Have Your Cybersecurity and IT Needs Outgrown Your IT Provider?

What Your IT Provider May Not Be Doing — But Should Be

Many businesses assume their IT provider has everything covered—until something goes wrong. But today’s managed IT services go far beyond fixing computers, installing updates and answering support calls.

Cybersecurity, email protection, cloud monitoring, backups, employee training, compliance and technology planning have all become part of protecting a modern business.

Your IT provider may be doing exactly what you’ve asked them to do. The more important question is:

Does your business need more today than your IT provider is delivering?

What Is Your IT Provider NOT Doing?

We recently took over IT support for a local business that had been working with another provider.

I’m deliberately not going to criticize that company.

We weren’t there. We don’t know what they recommended, what the client agreed to, what may have been declined, or what constraints they were working under.

But during our onboarding assessment, we discovered significant gaps.

There was no 24×7 Security Operations Center (SOC) monitoring and response.

There was no advanced inbound and outbound email protection.

We found no meaningful Microsoft 365 or SaaS security monitoring.

Employees weren’t receiving ongoing cybersecurity awareness training or simulated phishing tests.

And we couldn’t identify what we would consider a comprehensive, tested backup and recovery strategy.

Perhaps most surprising, the client told us they couldn’t recall HIPAA requirements ever being part of the conversation with their IT provider.

These aren’t the only security gaps we find in small and midsize organizations. We’ve previously covered several others in 5 Common Cybersecurity Gaps in Professional Services Firms.

That got me thinking.

Maybe the question isn’t whether their previous IT provider was doing a bad job.

Maybe this business had simply outgrown the IT services it had been receiving or had asked for.

Cybersecurity Doesn’t Stop at 5 PM

Consider a simple scenario.

It’s 2:07 AM on Sunday.

One of your employees’ Microsoft 365 accounts has been compromised.

The attacker successfully logs in and starts reading email. They search for invoices, financial information, client information and password-reset messages.

They may create forwarding rules, download files or begin sending convincing messages from the employee’s legitimate company email account.

Is anybody watching?

More importantly:

Is anybody going to do something about it?

If the answer is, “Our IT company will see the alert when they come in Monday morning,” an attacker could potentially have more than a day to operate inside that account.

There’s also an important distinction between monitoring and response.

Software generating an alert at 2:07 AM doesn’t necessarily mean a human being sees it, investigates it and takes action.

That’s why businesses should ask whether their cybersecurity includes 24×7 security monitoring and response through a Security Operations Center.

The federal Cybersecurity and Infrastructure Security Agency (CISA) also provide cybersecurity guidance specifically for small and midsize businesses, including practical steps organizations can take to reduce their risk.

Cybercriminals don’t wait until your IT provider opens Monday morning.

Your Employees and Email Are Now Part of Your Security Perimeter

Years ago, business cybersecurity largely revolved around protecting the network.

Install a good firewall. Run antivirus. Keep Windows patched.

Those things still matter.

But today, much of your business—and many cyberattacks—operate through email, Microsoft 365 and other cloud applications.

Inbound Email Security

Phishing emails, malicious links, impersonation attempts and credential-stealing attacks are constantly evolving.

Modern email security should help identify these threats before an employee has to make the decision alone.

Outbound Email Security

This one is frequently overlooked.

What happens after an employee’s account has already been compromised?

An attacker can use that legitimate account to send fraudulent invoices, request wire transfers, target coworkers or attack your customers and vendors.

We’ve looked at exactly this type of threat in Business Email Compromise Attacks Target Professional Services Firms. A message sent from a real but compromised account can be particularly dangerous because the recipient already trusts the sender.

Outbound email protection provides another opportunity to identify suspicious activity before the message leaves your organization.

Microsoft 365 and SaaS Security Monitoring

Your Microsoft 365 environment contains your company’s most valuable information.

Someone should be watching for suspicious logins, unusual account activity, risky changes and unauthorized application access.

Employee Cybersecurity Training

Technology can’t stop everything.

Employees should receive ongoing training that helps them recognize phishing, social engineering, fraudulent payment requests and other common attacks.

We’ve also written about why familiarity isn’t enough in Why “I Know the Sender” Doesn’t Mean an Email Is Safe. A familiar name in the From field doesn’t guarantee that the person actually sent the message.

Phishing Simulations

Training should also be tested.

Simulated phishing campaigns can identify where additional education may be needed before a real attacker discovers the weakness.

Your employees shouldn’t be expected to recognize every cyberattack on their own. Your technology and your IT provider should be helping them.

A Backup Isn’t Enough — Can You Actually Recover?

Almost every business owner we talk to believes their data is being backed up.

That’s good.

But “we have a backup” isn’t really the question anymore.

Instead, ask:

• What exactly is being backed up?
• How frequently?
• Where are the backups stored?
• Who gets notified when a backup fails?
• Is Microsoft 365—including email, OneDrive and SharePoint—also protected?
• Are the backups protected from ransomware?
• When was the last successful recovery test?
• How long would it take to get the business operating again?

A successful backup report tells you that data was copied somewhere.

A recovery test tells you whether that data can actually help get your business running again.

Those aren’t the same thing.

We go deeper into this distinction in Disaster Recovery for Businesses: Your IT Time Machine, including why backup and disaster recovery aren’t necessarily the same thing.

The worst time to discover your backup doesn’t work is when you need to restore from it.

Who Is Helping You With Compliance?

This was another thing that stood out during our recent onboarding.

The business had HIPAA-related responsibilities, yet the client couldn’t recall those requirements being part of their regular IT conversations.

Your IT provider isn’t necessarily your attorney or compliance auditor.

