Why buying the cheapest PC can cost your business more in the long run

A couple of years ago, we were working with a healthcare client whose office manager had a computer that was painfully slow. This wasn’t some ancient machine that had been hanging around the office since Windows 7. It was only about six months old.

That was the confusing part. It was practically new, so why was someone in a key position spending her day waiting for her computer?

Once we took a closer look, the answer became pretty obvious. The computer had an Intel N200 processor and only 8 GB of RAM. There wasn’t anything technically wrong with it. It wasn’t infected with malware, the hard drive wasn’t failing, and there wasn’t some mysterious Windows problem we could fix. It was simply woefully underpowered for the job it was being asked to do.

And that’s an important distinction. A computer doesn’t have to be broken to cost your business money.

Every time she waited for an application to open, switched between programs, or sat there watching the computer struggle to keep up, the business was losing productivity. A minute here and two minutes there doesn’t sound like much, but multiply that across eight hours a day, five days a week, and an inexpensive computer can get expensive pretty quickly.

Of course, replacing a computer that was only six months old wasn’t exactly something they had budgeted for. We ended up finding them a refurbished business-class computer for about what they’d originally paid for the slow machine. It was more than twice as fast and came with a three-year warranty.

The lesson isn’t that everyone should run out and buy refurbished computers. The lesson is that new doesn’t necessarily mean good, and cheap doesn’t necessarily mean inexpensive.

“But we only use it for email and the web.”

I hear some version of this all the time. Someone needs a new computer, and because they aren’t doing video editing, CAD, or scientific research, the assumption is that just about anything will do.

After all, they only use Outlook, Word, Excel, Teams, QuickBooks, a few browser-based applications, OneDrive, and the web.

Except the web browser has 15 tabs open. Outlook is running all day. Teams is sitting in the background. OneDrive is synchronizing files. Windows is doing its thing. Your security software is running. Your line-of-business applications are open. Maybe you’re working with a couple of large PDFs and an Excel spreadsheet at the same time.

Suddenly, “we only use it for email and the web” is asking the computer to do quite a bit.

This is where those $250 or $300 computers you see advertised can become a problem. Yes, they’re computers. Yes, they run Windows. Yes, they can probably open Outlook.

A golf cart is technically a vehicle too. I’m still not taking one on the Turnpike.

So what should a business computer have?

We aren’t trying to sell our clients the most computer we possibly can. A receptionist doesn’t need a $3,000 engineering workstation just to answer email and work in a browser. The goal is to buy enough computer to comfortably handle today’s workload, leave some room for tomorrow’s workload, and hopefully not have this conversation again two years from now.

For most typical business users today, we recommend a current-generation or one-generation-old processor from one of the major processor families. There are dozens of processor models out there, and this is one of the easiest places to get fooled when shopping. Two computers can both say “Intel” on the sticker and have dramatically different levels of performance. That’s exactly what happened with our healthcare client.

We consider 16 GB of RAM the minimum for a new business computer. Windows may technically run with less, but we’re not buying computers based on the minimum required to make Windows boot. We’re buying them for people who need to get work done. More demanding users may need 32 GB or more, but 16 GB gives the typical office user enough breathing room to work with several applications at the same time without the computer constantly struggling.

For storage, our starting point is a 512 GB SSD or NVMe drive. Solid-state storage has been standard for years, and there is simply no reason to put a traditional spinning hard drive in a new everyday business computer. We also don’t like starting with tiny drives that are already half full by the time Windows, Office, and your normal applications are installed.

And for a business, the computer should be running Windows 11 Pro, not Windows 11 Home. There’s a reason Microsoft makes separate Home and Pro editions. Pro includes management and security capabilities that businesses and their IT providers need. Home is exactly what the name suggests. It’s designed for home use.

Buy a business computer for your business

There’s another difference that isn’t always obvious when you’re comparing computers online: consumer computers and business computers aren’t necessarily built or supported the same way.

At Mighty Manatee IT, we standardize on Dell and Lenovo business-class computers. That doesn’t mean they’re the only companies capable of building a decent PC. It means we’ve chosen manufacturers and product lines that give us consistent hardware, good parts availability, predictable driver and firmware support, and business warranty options.

Standardization matters when you’re supporting computers for years. If something goes wrong, we want to know that parts are available, firmware and drivers are going to be maintained, and somebody can actually come fix the thing.

That brings us to something people often overlook when they’re shopping: the warranty.

For a business computer, we recommend a minimum three-year onsite warranty. If the budget allows it, we’ll often recommend five years. The important word there is onsite. If a computer fails, having to box it up and ship it somewhere for repair while an employee sits around without a computer for a week or two isn’t much of a warranty from a business productivity standpoint.

For laptops, we also strongly recommend accidental damage coverage. Laptops get dropped. Screens get cracked. Drinks get spilled. Bags get knocked off tables. Gravity has maintained a pretty impressive undefeated record.

Think in years, not today’s price tag

When we properly specify a business computer, we’re currently seeing useful lifespans in the five-to-seven-year range. Obviously, workloads change and hardware can fail, but that’s a reasonable expectation for a well-built machine that was properly sized in the first place.

That’s why I don’t like looking at computers solely in terms of purchase price.

If one computer costs $400 and another costs $1,000, it’s easy to look at them and say the $400 computer saves the business $600. But what happens if the $400 computer is frustratingly slow from the beginning, causes an employee to lose productive time every day, requires more support, and gets replaced after two or three years?

Meanwhile, the properly specified business computer does its job for six years.

Which one was actually cheaper?

Computers are tools. For most office employees, they’re probably the single tool they use more than anything else during the workday. If you’re paying someone for eight hours of their time, making them spend part of those eight hours waiting for an underpowered computer because you saved a few hundred dollars on the purchase doesn’t make a lot of sense.

