background of the tools we operate. It makes our response faster rather than changing anything about how your staff works.

We also run our own AI infrastructure in house rather than sending everything to third party services, which matters for anything that touches client data.

Where we are careful: we do not let AI make changes to client systems on its own, and a person reviews anything consequential. We would rather tell you plainly what it does than market it as something it is not.

As for making your dispatchers faster, the honest answer is that the AI features most likely to help you are the ones built into your field management software, such as call scoring and scheduling suggestions. We will help you evaluate whether they actually earn the subscription increase, which is a different question from whether they demo well.

The point of hiring us is that you think about this less, so we do not forward every alert to prove we are working. A provider who copies you on everything has moved the workload rather than taken it.

You get a scheduled review covering tickets and what caused them, security, backup and restore results, and what is aging out. Between reviews, you hear from us for three reasons: something needs a decision, something needs money, or something happened that you would want to know about even though it is already handled.

Security incidents and anything touching your data reach you immediately, whether or not we have finished cleaning it up. That is the one category we never batch into a report.

During onboarding we agree on an amount we can spend without checking first, so a failed drive or a dead switch gets replaced while your staff are still working instead of waiting for a signature. Above that number, we call.

We also agree who can approve, and a backup approver, so nothing stalls because the owner is on a roof or out of town for the week.

The exception is a genuine emergency. If the choice is between spending your money and leaving you down, we will act and tell you immediately rather than the other way round. That is a rule we set with you in advance, not one we invent during the outage.

How this fits into a managed IT agreement.

Acquired offices almost always arrive with their own equipment, their own way of doing things, and often their own vendors. Trying to unify everything at once is how you turn an annoyance into an outage.

We work in this order: first identity and security, so everyone authenticates the same way and is protected the same way regardless of which office they sit in. Then backup and monitoring coverage everywhere. Then network and equipment standardization as hardware comes up for replacement anyway, which spreads the cost across your normal refresh cycle rather than creating a project. Workflow and application differences come last, because those are usually management decisions wearing a technology costume.

That final point is worth sitting with. Some of what looks like an IT inconsistency between offices is actually two managers who do things differently. We will tell you which of your differences are technical and which are not, and we cannot fix the second kind for you.

Acquisitions have a specific risk window: the period between the deal closing and the acquired environment being brought under your controls. That is when you own the liability for a network nobody has examined. We compress that deliberately.

Within the first days after closing, their machines get our monitoring and endpoint protection, multi factor authentication gets enforced, and their staff can reach our help desk. Even before we understand their environment, it is no longer unwatched.

Full integration, meaning identity consolidation, network standardization, file and email migration, and documentation, typically runs three to six weeks depending on what they were running and how cooperative their outgoing provider is.

Bring us in during diligence if you can. An hour looking at what you are buying tells you whether there are surprises in the technology, and we have seen deals where that changed the number.

A business your size is frequently paying eight to twelve technology vendors, and in most cases nobody has ever listed them on one page. We build that list during onboarding: what each one is, what it costs annually, who owns the relationship, when it renews, and whether anything else you pay for already does the same job.

What usually consolidates: overlapping backup, duplicate security products, standalone tools that duplicate capability already included in your Microsoft or Google licensing and simply never enabled, and multiple vendors doing adjacent pieces of the same function.

What usually should not: your line of business software, and specialist systems where the best option is genuinely a separate vendor. We are not going to push you onto something worse to reduce a list.

Even where nothing consolidates, the list itself is valuable. It surfaces auto-renewals nobody remembers agreeing to, subscriptions for a former employee's tool, and services still billing for something you stopped using. That review pays for itself more often than not.

We deploy and manage business phone systems, and for most offices that now means a cloud based system rather than hardware in a closet. Handsets, softphones on computers, apps on mobiles, or a mix.

What usually makes it worth changing: paying for lines you do not use, a system nobody can reconfigure without calling a vendor, no way to work from anywhere, or a physical unit old enough that parts are getting hard to find.

Three things to sort out before switching:

• Your internet connection. Calls are unforgiving about quality in a way that email is not. Upload bandwidth and consistency matter more than headline speed, and this is the most common reason a cloud phone system disappoints.
• Number porting. Moving your existing numbers takes longer than everything else and should start early. This is the part that delays projects.
• What else is connected. Fax lines, alarm dialers, elevator phones, credit card terminals. These get forgotten and then stop working, and some genuinely need to stay on a traditional line.