But if your business operates under cybersecurity or data-protection requirements, your IT provider should understand that those requirements exist and help make them part of the technology conversation.

Depending on your organization, that conversation might include:

• HIPAA
• GLBA
• Cyber insurance requirements
• Customer security questionnaires
• Vendor security requirements
• Contractual cybersecurity obligations

The appropriate technology and cybersecurity protections for one business may be very different from those required by a law firm, financial organization or company handling protected information.

We’ve discussed the changing HIPAA cybersecurity landscape in HIPAA Security Rule Changes Are Coming (And Yes—They’re a Big Deal).

Ask yourself:

If nobody has ever asked what regulations apply to your business, who is making sure your technology supports them?

Does Your IT Provider Actually Talk to You?

This may be one of the easiest things on this list to overlook.

When was the last time your IT provider sat down with you when nothing was broken?

Not to sell you something.

Not because a server died.

Not because you submitted a support ticket.

Just to talk about your business.

Your IT provider should periodically be asking questions like:

• How are things going?
• What’s changing in your business?
• What are you concerned about?
• Are you hiring or expanding?
• Are you adding another location?
• What regulations or customer requirements are you facing?
• Where do you expect the business to be in the next 12 to 24 months?
• What technology should we budget for before it becomes an emergency?

Technology planning shouldn’t happen exclusively through support tickets.

Your IT provider shouldn’t learn about changes in your business when you submit a support ticket.

Your technology should support where your company is going—not just keep yesterday’s systems running.

7 Signs You May Have Outgrown Your IT Provider

None of these automatically means you have a bad IT company.

But they’re good reasons to start asking questions.

1. Nobody Is Monitoring Your Cybersecurity After Hours

Security alerts may be generated, but nobody is actively reviewing and responding to them overnight or on weekends.

2. Your Email Protection Hasn’t Evolved

Nobody has discussed modern inbound and outbound email protection with you.

3. Nobody Is Actively Monitoring Microsoft 365 and SaaS Activity

Your cloud applications may now contain more valuable business information than your physical network.

4. Your Employees Aren’t Receiving Ongoing Cybersecurity Training

And nobody is testing that training with simulated phishing attacks.

5. Nobody Can Clearly Explain Your Backup and Recovery Strategy

You know you have “backups,” but you don’t know exactly what’s protected, where it’s stored, whether it’s tested or how quickly you could recover.

6. Compliance Rarely Comes Up

Nobody is asking about HIPAA, GLBA, cyber insurance, customer requirements or other obligations that could affect your technology.

7. You Only Hear From Your IT Provider When Something Breaks

There’s little discussion about your business, risks, technology budget or future plans.

If several of those sound familiar, it doesn’t necessarily mean your provider has gotten worse.

Your business may simply need more today than it did five years ago.

10 Questions to Ask Your IT Provider

You don’t need to become a cybersecurity expert to have a meaningful conversation with your IT provider.

Start with these questions:

1. Who monitors our cybersecurity after hours?
2. If an employee’s account is compromised at 2:07 AM Sunday, what happens?
3. How are you protecting our inbound and outbound email?
4. Are you monitoring suspicious activity within Microsoft 365?
5. How are our employees being trained against phishing and social engineering?
6. Do you conduct simulated phishing tests?
7. What exactly are we backing up, and how often?
8. How do you verify that our backups can actually be recovered?
9. What cybersecurity or compliance requirements apply to our organization?
10. How often will we meet to discuss our business, technology risks and future plans?

A good IT provider shouldn’t be defensive about these questions.

They should welcome them.

Maybe Nothing Is Wrong With Your IT Provider

The technology world has changed dramatically.

Cybercrime has changed.

Microsoft 365 has changed.

Cyber insurance has changed.

Compliance requirements have changed.

And your business has probably changed too.

The IT relationship that worked perfectly well five or ten years ago may simply not provide everything your organization needs today.

That doesn’t necessarily make your current provider a bad IT company.

Maybe you’ve simply outgrown them.

And that’s worth a conversation.

Not Sure What’s Missing?

You don’t need to become an IT or cybersecurity expert to figure out whether your business has the basics covered.

Take Slingshot’s free 3-Minute IT Risk Self-Assessment.

It takes about three minutes and can help identify potential gaps in your cybersecurity, backups and IT management.

Frequently Asked Questions

What should an IT provider do for a small business?

A modern IT provider should do more than fix computers. Services may include proactive monitoring, patch management, cybersecurity, email protection, backups, Microsoft 365 security, employee training, compliance guidance, technology planning and ongoing support.

Should my IT provider monitor cybersecurity 24/7?

Businesses should understand what happens to security alerts outside normal business hours. There is an important difference between software generating an alert and having someone available 24×7 to investigate and respond to it.

Does Microsoft 365 need additional security and monitoring?

Microsoft 365 includes significant security capabilities, but organizations still need to properly configure, manage and monitor their environments. Additional email and SaaS security tools may be appropriate depending on the organization’s risks and requirements.

How do I know whether my company’s backups are working?

Don’t rely solely on successful backup notifications. Ask what is backed up, how frequently, where copies are stored, how failures are monitored and, most importantly, how recovery is tested.

Should my IT provider help with HIPAA and other compliance requirements?

An IT provider isn’t necessarily your attorney or compliance auditor, but technology and cybersecurity controls play an important role in many regulatory frameworks. Your provider should understand the requirements affecting your organization and participate in the compliance conversation.

How do I know if we’ve outgrown our IT provider?

Warning signs include limited cybersecurity monitoring, inadequate email or cloud security, untested backups, no employee security training, little discussion about compliance and infrequent conversations about your company’s technology strategy.