When we conduct initial assessments for new clients across Western New York, the findings follow a consistent pattern. Not because these businesses are careless — they’re not. These gaps are structurally common in organizations that haven’t had proactive IT management, and they almost never surface until something goes wrong. Here are the five we encounter most frequently, what makes each one genuinely dangerous, and what the fix looks like in practice.
Mistake 1: No Documentation
In the large majority of initial assessments, critical IT information exists in someone’s memory or on a piece of paper somewhere. The admin password to the firewall. The credentials for the backup software dashboard. The configuration settings for a server that hasn’t been touched in three years. The renewal dates for software licenses that will expire without warning.
The risk isn’t just inconvenience. When the person who holds this information is unavailable — sick, on vacation, or no longer employed — the organization is operationally exposed in ways that may not become apparent until a critical moment. When a security incident demands rapid response, spending 45 minutes tracking down the administrative credentials for the device you need to access is a serious liability that compounds the damage.
In one particular incident, the “IT guy” retired and with him, so too went the passwords. We were recently called to a new client with the initial scope being; to determine why various secondary devices like printers were no longer connecting to the network. When we arrived onsite to review the scene and investigate, it was determined that no passwords that they had were correct and a 20 minute job quickly turned into a 3 hour job of resetting network devices and redoing most of the network structure.
The fix: a complete, actively maintained documentation base covering all network devices, credentials stored in a secure vault (not a text file or a spreadsheet), vendor contacts, license and contract information, and configuration records. We build and maintain this for every managed client beginning in week one of onboarding. Something like BitWarden is easy enough to setup and we can help manage it for you!
Mistake 2: Flat Network Architecture
A flat network means every device — servers, workstations, printers, guest WiFi, security cameras, IoT devices, personal phones — exists on the same network segment and can communicate freely with every other device. This architecture is simple to set up and genuinely dangerous to operate.
In a ransomware event, malware that compromises one machine on a flat network can reach every other machine on that network within minutes. The difference between a single compromised workstation — recoverable in an afternoon — and an entire organization’s infrastructure encrypted simultaneously is often just the presence or absence of network segmentation.
The fix: VLAN-based network segmentation implemented through the firewall and managed switching layer. For most small businesses, the minimum effective segmentation separates servers and workstations, guest WiFi, IoT and security devices, and management infrastructure — each on its own VLAN with appropriate firewall rules controlling what can communicate with what. This limits the blast radius of any individual compromise to a defined segment.
Mistake 3: No Offsite Backup
We regularly find backup drives sitting physically on top of the servers they’re protecting — connected to the same machine, on the same network, in the same room. This configuration means the backup is subject to every threat that affects the primary data: ransomware that propagates across the network will find and encrypt the backup. A server room fire destroys the backup simultaneously with the server. A single point of failure in the primary hardware may make both the primary data and the backup inaccessible simultaneously.
The fix: a hybrid backup architecture with local backup for fast restores and cloud replication for geographic separation. The backup infrastructure should not be on the same network segment as the systems it protects, and it should not be physically co-located in a way that exposes both to the same environmental risks.
Mistake 4: Ignoring Firmware Updates on Network Equipment
Firewalls, switches, and other network equipment running significantly outdated firmware are among the most commonly exploited attack surfaces in small business environments. Security vulnerability disclosures for common firewall products are published in publicly accessible databases — complete with technical detail about how the vulnerability works. Automated scanning tools probe internet-connected devices for these vulnerabilities continuously. A firewall running firmware that’s years behind current releases is not a theoretical target. It’s an active one.
The fix: firmware update management as a disciplined, scheduled maintenance practice. We maintain firmware currency for every network device we manage on a defined update cycle, with validation before broad deployment. This is not heroic security work — it’s basic maintenance that closes one of the most reliably exploited doors.
Mistake 5: Treating IT as a Cost to Minimize
This is the mistake that makes all the others more likely. When IT is treated as a budget line to keep as low as possible — rather than an operational investment to optimize — the result is deferred maintenance, aging infrastructure, missing security layers, and an environment that appears functional right up until it isn’t.
The organizations in our region with the healthiest IT environments made a deliberate decision to invest in proactive management. Not extravagantly — the cost of proper managed IT is modest relative to the cost of the events it prevents. But intentionally, with leadership support for treating technology as infrastructure that requires ongoing investment rather than a one-time purchase.
Every one of these five mistakes is fixable. Most of them can be addressed within the first few weeks of a managed IT engagement. If several of them resonated, a free assessment is the right starting point — reach out at Contact Us.