We also connect phone systems to the other things you run, since call logging into your line of business software is worth having when it is available.

The typical conference room has a TV someone bought, a webcam someone else bought, a cable that reaches if you sit in the right chair, and a different process depending on whether the meeting is Teams or Zoom. Every meeting starts with five minutes of fiddling, and with eight people in the room that is a real cost repeated weekly.

What makes rooms work reliably:

• One way in. A single cable or a single wireless method, not three options that each work sometimes.
• Audio that suits the room size. Audio is what people actually notice. A laptop microphone at the end of a ten foot table is why the people dialing in cannot hear.
• A camera that shows the room, not a webcam clipped to a laptop pointed at one person's shoulder.
• A dedicated room system where the room is used constantly. For a room in use several times a day, a purpose-built system that joins meetings with one button pays for itself quickly.

We specify, install and support these, and we will tell you when the honest answer is a decent cable, a good speakerphone and a tidy-up rather than a project.

The failure mode in this industry is not that problems do not get fixed. It is that the same problem gets fixed eleven times. Each individual ticket is closed correctly and promptly, everyone is doing their job, and the printer still goes offline every third Tuesday for a year.

That happens because closing tickets quickly is what gets measured, and a recurring issue never becomes anybody's problem to own. We deal with it structurally rather than by hoping someone notices.

The two touch policy. Our tier one and tier two technicians get two touches on an issue. After the second, it escalates to tier three automatically. No questions asked, no permission to seek, no judgment call about whether it is worth escalating, and no incentive to keep trying because handing it over looks like giving up.

That last part is the whole point. The reason tickets bounce in most organizations is that escalating feels like an admission, so a technician tries a third time, and a fourth, and the clock runs while the client waits. Making the escalation automatic takes the decision away from the person least able to make it objectively. It also means your problem reaches the person who can actually solve it on the same day rather than next month.

Root cause analysis on major issues. Anything significant, including any business down event, gets an RCA rather than just a closed ticket. That means we establish what actually caused it rather than what we did to make it stop, and what change prevents a recurrence. Sometimes that change is ours to make. Sometimes it is a recommendation that costs money and we put it in front of you with the number attached, and it is your call. Either way you get told what happened and why, in plain language.

What that looks like from your side:

• You should not have to tell us something is recurring. If you find yourself saying "this again" or "we had this last month", that is a failure of ours, and it is worth telling us so bluntly.
• Repeat issues come up in your review alongside the reporting, so the pattern is visible rather than buried in a ticket list.
• Sometimes the honest answer is that the equipment is the problem. A machine that has needed four visits does not need a fifth. We will say that, with a cost, rather than keep billing visits to prop up something that should be replaced.

Worth asking any provider you are considering: what happens when a ticket comes back for the third time, and who decides to escalate it. If the answer is that the technician decides, you now know why the printer keeps breaking.

A fair question, and the answer splits cleanly in two.

Anything IT is us. Servers, networks, firewalls, workstations, Microsoft 365, backup, security, phones, the help desk. We do not subcontract the work you are paying us for, and we do not farm out an install and show up to supervise it.

The trades are subcontracted, and should be. Audio visual installation, electrical work, and the physical installation of security cameras are licensed trades. We are not electricians and we are not going to pretend otherwise so that an invoice stays in one place. We work with subcontractors we have used before and trust.

What "vetted" actually means here, because the word gets used loosely:

• We have worked with them. Not found for your job. People we have used on other sites and would use again.
• Licensed and insured, and we can produce that if your business or your landlord needs it.
• We bring them and we manage them. You are not handed a phone number and told to sort it out. We scope the work, we are there for the parts that matter, and we coordinate the schedule.
• The result is ours. If the cable run is wrong or the camera is pointed at a wall, that is our problem to put right, not a dispute for you to have with a third party you never chose.
• One point of accountability. You call us about it, whoever physically did it.

Where the line sits on a camera or access control job, since that is the most common mixed project. The system, the network it sits on, the accounts and permissions, the recording and retention, and the monitoring are all ours and stay ours. Running the cable, mounting the hardware and anything requiring an electrical license is the subcontractor's. That is why your camera system ends up properly separated from your office network and your payment traffic, which is frequently not how we find them when we take over an existing setup.