And nobody has ever called us complaining that their computer is too fast.

Buy the computer you need, not the cheapest one that runs Windows

None of this means every business needs expensive computers. It means businesses should buy computers based on what their employees actually need and how long they expect those computers to remain productive.

Sometimes the right answer is a moderately priced new business PC. Sometimes a more powerful system is appropriate. As our healthcare client discovered, sometimes even a properly selected refurbished business computer is a much better choice than a brand-new bargain-basement machine.

What matters is what’s inside it, how it’s supported, and whether it’s appropriate for the person who’s going to use it.

Because six months after you buy a computer is a terrible time to discover that you saved money on the wrong thing.

Most small businesses have policies. They just aren’t written down. They’re stored in the owner’s head, buried in an old email, mentioned during somebody’s first week, or summed up with, “That’s just how we do things here.” And for a surprisingly long time, that can work just fine. Right up until it doesn’t.

When I talk about written policies with small businesses and nonprofits, I can almost see the eyes starting to glaze over. The word policy sounds corporate. It sounds like an employee handbook nobody reads, a compliance department you don’t have, or a 47-page document written by an attorney where every third sentence starts with “whereas.” If you’ve got six employees, or maybe it’s just you, that can feel like ridiculous overkill.

But a good policy doesn’t need to be complicated. At its simplest, a policy is just a decision you’ve already made and bothered to write down. That’s it. And that matters a lot more than most small businesses realize.

You’re Making These Decisions Anyway

Think about some of the technology decisions happening inside a business every day. Can employees use their work computer for personal stuff? Can they install software themselves? Can they use ChatGPT or another AI tool with company information? Who gets access to the accounting system? Does everyone have to use MFA? What happens to someone’s accounts when they leave? Who gets called if someone clicks on something they shouldn’t have?

If you haven’t answered those questions, it doesn’t mean your business doesn’t have a policy. It usually means each employee gets to make the policy for themselves. One employee might think putting company files in their personal Dropbox is perfectly reasonable. Another might paste customer information into an AI tool because nobody ever told them not to. Someone else might share a password with a coworker because it’s faster than asking for another account. None of them necessarily think they’re doing anything wrong. The business simply never drew the line.

That’s one of the biggest reasons I like written policies. They eliminate a lot of conversations that begin with “I thought...” I thought that was allowed. I thought somebody disabled his account. I thought OneDrive was our backup. I thought we could all use the same password. I thought IT was supposed to handle that.

“I thought” can become two very expensive words.

Make the Decision Before Something Is on Fire

There’s another reason written policies matter that has nothing to do with employees following rules. They force you to make decisions while you actually have time to think about them.

The worst possible time to decide how your business responds to ransomware is while you’re staring at the ransom note. That’s when people panic. Phones start ringing, someone starts unplugging things, somebody else starts trying to restore something, the owner calls IT, another employee calls the insurance company, and someone decides this would be an excellent time to post something on Facebook. Now you’ve got the original problem plus three or four new ones you’ve created for yourself.

Compare that with a business that has already made those decisions. If we have a cybersecurity incident, we know who gets called first. We know who is responsible for communicating with employees and customers. We know where our backups are and who is responsible for recovery. If we have cyber insurance, we know what the carrier requires us to do before anyone starts changing things.

You don’t have to invent the process during the emergency because you already did the thinking on a boring Tuesday afternoon when nothing was wrong. That’s really what a useful policy does. It lets Calm You leave instructions for Panicked You.

“But It’s Just Me”

This is usually where the solopreneurs get to feel smug for a minute. “I don’t have employees. Who am I writing a policy for? Myself?”

Yep.

In some ways, written policies can be even more valuable when you’re the entire company because there’s nobody else around forcing you to make these decisions. Do you require MFA on every important business account? Where are your business files stored? What actually gets backed up? What information will you never put into a public AI system? If your laptop disappears tomorrow, what happens next? If you’re unexpectedly unavailable for a week, can someone you trust get to the information necessary to keep the business running?

Maybe you know all those answers right now, but will you remember every detail six months from now when you’re dealing with an emergency? More importantly, does anybody else know them? Writing this stuff down isn’t bureaucracy. Sometimes it’s simply doing your future self a favor, because Future You is already going to be having a bad enough day.

We Decide. We Document. We Enforce.

I’ve started using a very simple framework when talking about technology policies: We decide → We document → We enforce.

First, we decide. Leadership decides what the rule actually is. Not IT, not the employee who happens to know the most about computers, and not whoever encounters the problem first. Technology can help implement and enforce a rule, but the business needs to decide what that rule should be.

Then, we document. Write it down somewhere people can actually find it, and please write it in English. If your employees need an attorney and a decoder ring to understand the acceptable use policy, they’re not going to follow it. A useful policy doesn’t have to be twenty pages long. Depending on the subject and the size of the business, it might only need to be a page or two.

Finally, we enforce. This is the part businesses sometimes forget. If your written policy says everyone uses MFA but the owner doesn’t because it’s inconvenient, that’s not really your policy. If the policy says employees can’t share passwords but everyone knows the accounting login is written on a Post-it note under Karen’s keyboard, that’s not your policy either. A policy you don’t enforce is just a document taking up space.

You Don’t Need Fifty Policies

The other mistake small businesses make is assuming that once they start down this road, they’re going to need a giant binder full of policies. You don’t. Start with the areas where a bad assumption could seriously hurt the business.

