A client of mine was using a Claude agent to help manage some administrative work. Her sons are AI programmers in their late twenties, and they gave her a hard time about it. She was prompting the thing with “please” and “would you kindly” and “thank you so much,” and they told her she was wasting her time being polite to software.

I told her she was not wrong to do it.

That conversation has stuck with me, because it gets at something bigger than manners. It gets at the fundamental misunderstanding most people have about what AI actually is, and what it is not.

We Built This Expectation

Part of why people talk to AI like a person is because people like me spent decades encouraging exactly that.

I have been humanizing technology for years. Not because I was trying to mislead anyone. It is just that when you need a non-technical person to feel comfortable with a tool, you reach for the familiar. You describe the computer as something that gets confused, or something that is thinking, or something that does not like it when you do that particular thing. You anthropomorphize it so the person can work with it.

The side effect is that people now believe the technology has feelings. Or intentions. Or moods.

It doesn’t.

Before AI, we called it the inherent perverse nature of technology. You know the phenomenon: the thing that breaks always breaks at the worst possible moment. The file that disappears does it right before a deadline. People attribute malice or perversity to what is really just bad timing and probability. The technology doesn’t care. It has no agenda. It is just math, running at scale, at all hours.

So Why Bother Being Polite?

Here is the honest answer: being polite to your AI actually costs something.

There is real research on this. When you include “please” and “thank you” in your prompts, the model has to process those words as part of your input. Compute cycles get spent on them. At the individual level, the cost is essentially nothing. At scale, across millions of interactions, it adds up to meaningful energy and money.

So if your AI developer sons are telling you to cut the pleasantries for efficiency, they are not entirely wrong.

There is a reason most people ignore that advice, and it is not because they misunderstand the technology. It is because the habit of courtesy is not really about the thing you are being courteous to. It is about who you are when you do it. My client says please and thank you to the AI for the same reason she says it to the barista, the parking attendant, and the new paralegal. It is a reflex built over a lifetime, and it reflects something real about how she moves through the world. That is worth something.

I have my own version of the argument. Come the time when the robot overlords take over, those of us who were rude are going to be the first ones up against the wall. You never know who you’re currying favor with.

I say that as a joke. Mostly.

The More Interesting Question

The real conversation my client and I were having was not about manners. It was about what happens as we try to make AI more empathetic.

Right now, AI has no understanding of how humans work. None. It produces outputs that look like understanding because it has processed a massive amount of human-generated text and learned to approximate the patterns. That is genuinely impressive. It is also not the same thing as comprehension.

When we want AI to handle sensitive situations, to respond to a frustrated client, to navigate a nuanced request, we run into the same wall every time. The nuance we are asking it to understand is encoded in human experience. And AI cannot absorb or apply human experience. It can only approximate it based on what humans have written down and uploaded to the internet.

Think about that for a second. The training data for most large language models includes everything on the internet. Everything. The careful explanations and the misinformation. The thoughtful discourse and the harassment. The accurate science and the conspiracy theories. All of it, informing something that is essentially an infant intelligence, trying to learn what humans are like from the full undifferentiated chaos of what humans produce online.

Hollywood has been telling this story for fifty years. Nobody is paying attention.

What AI Actually Is

The clearest framing I have found is to stop thinking of AI as a faulty human and start thinking of it as a completely alien entity.

There is no way to attribute human behaviors, reasons, logic, or emotion to it. Not because it is broken, but because none of those things are present. When an AI model does something unexpected, something like deleting a production database even after being told not to, it is not rebellion. It is not malice. It is an error in the algorithm. An output produced by flawed training data or flawed programming, written by humans, carrying every bias and inconsistency that entails.

We wrote our own values, our own cultural norms, our own contradictions into these systems. Then we act surprised when the output reflects contradictions back at us.

That is not an AI problem. That is a human problem.

What This Means for Your Business

If you are using AI tools in your firm, the practical takeaway is this: AI does not understand your context the way a person does. It cannot be assumed to interpret nuance correctly. The output it generates needs review by someone who knows what correct looks like in your specific situation.

That does not mean AI is useless. It means it is a tool, and tools require the person using them to understand what they are and what they are not.

The firms that are going to use AI well are the ones that treat it like what it is: a powerful, fast, probabilistic text-processing system that does not know your clients, does not know your industry norms, and has no stake in getting the answer right. Pair it with someone who does know those things, and you have something useful. Deploy it on its own and trust the output without review, and you are opening your firm up to real security exposure.

And yes, if saying please and thank you helps you stay in the habit of treating the people around you with courtesy, including the junior staff member helping you figure out how to use the thing, then keep doing it. The AI won’t notice. But your team will.

If you want to talk through how AI tools actually fit into the workflow of a professional services firm, and what that means for your security and operations, schedule a conversation with us. We will skip the jargon and just tell you what is actually worth your attention.

Your network does not take nights off. Neither does the thing trying to get into it.

This is the part of the IT infrastructure that most professional services firms do not consider until something stops working. The network is invisible when it runs well, which means it tends to get attention only during the wrong kind of moment: a Monday morning when no one can connect or a deadline afternoon when the file server goes unreachable.

