The short version:

• Client: Two sister engineering firms, one in the US and one in Canada (anonymized), serving industrial clients
• Engagement: Seven years and counting of outsourced IT support and security
• Scope: Email security, cloud storage, remote and in-person helpdesk, phone systems, hardware
• Status: Both firms are now being acquired, primarily for their engineering talent. I still run their security today.

Two firms, one border between them

These two companies came to me about seven years ago. Sister firms, shared ownership, one operating in the US and one in Canada, both doing engineering work for industrial clients. Neither one had internal IT, and neither one needed a big MSP contract with a 40-page SLA. They needed someone who picked up the phone.

That’s been the shape of the whole relationship. I handle their email security, their cloud storage, and their day-to-day support, remote when that works and in person when it doesn’t. Over the years the scope grew the way it does with small firms: I’ve run their phone system migrations, built their workstations by hand when off-the-shelf machines didn’t fit the budget, and made a hundred small calls about where to spend money and where to hold off. IT support for small business lives in those decisions. The stack matters less than the judgment behind it.

The customer security test

A few years in, one of their major industrial customers raised the stakes. Before awarding project work, the customer required compliance with its corporate IT security policy and information security program. Buried in the requirements was a hard one: all project data had to stay in Canada.

That’s a data residency requirement, and it’s the kind of thing that quietly kills deals for small vendors. The engineering team just wanted to work. The customer wanted proof their data wouldn’t drift onto US servers. My job was to close that gap without blowing up the budget or the workflow.

I laid out three options with real time and cost estimates: client-side encryption with Canadian-held keys on their existing cloud storage, a locally encrypted vault, or a move to a Canadian-hosted cloud platform. They picked the Canadian platform. I ran the migration, kept the working copies flowing for the engineer who needed them daily, and mapped the setup against the customer’s security policy documents so the answers were ready before anyone asked.

Small firms lose big customers over vendor security assessments they can’t answer. This one kept theirs.

Then the acquisition came

Both firms are now being acquired by a larger company, and the deal is mostly about people. The acquirer wants the engineers. That’s the whole thesis.

Talent deals move slowly, and this one has. Which makes the IT story simple to state and hard to fake: through the entire drawn-out process, the engineers have kept working, the systems have stayed up, and the security stack has kept running. Seven years in, the incident count is still zero. Nobody on the buyer’s side has had to ask why the target’s email got breached or where the customer data lives, because those answers were settled years ago.

I’m not running this deal, and this case study isn’t about deal work. It’s about the thing that makes deal work easy: an acquirer doing diligence on these firms finds documented systems, a customer-vetted security posture, and a support relationship that didn’t wobble when ownership went into limbo.

What seven years buys

Here’s the honest math on long-term outsourced IT support. Any provider can look good for six months. The value shows up in year three when a customer’s security team comes knocking, and in year seven when a buyer does, and both times the answers are already written down.

These two firms got acquired for their talent. The reason talent was the only thing under negotiation, rather than talent minus a pile of IT risk, is seven years of unglamorous maintenance: patched systems, secured email, data where the contracts say it should be.

If your customers are bigger than you

Industrial customers push their security requirements downstream, and acquirers read your environment like a balance sheet. Both happen on their schedule, not yours. The firms that come through clean are the ones that treated security as routine long before anyone was checking.

If you’re staring down a customer’s vendor security assessment, a data residency requirement, or a sale where your IT needs to hold up to inspection, that’s the work I do.

Facing a security review you’re not sure you’d pass? Get in touch.

How 4.5 years of security work turned a single-location self-storage company into a clean acquisition target, and what a three-week technology handoff looks like when the buyer runs 50+ facilities.

The short version:

• Client: Single-location self-storage operator in Colorado (anonymized)
• Buyer: Private equity-backed storage operator with 50+ facilities
• My role: IT and security provider for 4.5 years, then transition lead on the seller side
• Handoff: Three weeks, kickoff to done

It started with a breach

They found me the way a lot of my clients do: mid-incident. Their previous IT provider had gone defunct, and the provider’s abandoned website was serving malware. Someone at the storage company opened that site looking for support and infected their machine instead.

I took the call, cleaned the infection, recovered their systems, and combed through everything for leftover malicious code. Then I rebuilt their stack so it wouldn’t happen twice: antivirus, EDR through Huntress, cloud backup, and same-day helpdesk, remote and onsite. All of it sized and priced for a single-location business.

Four and a half years of quiet

For the next 4.5 years I ran their IT and security. Webroot and Huntress covered the endpoints. Backups ran to the cloud and got checked. When something broke, I fixed it the same day. No repeat incidents, no drama.

That stretch of quiet matters more than it sounds. When a buyer showed up years later, the company had a documented, monitored environment with a real security history behind it. Most small businesses walk into a sale with none of that.