For most small organizations, I think there are four technology policies worth putting at the top of the list. An Acceptable Use Policy answers how company computers, accounts, internet access, email, and AI tools can be used. It establishes what is okay, what isn’t, and what information should never leave the company. A Password & Access Policy establishes how accounts are protected, where MFA is required, who gets access to what, and who approves that access.

An Incident Response Plan answers the big question nobody wants to think about: What do we do when something goes wrong? If you carry cyber insurance, that includes knowing what your policy requires you to do first. If you don’t, you still need to know who that first call is going to be and what happens next. Finally, an Employee Offboarding Checklist makes sure someone’s access to your company ends when their employment does. Not next week, not when somebody remembers, but as part of a defined process when they leave.

None of those need to start as enormous documents. They need to start as decisions.

The Policy Isn’t the Point

The goal isn’t to be able to brag that your company has written policies. The goal is consistency. You don’t want your cybersecurity strategy changing depending on which employee gets the suspicious email. You don’t want access removed from former employees only when somebody happens to remember. You don’t want to figure out your incident response process while an attacker is sitting inside your network, and you definitely don’t want your company’s rules to exist only inside one person’s head.

That’s why written policies matter whether you have one employee, ten employees, or a hundred. Decide what you’re going to do, write it down, and then actually do it. We decide. We document. We enforce.

It doesn’t need to be complicated. It just needs to stop being something everybody thought they knew.

A long time ago, when I was just getting started in IT, I was sent to an employee’s desk to troubleshoot a recurring problem with their computer. There was just one problem: the employee wasn’t there that day, and this was long before you could solve that problem with a quick text message. I needed to get into the computer, didn’t have the password, and couldn’t reach the person who did.

I could have given up and come back another day, but I figured I’d check the obvious first.

I lifted up the keyboard.

Stuck to the bottom was a Post-it note with a single word written on it. I tried it as the password and, of course, I was in.

The funny part is that even back then I wasn’t particularly surprised. Hiding your password under the keyboard was apparently considered secure because nobody could see it unless they picked up the keyboard. It was the office equivalent of hiding the spare house key under the doormat.

You’d like to think we’ve gotten better at passwords since then. In some ways we have, but I’m not convinced we’ve gotten as far as we think. The Post-it note may have become a notebook in a desk drawer, an Excel spreadsheet called Passwords.xlsx, a Word document, or a note on someone’s phone. Plenty of people have also solved the problem by using basically the same password everywhere, changing a number or adding an exclamation point whenever a website complains.

The technology has changed quite a bit since I found that Post-it note. The basic problem really hasn’t.

We’ve spent decades asking people to create dozens, and now sometimes hundreds, of long, complex, unique passwords and somehow remember all of them. That’s simply not realistic. People aren’t necessarily being careless when they come up with shortcuts. They’re trying to make an unmanageable system manageable.

Unfortunately, most of those shortcuts also make their accounts less secure.

There is a much better solution, and it’s probably the single piece of security software I’d recommend to just about everyone: a password manager.

Stop Trying to Remember Your Passwords

This sounds a little backwards, but one of the first things I tell people about password security is that you really shouldn’t know most of your passwords. If you can sit down and tell me the passwords for your bank, Microsoft 365, Amazon, Facebook, insurance company and another 30 accounts, there’s a pretty good chance you’re reusing passwords or following some sort of predictable pattern.

Maybe Fluffy2026! becomes Fluffy2026!! when you’re forced to change it. Maybe you’ve developed a system where the name of the website becomes part of the password. Those tricks make passwords easier for you to remember, but they also make them much easier to predict. More importantly, if you’re using the same password on multiple sites, one compromised account can quickly become a much larger problem.

A password manager changes the way you approach the whole thing. Instead of creating passwords you can remember, you let the password manager generate long, random, unique passwords for every account. A password can be 20 or 30 characters of complete gibberish because you don’t need to know what it is. You only need to protect your password manager with a strong master password, and it remembers everything else for you.

That also means there’s no good reason to reuse passwords anymore. If some random website you created an account with five years ago suffers a breach, the username and password exposed in that breach should only work on that one website. Attackers routinely take stolen credentials and automatically try them against Microsoft 365, Google, banking sites, social media and other services because they know people reuse passwords. It’s called credential stuffing, and unfortunately it works.

With unique passwords, that chain gets broken. You still need to change the password on the site that was breached, but you’ve turned what could have been a compromise of several accounts into a problem with one account.

Give the Post-it Note a Well-Earned Retirement

I’ve been doing IT for a long time, and I’ve seen just about every possible system for storing passwords. I’ve seen Post-it notes attached to monitors, passwords hidden under keyboards, notebooks kept in desk drawers, Word documents, spreadsheets and text files sitting on desktops. I’ve even seen people get creative about where they hide them, although “creative” doesn’t necessarily mean “secure.”

The problem with all of these approaches is that you’re storing some of the most valuable information you have in something that was never designed to protect it. A password manager gives you a secure, encrypted place specifically designed for storing credentials. It can also automatically fill those credentials into websites and applications, which means you don’t have to constantly look them up, copy them, type them or even see them.

Password managers can also make multifactor authentication easier to live with. I’m a big believer in MFA, particularly for important business accounts, but I also understand that every additional security step creates some amount of inconvenience. Modern password managers can help manage passkeys, authentication codes and recovery information in addition to passwords. There are situations where keeping the second authentication factor completely separate is the better security choice, particularly for highly sensitive accounts, but for many people there is a practical benefit to making MFA simple enough that they will actually use it consistently.

Security has to work in the real world. The theoretically perfect security system doesn’t do much good if it’s so inconvenient that everyone finds a way around it.

Password Managers Are Even More Important for Businesses

For a business, a password manager solves a problem that goes beyond creating better passwords. It helps answer a surprisingly important question: Who actually owns your company’s accounts?