What to ask any provider: who physically comes into my building, are they your employees or someone else's, are they licensed and insured, and who is accountable if the work is wrong. The last one is the one that matters. A provider who subcontracts and owns the outcome is fine. A provider who subcontracts and then points at the subcontractor when something fails is a problem, and you want to know which you have before anyone is on a ladder.

We are happy to walk through specific certifications for the people who would be working on your account. A word of caution though: certifications tell you someone passed a test, not that they return your calls. Weigh references and response commitments at least as heavily.

Each resolved ticket sends a short satisfaction survey. Negative responses are reviewed directly rather than averaged into a number nobody looks at. We also ask in the scheduled review, where people tend to say the thing they would not put in a survey.

The honest version: businesses get bought and absorbed into the parent company's IT, they close, or they grow to the point where a full time internal IT person makes sense. Once in a while someone finds a cheaper provider. Sometimes they come back.

Any provider who tells you they have never lost a client is either very new or not being straight with you.

We do not write custom applications, and we are not the right fit for large enterprises with their own IT departments. We also will not take on a client who refuses basic security controls, because we would be signing up to be blamed for a breach we were not allowed to prevent.

When something is outside what we do, we say so and point you at someone who does it well.

We start with a conversation about what is not working. If it looks like a fit, we do a free IT assessment: a look at your network, systems, security posture, and backups, and a written summary of what we found. You get that summary whether or not you hire us.

Fair question, and usually asked by someone who has been let down before. Ticket response is the easy part to fake because it is visible. The work that quietly stops is the preventive work, and the warning signs are specific:

• Patch compliance drifting downward month over month
• Restore tests that stop appearing in your reporting, or appear with no detail
• Access reviews that stop happening
• Documentation that has not been updated since onboarding
• Recommendations drying up, because a provider paying attention always has something to raise
• Only ever hearing from us when you initiate

Those are the numbers to watch in your reporting, and you are entitled to ask about any of them at any time. A provider who cannot produce patch compliance and restore test results on request is not doing the work.

The most useful signal is the last one. If nobody has brought you a problem you did not already know about in six months, either your environment is perfect or nobody is looking.

Most of what you pay for is invisible by design, which is exactly why it needs to be evidenced rather than asserted.

Your reporting shows patch compliance by machine rather than a percentage that hides the three servers nobody touched, backup and restore test results with dates, security alerts raised and what was done about each one, and asset age against the replacement plan.

You can also ask at any time for a specific answer: when was this server last patched, when did this backup last restore successfully, who has administrative access to this system today. If a provider needs a week to answer those, they are reconstructing rather than reporting.

Use this in the sales process too. Ask a prospective provider to show you a sanitized version of what a client actually receives each month. What comes back tells you a great deal.

A provider that cannot tell you how it is performing is asking you to take it on faith, and faith is hard to audit. These are the numbers we hold ourselves to and show you.

• First contact within 15 minutes, for clients on a managed agreement. How quickly a person makes contact after something is reported. This is the one clients feel most, because the gap between reporting a problem and hearing from a human is where frustration actually lives, more than in the time to fix. Break-fix work is best effort and we do not publish a number we would be guessing at.
• Response against the published tiers. One hour for business down, four business hours for standard, next business day for low priority. Measured as attainment rather than as an average, because an average hides the one that took three days.
• How often tickets hit the two touch escalation. Our tier one and tier two technicians escalate automatically after two touches. The rate at which that fires tells us whether our first line is properly equipped or whether something is being escalated that should not need to be. It is as much a measure of us as of any individual.
• Satisfaction on closed tickets. Every closed ticket asks, and the owner reads the answers rather than a summary of them.
• Ticket volume over time, per client. This is the one that matters most in the long run, and the direction is the point. A well run environment should generate fewer tickets in year two than in year one. If yours is going the other way, something is wrong and the number says so before anyone feels like complaining.

You see this in your review, not on request. It arrives whether the numbers are good or not, which is the part that makes it worth anything.

What we would rather you watch, honestly. Response metrics are easy to publish and easy to look good on. The work that actually protects you is the part you cannot see: patch compliance, whether restores have been tested, whether access reviews happened, whether anybody raised something you did not ask about. There is an article in this topic on exactly that, because those are the numbers that go quietly wrong first when a provider starts coasting, and ticket response times are the last thing to slip.

