IT & security
A security check-up that showed what the IT bill wasn’t covering
Raghav’s work at a 25-person Toronto retailer, where he works now.
The first complete picture of a 25-person company’s IT: 71 observations and 7 ranked findings from a survey that needed no logins, every line of a five-figure annual IT bill mapped to what it covered, serious backup and server gaps found while there was still time to fix them, and a company-owned cloud security baseline built from scratch.
- Observations from a survey that needed no logins
- 71
- Invoice lines mapped to what each actually covered
- 13 of 13
- DNS records checked against what was live
- 46 of 46
The situation
The company runs its showroom, production, online store and weekly auctions from one office. One server host runs everything that matters: logins, the file server and the company’s other Windows machines. An outside IT provider managed all of it for a five-figure annual fee, and nobody inside the company held admin access to Microsoft 365, the backups, the antivirus, the firewall or the domain’s DNS. Leadership wanted to know what they were paying for, how safe the business really was, and how much of it they could run themselves.
What was hard
The first look had to happen with no logins and no changes, on a live network shared by production machines, cameras, printers and phones. The provider controlled every admin console, so access had to be negotiated one step at a time while the relationship kept working. And every decision, from licences to internet plans to firewalls, carried a cost the business would live with for years.
What Raghav did
- Ran a read-only network survey in about 22 minutes, with no logins and no changes. It found 61 devices answering on one flat network and produced 71 observations, 7 findings ranked by risk, and a 90-day plan for leadership.
- Mapped all 13 recurring lines on the monthly IT invoice to what each one actually covered, then built cost models comparing the current provider, another provider’s quote and a self-managed setup.
- Wrote a read-only diagnostic for the server host that ran in 48 seconds and found storage, backup-drive and power problems that needed attention.
- Reviewed the backups and endpoint protection once read access came through, and found accounts, including the main shared inbox, outside the backup, and no device enrolled in recovery testing.
- Took the company from no admin visibility to read access across Microsoft 365, backups, antivirus and DNS in about six weeks, then checked all 46 DNS records in the provider’s export against what was live.
- Settled whether to buy 3 Gbps internet and a new firewall, using vendor documentation. The firewall’s ports run at 1 Gbps, so a faster plan could not speed up the office, and the company kept its plan and its firewall.
- Built the company its own AWS organisation to a security baseline: organisation-wide audit logs encrypted and locked for 365 days, threat detection in three regions, checks against the AWS and CIS benchmarks, guardrails that keep logging on and workloads in approved regions, and a budget alert.
- Set up a free help desk with 12 request types, including onboarding a new employee, offboarding a leaver, requesting admin access and reporting a security concern, and merged 17 scattered documents into one IT handbook.
What changed
For the first time, the company can see its own IT. Every device, account, backup and invoice line is documented, and the fixes are ranked by risk and cost.
Leadership approved a two-stage plan: visibility first, then ownership. Next, in that order: Microsoft 365 Business Premium with two-step sign-in and device management, Microsoft Defender in place of the paid antivirus, closing the backup gaps and testing restores, and separating the office network into zones.
How this was measured. Counts come from the survey output, the provider’s invoices and the provider’s own exports.
Bring us in when you pay someone to run your IT and can’t say what you’re getting, or you’re about to take it in-house and need to know what’s really there first.