Businesses accumulate an incredible number of accounts over the years. There’s the domain registrar, website, social media, internet provider, copier company, payroll system, insurance portals, utilities, vendors and dozens of software subscriptions. New accounts get created whenever they’re needed, and quite often the person who created the account becomes the unofficial keeper of the password.

Everything works fine until that person leaves.

Then six months later somebody needs to make a change and the conversation starts with, “Does anyone know what Susan used for the GoDaddy password?” Someone searches old emails. Somebody else checks a spreadsheet. Eventually someone texts Susan and hopes she’s still willing to help.

If your company’s password management strategy depends on tracking down a former employee, you don’t have a password management strategy.

A business password manager allows those credentials to belong to the organization instead of an individual employee. Accounts can be organized into shared vaults, employees can be given access to the credentials they need for their jobs, and that access can be changed as their responsibilities change. When someone leaves the company, their access can be removed. When their replacement starts, the appropriate access can be assigned to the new employee without recreating the entire collection of passwords from scratch.

That’s obviously good for security, but it’s also good business continuity. Your company shouldn’t lose access to an important service because the person who originally created the account left three years ago.

It also gives businesses a much better way to share credentials. Emailing or texting someone a password may be convenient, but now that credential is sitting indefinitely in someone’s mailbox or message history. Maybe it gets forwarded, maybe someone takes a screenshot, or maybe nobody remembers six months later exactly who received it. A business password manager allows you to grant access through the system designed to protect the credential and remove that access when it’s no longer needed.

One Change That Fixes a Lot of Problems

Cybersecurity can get complicated very quickly. Businesses need to think about endpoint protection, email security, backups, identity management, monitoring, policies, employee training and plenty of other layers. A password manager doesn’t replace any of those things, and simply installing one isn’t going to magically make a business secure.

What I like about password managers is that they’re one of those relatively rare security improvements that solve several common problems at the same time. They help eliminate password reuse, make long and complex passwords practical, provide a secure place to store credentials, make MFA and passkeys easier to manage, and give businesses control over credentials that might otherwise walk out the door with an employee.

At Mighty Manatee IT, we provide 1Password Enterprise to our managed clients because we think password management is an important part of a company’s overall security posture. It’s not particularly flashy technology, and nobody is going to get excited at the company Christmas party because you rolled out a password manager. What it does is solve a very old problem in a practical way.

We’ve spent years telling people they need to create better passwords and then expecting them to somehow remember all of them. Maybe the better answer is to stop expecting people to remember passwords in the first place.

Let the password manager do that.

And if you have a notebook sitting next to your computer with PASSWORDS written across the front, you can finally retire it.

Please don’t throw it away until you’ve moved the passwords first.

A client called me recently with one of those random computer problems that is difficult to describe. Something wasn’t working quite right, there wasn’t an obvious error message, and nothing had dramatically failed. It was just being weird.

One of my first questions was, “When was the last time you restarted your computer?”

The answer was about a week ago.

Because we manage their computers, I could actually check. It had been three weeks.

I’m not telling that story to pick on the client. Three weeks without a restart isn’t unusual. I’ve seen computers go considerably longer. But it did lead to a conversation about something we probably don’t explain often enough: why are we so insistent that people restart their computers?

There is actually a good reason. Several of them, in fact.

Restarting is part of keeping your computer secure

This is the big one.

Your computer receives updates on a regular basis, and many of those updates aren’t just adding features or fixing minor annoyances. They’re fixing security vulnerabilities discovered in Windows, applications, drivers and other components of the computer.

A lot of the update process can happen quietly in the background. Updates can be downloaded, prepared and even partially installed while you’re working. But there are parts of Windows that can’t safely be replaced while they’re being used.

That’s where the restart comes in.

During a restart, Windows gets an opportunity to shut down those components and complete changes that couldn’t be made while the computer was running. Until that happens, you can end up with an update that is downloaded and waiting but isn’t completely applied.

From our side, we can monitor the computer. We can make sure patches and updates are being deployed. We can see when something hasn’t installed correctly. We can do a lot of the work without you ever knowing we’re doing it.

But eventually the computer needs to restart.

That’s why our clients sometimes see a message from us telling them that their computer has a pending reboot. You can postpone that message twice because we understand that rebooting five minutes before a Zoom meeting or in the middle of finishing a proposal isn’t particularly helpful.

After that, though, the reminder stays.

We’re not trying to annoy you. We’re trying to get the computer into the state it needs to be in so the work we’ve already done to protect it can actually finish.

In other words, restarting your computer is part of your security posture.

Restarting also clears out a lot of accumulated junk

Security isn’t the only reason.

Think about everything that happens on your computer during a normal workday. You open and close programs. Browser tabs come and go. Applications update themselves. Services run in the background. Drivers interact with hardware. Programs allocate memory and don’t always give all of it back cleanly.

Now multiply that by several days.

Most modern computers are remarkably good at keeping all of that running, but they’re not perfect. Applications can develop memory leaks. Processes can get stuck. Services can stop responding properly. A driver can get itself into a strange state. Something that worked perfectly Monday morning can be acting just a little bit odd by Friday afternoon.

A restart gives the computer a clean starting point. Running applications and processes are stopped, memory is cleared, services reload and Windows starts fresh.

That’s also why “Have you restarted it?” is one of the first questions IT people ask.

It’s not because we’ve run out of ideas.

A restart eliminates an enormous number of temporary conditions at once. If the problem disappears afterward, we’ve learned something. If it doesn’t, we’ve also learned something and can move on to figuring out what is actually wrong.

It’s troubleshooting, not an exorcism. Although some days the distinction gets a little blurry.