And when we miss. You get told rather than apologized to after the fact, and a pattern of misses is a credit conversation rather than a scheduling excuse. That is covered in its own article in the Support and response times topic.

We have never walked into a small business and found everything correct. Not once. What we usually find is a mix of decisions that made sense at the time, work a previous provider left half finished, and things added in a hurry because you were busy running the business. That is normal, and it is not a character flaw.

What you get from us is a written list of what we found, sorted by how much it actually matters, without commentary about how it got that way. If a technician of ours is condescending to you or your staff, tell the owner directly and it stops.

In our experience, providers who make you feel stupid about your setup are usually doing it to justify the size of the quote.

Owner-built setups are often more sensible than people expect, because the person who built it actually understood the business. What they usually lack is documentation, patching discipline, and a backup somebody has tested. All three are fixable without replacing anything.

We do replace things that cannot be secured, cannot be supported, or are visibly heading for failure. When that happens you get the reason in plain language and the cost before anything moves. "We are more comfortable with our own brand" is not a reason, and we will not present it as one.

The one thing we do insist on is our monitoring and management tools on the machines, because we cannot be accountable for equipment we cannot see.

After the assessment you get a list in three groups:

• Fix now. Things that will take you down or get you breached. Failing drives, no working backup, no multi factor authentication on email, an unsupported system exposed to the internet.
• Budget this year. Aging equipment, gaps that are not on fire yet, projects with a real payback.
• When you get to it. Convenience, performance, and improvements that are genuinely optional.

Almost nobody can do all of it at once and we do not pretend otherwise. If you decide to leave something in the first group unaddressed, we will say so once more in writing, and after that it is your business and your call. We are not going to nag you into a purchase.

Nearly every small business has one: the front desk person who knows how to clear a print queue, the office manager who resets passwords. They did not ask for the job, but they are usually good at it and they know your business better than any outsider will.

It can go either way. Some owners want everything off that person's plate so they can do the job they were actually hired for. Others want them keeping the quick things because walking ten feet is faster than calling anyone. We will set it up whichever way you want, give them access to our documentation so they are not guessing, and be clear about where their part stops and ours starts.

The one thing we will not do is leave them as the only person who knows how something works. That is a risk to you if they are out sick or move on, and documenting it is not a move against them.

Onboarding includes a short session for your staff covering how to reach us, what counts as an emergency, and the handful of security habits that actually matter. It runs fifteen or twenty minutes, not a seminar, and we repeat it for new hires.

Your people are experts at their job, not at ours. A technician who cannot explain something without condescension is not doing their job well, and that is a conversation we have internally, not something you should have to manage.

One more thing worth saying: if someone on your team keeps running into the same problem, that is usually a sign the setup is wrong, not that they are.

You should not choose a provider based on whoever sold it to you. Ask to meet the person who would handle your day to day work and the person who would show up onsite, and ask them something specific about your setup.

We will arrange that, and it costs you nothing. It is a reasonable request, and a provider who deflects it is telling you something about how their delivery team compares to their sales team.

Very few prospects ask this, and it is one of the more revealing questions available to you. The number tells you whether the person who answers your call recognizes your business or has to open a file and start reading.

We keep accounts per technician low enough that your environment is familiar, and we staff so at least two people know your setup rather than one. There is a genuine tradeoff in provider size here: a one or two person shop gives you intimacy with no coverage when somebody is sick, and a very large provider gives you coverage from people who have never seen your office.

Ask every provider for the number, then ask how many of those clients that technician has physically visited in the last six months. The second answer is usually more informative than the first.

Personality fit is real, and saying it is wrong is not an accusation of incompetence. Some clients want everything explained as it happens, others want it fixed quietly with no commentary. A mismatch there causes friction that has nothing to do with skill.

If the match is wrong, say so. We would far rather move somebody internally than lose a client over a mismatch nobody mentioned until the exit conversation.

Get in touch if this is where you are.

This is a fair question in this market and more owners should ask it. A number of IT providers in Northeast Florida have been acquired by out of state groups over the last few years, and the pattern afterward is consistent: familiar technicians leave, support moves further away, and pricing shifts to hit somebody else's targets.

We are independent. No private equity, no parent company, no investors with an exit timeline. The owner works here and is reachable by clients directly.

Nobody can promise the future, which is exactly why the month to month agreement matters. If we were ever acquired, you would not be locked into a multi year contract with whoever bought us. That protection is there whether or not you ever need it.