Then a buyer showed up

A private equity-backed storage operator with 50+ facilities acquired the company. Deals like this live or die in diligence, and the buyer’s team had two questions about IT: is this environment secure, and is it cost-effective?

That’s technology due diligence in one sentence. Buyers want proof, and on small acquisitions they rarely get it, because the seller’s IT knowledge lives in one person’s head or a defunct vendor’s filing cabinet. Here, I had run the environment for years and could answer with documentation instead of guesses. That alone shortened the timeline.

The three-week handoff

Post merger IT integration for this deal came down to four workstreams.

RMM migration. The buyer standardized every acquisition onto their own remote management platform. Instead of touching each machine by hand, I wrote a script that deployed their agent and removed mine (ConnectWise Automate, at the time) across all systems in one pass.

Backup migration. I moved their cloud backups off my platform and onto the buyer’s, and verified restore points on both ends before cutting over. A migration without verified restores is a gamble, and nobody gambles during a closing.

Access control. The buyer’s team ran the access control migration themselves. I supported from the client side, kept credentials flowing, and made sure nothing on our end held them up.

Data cleanup and destruction. The buyer’s compliance requirements meant old data had to go, and go for real. I purged stale records the business no longer needed, then dealt with the retired hard drives that held customer data: a seven-pass wipe on each drive, and then I opened them up and pulled the platters out. Nobody is recovering that data. The platters make decent coasters, if you’re wondering.

Secure data destruction is the step small-business acquisitions skip most, and it’s the one that turns into a lawsuit years later when a drive full of customer records surfaces at a pawn shop.

Total time, including the buyer’s inspection and the back-and-forth between their team and my client: three weeks.

The result

The buyer got what diligence teams almost never get from a small acquisition: a documented environment, a working security stack, verified backups, and proof that legacy customer data was destroyed instead of forgotten in a closet. My client walked into closing without IT sitting on the deal as an open issue.

And the whole thing traced back to a malware infection five years earlier. The same work that saved them from a breach made them a cleaner company to buy.

Why this matters if you’re buying or selling

Most small businesses run on undocumented IT held together by whoever set it up. In an acquisition, undocumented becomes risk, and risk becomes a price reduction or a delayed close. Buyers now run cybersecurity due diligence on deals of every size, and sellers who can’t answer basic questions about their environment pay for it at the negotiating table.

If you’re a buyer, a searcher, or an owner planning an exit, the cheapest time to fix your technology story is before diligence starts. That’s the work I do: assess the stack, close the gaps, and run the handoff so the deal keeps moving.

Working a deal and want a second set of eyes on the technology? Get in touch.

2FA Availability

That’s the thing that I’m frustrated with at the moment, not all major companies offer Two Factor Authentication via a true 2FA App or even better a YubiKey physical key. Banks are the biggest offender of this. They might offer 2FA via your phone or email verification token, but as we all should know, your phone and your email ARE NOT SECURE EITHER. What do I have to do to get USBank and other major Banks to offer the best of the best in security for access to our digital currency?

All it takes is a hacker taking control of an email, or SIM jacking your phone number, and presto – they have access to the remainder of your personal information and money. Quite scary if you ask me.

Now that I’m looking into this I’m finding that Bank of America – BOA has the highest online security including support for YubiKey. That might be everyone’s best bet, especially large targets like Whales.

[insert picture of a whale]

“Whaling is a highly targeted phishing attack – aimed at senior executives – masquerading as a legitimate email. Whaling is digitally enabled fraud through social engineering, designed to encourage victims to perform a secondary action, such as initiating a wire transfer of funds.”

SIM Jacking

Okay so I don’t have a solution for this, unfortunately, most carriers allow for a sim lock but that has its flaws, as someone with enough information could bypass that over the phone with a telecom customer service rep.

It would be cool if a startup or a current telecom company just made a High-security mode for your account/phone numbers linked to the account, which locks the phone number from being replicated to a different SIM without an In-Person double identity verification process. Possibly with fingerprint verification, again in-person to add a barrier to socially engineered methods like SIM jacking.

I think this is essential for everyone as our lives now live on our phones, and realistically I’ve noticed most people are less secure with their mobile devices than they are with their desktop computers. When in the real world your phone/phone number should be more important to protection as it ends up being that 2FA step that malicious entities would have to overcome, and currently it’s doable with the right attack vectors. No seriously how are these multi-millionaires not terrified that with their mindset in cyber-security and when they are targeted, they would be hacked in a matter of hours, not days or weeks? Leaving massive financial risk based on one of 3 attack vectors, compromised email, compromised mobile device, or a socially engineered SIM jacking.

Get a Yubico Key for your personal or business cyber-security.