“But I shut my computer down every night”

Good. Except there’s a Windows wrinkle here that catches a lot of people.

Shut Down and Restart aren’t necessarily the same thing.

Modern versions of Windows can use a feature called Fast Startup. When it’s enabled, shutting down doesn’t always completely shut down Windows in the traditional sense. Windows saves some system information so the computer can start faster the next time you turn it on.

That’s useful, but it also means shutting down and turning the computer back on isn’t always the same clean reset as choosing Restart.

When you choose Restart, Windows performs a more complete shutdown of the operating system and reloads it. That’s what we want when we’re troubleshooting a problem or trying to make sure pending updates have been completed.

So when your IT person asks you to restart, don’t shut the computer down and turn it back on.

Actually click Restart.

Yes, it matters.

“But I have everything open”

This may be the number one reason people keep postponing a restart.

You have six applications running, 14 documents open and enough browser tabs that Chrome has stopped displaying the names on them. Everything is exactly where you want it, and restarting means disturbing the ecosystem you’ve spent the entire week creating.

I get it.

Fortunately, modern applications are much better at dealing with this than they used to be. Browsers can restore sessions. Microsoft 365 applications regularly save your work. Many applications will reopen where you left off.

That doesn’t mean you should blindly restart with unsaved work sitting on the screen. Save what you’re working on first.

But keeping a computer running for weeks because you don’t want to reopen your applications isn’t a particularly good trade, especially when security updates are waiting for that restart.

So how often should you restart?

Our preference is simple: restart your computer every night.

That’s not always going to happen, and we’re realistic about that. At an absolute minimum, we’d like to see it restarted once a week.

And if you see a notification from us telling you there’s a pending restart, don’t ignore it indefinitely. Finish what you’re doing, save your work and restart the computer when you get a reasonable opportunity.

That notification means there’s a reason we’re asking.

Technology has gotten very good at taking care of itself in the background. We can remotely monitor computers, install updates, detect threats and handle a tremendous amount of maintenance without interrupting your work.

But there are still a few things that require the person sitting in front of the computer to participate.

Sometimes the most important thing we need you to do is also the simplest.

Click Restart.

Most small businesses don’t need an IT department. If you have 10, 20, or 30 employees, hiring a full-time IT person probably doesn’t make financial sense, much less building an entire department with people responsible for support, cybersecurity, cloud services, networking, backups, and everything else that has become part of business technology.

Where small businesses sometimes get into trouble is making the leap from “we don’t need an IT department” to “we just need somebody to call when something breaks.”

Those aren’t the same thing.

There’s a big difference between having someone who can fix your computers and having someone responsible for managing your technology. Twenty or thirty years ago, the first option might have been enough for a lot of small businesses. Today, it usually isn’t.

The IT Guy Isn’t an IT Strategy

For decades, small-business IT was pretty straightforward. You bought some computers, found somebody who knew more about them than you did, and kept their phone number handy. If a computer broke, the printer stopped working, or you couldn’t get your email, you called the IT guy.

There’s nothing inherently wrong with that arrangement. Having someone capable of fixing a problem when it happens is useful. The problem is that modern business technology has become much bigger than fixing computers.

Even a fairly small company may now depend on Microsoft 365 or Google Workspace, cloud applications, laptops, mobile devices, networks, backups, security systems, multifactor authentication, software subscriptions, and a growing collection of online accounts. Employees come and go, computers get older, software reaches end of support, and new security threats appear constantly. Most of this needs attention long before somebody calls to say something isn’t working.

That’s the fundamental difference between break/fix IT and managed IT. The person you call when the computer breaks has an incentive to fix the computer. The person responsible for managing your IT has an incentive to keep it from breaking in the first place.

Sometimes Everything Looks Fine Until It Isn’t

We worked with a nonprofit that initially used us for its networking infrastructure and occasional support, while an in-house “IT guy” handled its computers. That arrangement seemed to be working, and from the organization’s perspective there wasn’t much reason to change it.

Then one of their primary operations employees was hit with ransomware.

This wasn’t a spare computer sitting in the corner. It was a system being used every day by someone important to the organization’s operations, and there was no backup or recovery plan for it. Suddenly the problem wasn’t simply removing malware and getting a computer running again. The organization had to worry about the data on that computer and whether it could be recovered.

After the ransomware incident, they asked us to take over management of their computers as well.

As part of onboarding, we inventoried and evaluated their systems. What we found was almost as concerning as the ransomware incident itself: roughly 30% of their computers were running operating systems that were so old they were no longer supported.

The computers weren’t necessarily broken. They turned on every morning and people were using them to work, which is why the problem had been easy to overlook. But an unsupported operating system isn’t receiving the security updates and support that a business should be relying on.

Nothing had failed yet. That didn’t mean everything was fine.

“It Still Works” Isn’t a Lifecycle Management Plan

Small businesses are remarkably good at keeping computers alive. I understand the thinking. If a computer turns on every morning and the employee sitting in front of it can still do their job, replacing it can feel like spending money to solve a problem you don’t have.

Unfortunately, computers have a lifecycle whether you plan for it or not. Hardware warranties expire, operating systems eventually stop receiving security updates, applications stop supporting older versions, and aging computers become slower and less reliable. Eventually, something that could have been replaced on your schedule becomes an emergency because it finally dies on a Tuesday morning when someone has a deadline.

When we discovered how many outdated systems the nonprofit had, telling them to immediately replace 30% of their computers wouldn’t have been particularly useful. They had a budget to work within, as every nonprofit and small business does.

Instead, we developed a three-year replacement plan. We identified the systems presenting the greatest risk, prioritized what needed to be addressed first, and spread the remaining replacements across future budgets. They went from waiting for computers to fail randomly to knowing what needed to be replaced and when.