A backup report full of green checkmarks tells you a job ran. It does not tell you the data is usable. The distance between those two facts is where businesses get destroyed, and it is almost always measured at the worst possible moment.

We restore test data monthly for every managed client, covering your Microsoft 365 or Google Workspace data and any server on a backup line, and the result is part of your reporting. If you want to sit in on one, ask and we will schedule it.

Ask your current provider the same thing. "Show me a restore" is the single most revealing question you can put to an IT company, and the hesitation in the answer tells you most of what you need to know.

Every provider publishes a response commitment. Considerably fewer can show you what actually happened. Our ticketing system records response and resolution times, and we are willing to show prospective clients real figures instead of the promise.

Ask every provider you are considering for the report rather than the agreement, and then ask how they define response. Some count an automated email confirming your ticket was created. That is a receipt, not a response, and the difference matters at 7 AM when nothing works.

Things commonly sold to businesses your size that frequently are not worth the money:

• A second backup product when the first is configured correctly and actually tested
• Security tools layered on top of capability you already own and have not turned on, which is extremely common with Microsoft licensing
• A server for a business that could run entirely on cloud services
• Enterprise grade equipment at a scale where the business grade version will serve you for years
• Compliance packages for frameworks that do not apply to you

We will tell you when something falls in this category. If you want it anyway for reasons of your own, that is your call and we will do it, but you will know which bucket it is in.

Ask every provider this question and watch what happens. The ones who cannot name a single thing are the ones to be careful with.

It happens. A patch with an unexpected consequence, a change nobody predicted the effect of, an honest mistake. Anyone who has been doing this for years and tells you otherwise is not being straight with you.

What we do: tell you as soon as we know. Not after it is quietly fixed, and certainly not after you noticed. The person who made the mistake is part of that conversation rather than a manager running damage control. We fix it on our time, and we tell you what changed in how we work so it does not repeat.

The thing that ends relationships is not the mistake. It is finding out about it later, from somebody else.

Nobody knows everything across the range of systems a small business runs. The failure is not in not knowing. It is guessing confidently, or going silent for three days while quietly trying to work it out.

What you should get is "I do not know, here is how I am going to find out, and I will have something for you by Thursday." Then we research it, escalate it internally, or go to the vendor, and you hear back when we said you would.

If it turns out to be outside what we do at all, we will tell you that too and point you toward someone who does it well. That happens a few times a year and it has never cost us a client.

Worth answering honestly up front, because the alternative is you discovering it in month three.

Still yours:

• Decisions about money and priorities. We recommend and sequence, but it is your business.
• Telling us when something changes: a new hire, a new location, a new software vendor, another crew.
• Approving access. We are not granting someone permissions because they asked us nicely.
• Choices about your own line of business software: which platform, which modules, which version.

Should leave your plate completely: patching, monitoring, backups and whether they actually work, security, sitting on hold with vendors, new hire setup, hardware planning, and being the person your staff comes to when something breaks.

If you are still doing anything in that second list six months in, we have not done our job, and you should say so out loud.

How this fits into a managed IT agreement.

We see this pattern often: the owner is technical, and the office manager, frequently the owner's spouse, is the person who actually deals with the provider every day. Some technicians unconsciously give the detailed answer to the owner and a simplified one to everyone else. It is condescending, and it also means the person doing the work is getting the worse information.

Your office manager gets the same explanations, the same access, and the same authority you tell us they have. Nobody has to prove they are technical enough to receive a straight answer.

This is worth watching during the sales process rather than after. In the first meeting, notice who they talk to and who they look at when a question comes from someone other than the owner.

We earn more if the answer is that you need us. Any provider who takes that question without acknowledging the conflict is not someone whose judgment you should rely on here.

What we can do honestly is report facts rather than render a verdict. Are systems patched. Do backups run and restore. Is multi factor authentication enforced. Is anything documented. Is licensing in order. Are there unresolved tickets going back months. Those are observations with dates attached, and they do not require an opinion about a person.

We will also tell you what a single person at your scale could reasonably be expected to cover, which is usually less than owners assume. Sometimes that reframes the whole question.

What we will not do is build a case. If you want a genuinely independent assessment of an internal employee's performance, hire someone who is not bidding on the work. That is worth the money and we will say so even though it costs us the easier path.