Security
Most of what goes wrong does not announce itself.
Backups that actually restore. Who can reach what. Equipment that still gets updates. And a plan for the morning something has already happened.
The one place I will tell you to spend money
Everywhere else on this site I will talk you out of replacing something that works. Age is not a fault. If your network is doing its job, leave it alone and spend the money on something that is actually costing you.
Security is the exception, and it is worth being clear about why.
Everything else tells you when it is broken. A slow network annoys people. A failed printer generates a phone call. You find out because somebody complains, and then you fix it.
Security fails silently. A backup that has not run since March looks exactly like a backup that ran this morning — right up until the day you need it, which is the worst possible day to find out. An account belonging to somebody who left two years ago still works, and nothing anywhere will mention it. The first symptom is the incident.
So this is the one area where waiting for a problem is not thrift. It is just waiting.
Where I start
Three things, in this order, because the order matters more than the list. Then a plan for the day it happens anyway.
Can you actually get your data back
Not whether you have backups. Whether a restore has been tried, by a person, recently, onto something. An untested backup is a receipt, not a copy. This is first because it is the one that decides whether a bad week is a bad week or the end of the business.
Who can reach what
Accounts for people who have left. Shared folders opened up to everybody in 2019 for one afternoon and never closed. Administrator rights handed out to get something working. None of it shows up as a problem until it is the route somebody takes.
What is still getting updates
Patching, but also the harder question underneath it: is this thing still supported at all? Equipment that no longer receives security updates is the one case where age genuinely is the fault, and it is worth replacing even though it still works.
And then the plan
Who you call, what gets turned off, who tells your customers, and where the backups are — written down somewhere that is not the machine that just went down. Most organizations write this during the incident. It is a bad time to be drafting.
AI is a security question before it is a productivity one
Most AI tools work by being connected to things. Your mail. Your documents. Your shared drives. That is what makes them useful, and it is what makes them a security decision rather than a software purchase.
An assistant sees whatever the person using it is allowed to see. Not more — but not less either, and that is what catches organizations out. If a folder was opened up to everybody years ago and never closed, it was already a problem. The assistant simply makes it reachable in one sentence instead of twenty clicks.
Which means your access control is now your AI policy, whether you wrote one or not.
The other half is the vendor. Before a tool gets near your business, somebody should be able to answer: what does it collect, where is it stored, is it used for training, who can see it, how long is it kept, and what happens when something goes wrong. A useful tool should also be a trustworthy one, and those are separate questions with separate answers.
I do that review. It is unglamorous and it is mostly reading terms of service, which is precisely why nobody does it.
What a look actually involves
A couple of hours going through what you have, no charge and no obligation. Afterwards you get a plain list: what is genuinely urgent, what is worth doing this year, and what you can safely leave alone.
That last category is usually the longest one, and I would rather tell you that than sell you a project. But if something on your network cannot be secured any more, I will say so plainly, because your business depends on this working and that is not a place for tact.
Not sure whether anything is wrong?
That is the normal state, and it is the reason to look rather than a reason not to. Nobody finds this sort of thing by waiting for a problem.