That’s lifecycle management. Someone should know what technology your business has, how old it is, whether it’s still supported, when warranties expire, and what needs to be replaced next. You shouldn’t have to wait for smoke to come out of something to discover that it’s old.

Cybersecurity Has Changed What Small Businesses Need

Cybersecurity is probably where the old “call the IT guy when something breaks” model has become most outdated.

There was a time when small-business cybersecurity mostly consisted of antivirus software, a firewall, and repeatedly telling employees not to click on things they shouldn’t. We still tell employees not to click on things they shouldn’t, with varying degrees of success, but everything else has changed considerably.

Modern cybersecurity relies on multiple layers. There may be protection on the computer itself, email security, identity and account monitoring, multifactor authentication, backup, security awareness training, vulnerability management, and systems watching for suspicious behavior. If one layer misses something, another layer should have an opportunity to catch it.

Some of the security technologies available through managed IT providers are the same kinds of tools and services used by much larger organizations. Others are specifically designed to be delivered through IT and security providers and may not even be practical for a small business to purchase and operate independently.

Access to the tools is only part of the advantage. Someone still needs to configure them, maintain them, monitor the alerts they generate, investigate suspicious activity, and know what to do when something actually happens. Buying cybersecurity software is relatively easy. Building the people, processes, and expertise around it is the expensive part.

That’s one of the reasons managed IT makes sense for a smaller organization. You’re effectively sharing access to technology and expertise that would be difficult to justify building internally for a company with 15 employees.

Security Problems Don’t Wait Until Monday Morning

Cybersecurity also creates a staffing problem that most small businesses can’t reasonably solve themselves.

Attackers don’t particularly care what your office hours are. If something suspicious happens at 2:00 Sunday morning, waiting for somebody to notice it when they get to work Monday isn’t a great response plan.

A properly equipped managed IT provider can have security systems monitored around the clock, with security professionals available to investigate and respond when those systems detect a threat. That’s very different from expecting a small business owner, office manager, or lone IT employee to keep an eye on security alerts all weekend.

That doesn’t mean someone needs to be standing by at 2:00 AM because Bob can’t print.

There’s a difference between providing 24/7 help desk support and providing 24/7 security monitoring. Most small businesses probably don’t need the first. Increasingly, they do need the second.

Somebody Needs to Be Responsible for the Whole Picture

Ultimately, that’s what I think businesses should expect from managed IT. It’s not simply an arrangement where you pay a monthly fee instead of receiving an invoice every time somebody fixes a computer.

Someone needs to be responsible for looking at the entire technology environment.

That means keeping computers patched and supported, monitoring backups, managing employee access, keeping an eye on security, maintaining the network, tracking warranties and equipment age, managing Microsoft 365 or Google Workspace, and planning for what needs to be replaced or changed in the future. It also means understanding how those pieces affect each other instead of treating every problem as an isolated support ticket.

In a large company, an IT department handles those responsibilities. There might be separate people responsible for security, networking, cloud services, support, and planning. A small business obviously isn’t going to hire five different technology specialists.

The responsibilities don’t disappear just because you only have 15 employees.

That’s really the problem managed IT is supposed to solve. It gives a smaller business access to many of the capabilities of an internal IT department without having to build one.

Managed IT Should Be About More Than Support

When businesses compare IT providers, it’s easy to focus on support because that’s the part employees see. When something isn’t working, they want somebody to fix it, and preferably before they’ve rebooted the computer four times and started threatening it.

Support absolutely matters. Downtime costs money and frustrates everyone involved.

But I don’t think the number of support tickets an IT company closes is the best measure of whether your technology is being managed well. Over time, good IT management should make your technology more predictable. Aging equipment should be identified before it fails. Security risks should be addressed before they become incidents. New employees should get the access they need, departing employees should lose access promptly, and backups should exist before ransomware makes everyone suddenly interested in whether there is a backup.

There will always be unexpected problems. Technology has been keeping me employed for more than four decades largely because it continues finding creative new ways to misbehave.

The goal isn’t to eliminate every problem. It’s to eliminate as many preventable ones as possible and have a plan for dealing with the rest.

So What Should You Expect?

You don’t need to become an IT expert to figure out whether your technology is actually being managed. You just need to ask a few questions.

Ask whoever handles your IT how they know when your computers need to be replaced. Ask what happens if a security threat is detected after hours. Ask whether your backups are monitored and what the recovery plan is if something happens. Ask who is responsible for making sure your computers and software remain current and supported.

Most importantly, ask what they’re doing when you’re not calling them with a problem.

That’s where the difference between IT support and IT management becomes pretty obvious.

A small business doesn’t need to recreate the IT department of a 500-person company. It would be expensive, unnecessary, and probably involve far more meetings than any reasonable person should have to endure.

But a small business still needs support, planning, cybersecurity, monitoring, lifecycle management, backup, and someone taking responsibility for how all of those pieces work together.

Your business may be too small to have an IT department.

It isn’t too small to have its technology properly managed.

There’s an assumption I hear from business owners all the time: “Our stuff is in the cloud, so it’s backed up.”

Unfortunately, those are two very different things.

Microsoft 365 and Google Workspace do an excellent job of keeping your email, documents, calendars, and other business data available. They operate massive, redundant systems designed to keep their services running even when hardware fails or something goes wrong behind the scenes.

But keeping Microsoft 365 or Google Workspace running is not the same thing as keeping an independent backup of your business data. That distinction usually doesn’t seem very important until something disappears.

We Learned This One the Hard Way

Several years ago, we had a client with an employee who decided to leave the company. Before leaving, they deleted their email and files, then went into the cloud-based recycle bin and emptied that too. This wasn’t somebody accidentally dragging the wrong folder into the trash. It was deliberate.

By the time anyone realized what had happened, the employee was gone, along with a significant amount of company data. Fortunately, the client had an independent backup, so what could have been a disaster became a recovery job instead.

That experience reinforced something we already knew. If your only copy of your cloud data is the copy sitting in the cloud service itself, you don’t really have a backup.

Cloud Storage and Cloud Backup Aren’t the Same Thing

Part of the confusion comes from the fact that Microsoft 365 and Google Workspace have features that feel a lot like backup. There are recycle bins, deleted-item recovery options, version histories, and various retention capabilities. Those are all useful, and there are plenty of situations where they can save the day.

The problem is that they are still part of the same environment where your production data lives. Their availability also depends on what happened, how the system is configured, and how much time has passed before someone realizes something is missing.

A true backup gives you another copy of that data, with its own retention and recovery capabilities.

Think about an important document in a filing cabinet. If you make a photocopy and put it in another drawer of the same filing cabinet, you technically have two copies. But if somebody walks off with the filing cabinet, you have zero copies.

Cloud backup is about having another filing cabinet.

Sometimes It’s Just a Mistake

Not every data-loss story involves a disgruntled employee or a hacker in a dark room wearing a hoodie. Most businesses employ humans, and humans occasionally delete things they shouldn’t.

Someone cleans up an old folder without realizing another employee still needs it. Someone deletes an email they thought was unimportant. A shared folder gets reorganized and something important disappears in the process. Usually somebody notices fairly quickly, but sometimes they don’t.

That last part matters. Finding out that a file was deleted yesterday is very different from discovering that a folder disappeared six months ago. Recovery features that might have helped immediately may no longer be useful by the time someone notices.

So the important question isn’t just, “Can we recover a deleted file?” It’s, “How far back can we recover it?”

Sometimes It Isn’t a Mistake

Then there are situations like the client I mentioned earlier.

Businesses have to give employees access to company information so they can do their jobs. Depending on their role, that can mean access to thousands of emails, customer records, shared folders, documents, spreadsheets, and years of institutional knowledge.

Most departing employees aren’t going to intentionally destroy company data. But “most” isn’t much comfort when you’re dealing with the one who does.

There are also less malicious versions of the same problem. Someone leaving the company may delete files because they mistakenly believe those files belong to them. An employee account might be compromised and used by someone else. Someone with legitimate access can simply make a very large mistake.

Good account management, permissions, security monitoring, and offboarding procedures can reduce those risks. Independent backup gives you another option when those controls aren’t enough.

And, Of Course, There’s Ransomware

You can’t talk about protecting business data without talking about ransomware.

Cloud services aren’t magically immune from cyberattacks. If an attacker gains access to an employee account, they may be able to do many of the same things the employee can do, including changing, deleting, or moving information. Files synchronized between a computer and cloud storage can create additional problems when compromised or encrypted data gets synchronized.

That’s why good cybersecurity uses layers. Multifactor authentication, endpoint protection, email security, properly configured permissions, monitoring, and employee training all reduce the chances of an attack succeeding.

But no security system is perfect.

Backup is what you have when prevention doesn’t work.

Don’t Forget About Email

When I talk to businesses about backup, files are usually the first thing they think about. They picture Word documents, Excel spreadsheets, PDFs, accounting exports, customer folders, and everything stored in OneDrive, SharePoint, or Google Drive.

Email often gets overlooked, which is strange when you consider how much business happens there.

Think about what’s sitting in the average employee’s mailbox. There are customer conversations, approvals, attachments, project histories, financial discussions, vendor information, contracts, scheduling details, and countless decisions that nobody ever documented anywhere else.

For many small businesses, email has quietly become an unofficial filing system.

That’s why protecting Microsoft 365 or Google Workspace shouldn’t mean protecting only the files. Email is business data too, and losing years of it can be every bit as disruptive as losing a shared drive.

Doesn’t Microsoft or Google Back This Stuff Up?

This is usually where someone asks the obvious question: “But Microsoft and Google back everything up, right?”

The better way to look at it is that Microsoft and Google are responsible for operating their platforms. You’re responsible for your business’s data.

If a server in one of Microsoft’s data centers dies, you don’t expect half your mailbox to disappear. Google doesn’t expect you to understand which physical piece of hardware contains a particular Google Drive file. They build resilient infrastructure so those kinds of failures aren’t your problem.

That’s different from your employee deleting three years of email.

Your problem isn’t keeping Microsoft 365 running. Your problem is being able to say, “We need this employee’s missing emails back,” or “We need the version of this folder from before somebody changed it,” or even, “Something happened Tuesday afternoon. Can you put our data back the way it was Monday?”

That’s backup and recovery.

The Important Part Isn’t Actually the Backup

There’s another mistake businesses make when thinking about backup: focusing entirely on whether a backup exists.

Having a backup isn’t the goal. Being able to recover from something is the goal.

If something happens tomorrow morning, how quickly can you get the business functioning again? Can you restore a deleted email? Can you retrieve an older version of a document? Can you recover an entire employee’s mailbox and files? How far back can you go? And does anyone actually know how to perform the recovery?

Those are business continuity questions, not just IT questions.

A backup that can’t be restored when you need it is just a collection of files taking up storage space.

Three Questions Worth Asking Your IT Provider

You don’t need to become a cloud-backup expert. That’s what you have an IT provider for.

But there are three questions every business owner should be able to get straightforward answers to:

1. Is our Microsoft 365 or Google Workspace data independently backed up?

2. How far back can we recover deleted or changed email and files?

3. If we needed something restored tomorrow, what would that process look like?

If the answer to the first question is, “Microsoft takes care of that,” “Google takes care of that,” or “There’s a recycle bin,” I’d keep asking questions.

The worst time to discover the difference between cloud storage and cloud backup is five minutes after you desperately need the backup.

The cloud is a great place for your business data. Microsoft 365 and Google Workspace have transformed the way small businesses work, and I wouldn’t want to go back to the days when everything lived on a server in the closet.

Just make sure the cloud isn’t the only place your business data exists.

There are certain things I see in business that immediately make me wonder what else is being overlooked.

A business using a free Gmail, Yahoo, or AOL address is one of them.

I’m not talking about Google Workspace. Google Workspace is a business email platform that can use your company’s domain. I’m talking about putting yourbusiness@gmail.com on your website, business card, invoice, or the side of your truck when you already own yourbusiness.com.

I’ve been complaining about this for years, so I might as well put it in writing.

It Starts With How Your Business Looks

Imagine you’re considering two companies you’ve never worked with before. One emails you from glenn@mightymanatee.com. The other emails you from mightymanateeit@gmail.com.

Everything else being equal, which one looks more established?

That’s the simplest argument for using business email, but I don’t actually think it’s the most important one. A professional email address certainly makes a better first impression, especially when you’re asking someone to trust you with their money, their business, or their information.

But looking professional is only the beginning.

Your Business Email Should Belong to Your Business

This is where my bigger objection to free email starts.

A business needs to own and control its email accounts.

If you have employees using personal Gmail accounts for company business, who actually owns those messages? What happens when an employee leaves? Can you immediately shut off their access? Can you preserve their email? Can another employee take over conversations with customers?

With a properly managed Microsoft 365 or Google Workspace environment, the business controls the accounts. When someone joins the company, an account can be created for them. When they leave, access can be removed and the company can retain control of its business information.

That’s not just an IT issue. That’s basic business continuity.

You wouldn’t let an employee take the company filing cabinet home and keep the only key. Your email shouldn’t work that way either.

One Email Address Isn’t a Business Email System

Sometimes I’ll see a small business that has taken the first step and created something like companyname@gmail.com. Everyone in the company uses it, so they figure the problem is solved.

It isn’t.

Now five people know the same password. Nobody really knows who sent what. Multifactor authentication becomes inconvenient, so there’s a temptation to weaken it or work around it. When someone leaves the company, you have to change credentials everywhere. And if that one account gets compromised or locked out, everybody has a problem at the same time.

Shared passwords are not an email strategy.

Every person who needs business email should have their own account. Addresses such as info@, sales@, or billing@ can still exist, but they can be configured so the appropriate people have access without everyone pretending to be the same person.

That gives you accountability, control, and a much easier time when employees come and go.

Security Is a Big Part of This

Business email is one of the primary ways attackers get into small businesses. Phishing, stolen passwords, fake invoices, malicious attachments, and impersonation attempts arrive in inboxes every day.

Microsoft 365 and Google Workspace give businesses administrative and security controls that simply aren’t available when everyone is doing their own thing with personal accounts. You can require multifactor authentication, manage access, establish security policies, monitor accounts, and respond when something suspicious happens.

More importantly, you can apply those protections consistently across the company.

That’s difficult to do when one employee uses Gmail, another has Yahoo, the owner has an AOL address they’ve had since 1997, and somebody else is forwarding everything to their personal account.

Technology has moved on. Your business should too.

You Already Own the Domain

This is the part that makes free business email particularly hard for me to understand.

A lot of businesses doing this already own a domain.

They have a website at yourbusiness.com, but their email address is yourbusiness@gmail.com.

You’ve already done the hard part. You have the company name. You have the domain. You’re probably paying for the website. Yet one of the primary ways customers communicate with your company is still being handled through a free consumer account.

Professional business email isn’t some exotic enterprise technology anymore. Microsoft 365 and Google Workspace have made it practical for even very small businesses.

If you’re running an actual business, email is one of the basic operating expenses.

“But I’ve Used This Address for Years”

This is probably the objection I hear most often.

You’ve had the Gmail address forever. All your customers know it. It’s on your business cards. It’s connected to various accounts. Changing it sounds like a giant pain.

Fair enough.

But switching to a business email address doesn’t mean your old address has to disappear at midnight.

You can move to the new address gradually. Start using the business address for new conversations. Update your website, invoices, business cards, social media profiles, and other public listings. Let existing customers get accustomed to seeing the new address.

The old account can continue to receive messages during the transition.

You don’t have to rip off the Band-Aid. You just have to start.

This Isn’t Really About Email

After working in technology for a very long time, I’ve found that small things can tell you a lot about how a business handles technology.

Using a free email account doesn’t automatically mean a business is poorly run. There are plenty of excellent small businesses still using them simply because that’s how they started and nobody has ever given them a reason to change.

But technology decisions that made sense when you were starting out don’t necessarily make sense five or ten years later.

Your business grows. You hire people. You accumulate customer information. You become more dependent on email. Security becomes more important. The consequences of losing access to an account get much bigger.

At some point, the technology needs to grow up with the business.

If You’re Still Using Free Email, Start Here

You don’t need to understand the technical differences between Microsoft 365 and Google Workspace before doing anything. Start with a few basic questions.

Does your business own its domain? Are employees using company-controlled email accounts? Does each person have their own login? Is multifactor authentication required? And when an employee leaves, can the business immediately remove their access while keeping the company’s email and information?

If you can’t confidently answer those questions, it’s worth having a conversation with whoever handles your IT.

And if your business already owns its domain but you’re still handing out a Gmail address?

It’s time.

Your domain isn’t just for your website. Use it.