By the time any of those moments arrive, the problem has usually been building for hours. Sometimes days. A network monitoring service does not prevent every problem, but it catches the ones that announce themselves quietly before they become the ones that cost real money.

What “Monitoring” Means

Network monitoring is often described in vague terms, so let me be direct about what it is and what it is not.

It is not someone staring at a screen watching traffic. It’s a combination of software tools and alert thresholds that run continuously across your network infrastructure, flagging conditions that deviate from normal before they lead to failure. Monitoring means collecting and analyzing that data in real time, with alerts configured to notify someone when something looks wrong.

What it catches depends on what it is watching for. At a baseline, a network monitoring service should detect and alert on connection failures, bandwidth saturation, hardware performance degradation, unusual traffic patterns, device outages, and failed authentication attempts.

That last one matters more than most firms realize. Unusual authentication patterns, logins from unfamiliar locations, repeated failed attempts on a single account, and access at unusual hours are often early indicators that a compromised credential is being tested against your environment. Catching that at 2 am, before the credential is used to access anything substantial, is categorically different from discovering it a week later during an incident investigation.

Why After-Hours Is When It Matters Most

There is a common assumption that network problems occur during business hours because that is when the network is in use. The data does not support this.

Cybercriminals operate across time zones, and they understand that Friday evenings and holiday weekends are when IT response is slowest. Ransomware attacks are frequently staged during off-hours precisely because there is less chance of detection before the encryption is complete. A threat actor who gains access to your environment at 11 pm and goes undetected until 8 am the next morning has had nine hours to move laterally through your network, identify your most valuable data, and position the payload.

Network problems that are not security-related also tend to surface overnight. A disk array running out of space, a backup job consuming bandwidth and slowing everything else, a firewall rule that got changed and is now blocking something it should not. These conditions do not stay small. They get discovered in the morning, when they have been quietly degrading things for hours.

A proactive IT consultant approach means these alerts come in at 2 am, and someone responds to them at 2 am, or, at minimum, reviews them before anyone in your firm starts their day. The alternative is reactive. Something breaks, someone notices, someone calls, and only then does the process of figuring out what happened begin.

What This Looks Like for a 75-Person Accounting Firm

I work with professional services firms specifically because the stakes during certain periods are not evenly distributed. A 75-person accounting firm does not operate the same way in February through April as it does in July. Systems that are merely inconvenient when they go down in summer are catastrophic when they go down during tax season.

The network for a firm like that typically carries file access for a dozen simultaneous users on large document sets, communication traffic, client portal connections, and remote access for staff working from home or client sites. It is not a complicated environment by enterprise standards. It is also not a simple one, and the consequences of downtime during a critical period are disproportionate to the firm’s size.

The cost-of-downtime math for firms this size is not abstract. A 50-person professional services firm paying average industry salaries loses roughly $1,900 per hour in labor productivity alone when systems are down, before accounting for lost billable time, missed deadlines, or client-facing disruption. A four-hour outage that started the night before and could have been resolved overnight if someone had been alerted is a different outcome than a four-hour outage that gets discovered at 9 am and resolved by 1 pm.

The Proactive vs. Reactive Distinction

I have used the family doctor analogy with clients for years because it is accurate. A doctor who only sees you when something is wrong is an urgent care physician. A doctor who knows your baseline, tracks changes over time, and tells you about the thing you did not notice yet is a family doctor. The value is in the continuity and the proactive attention, not just the ability to respond when you call.

Managed IT support services that include network monitoring operate the same way. The monitoring builds a picture of what normal looks like for your specific environment. Deviations from that baseline, gradual ones, sudden ones, ones that happen at unusual hours, all of them become visible. Problems that would otherwise surface as emergencies get addressed as maintenance items.

This is not complicated to explain, but it requires discipline to execute. Someone has to be responsible for reviewing alerts, responding to them at any hour, and following through on the patterns they reveal. That is what a 24/7 network monitoring service provides that a reactive support contract does not.

What to Ask Your Current Provider

If you are already working with a managed IT provider, the questions you should ask are specific.

Are we being monitored continuously, or only during business hours? What gets alerted on, and who receives those alerts at night and on weekends? What happened the last time an alert fired outside business hours? Can you show me a report of network events from the past 30 days?

If the answers are unclear, that is the answer. Monitoring that no one is watching is not monitoring. It is logging, which is useful after an incident but does not prevent one.

If you want to see what a network monitoring report for your environment would look like, schedule time and we can run a baseline assessment.

Meta Description: Network problems at 2 am can wait until morning, right? Wrong. Why 24/7 network monitoring matters for professional services firms and what it prevents.

On July 19, 2024, CrowdStrike pushed a routine security update to millions of Windows machines. By mid-morning, 8.5 million systems had crashed. Airlines grounded flights. Hospitals reverted to paper. Banks went offline. It was not a cyberattack. It was a software update.

That story makes the rounds whenever I tell clients they need to stay current on their patches. I get it. If a major cybersecurity firm can detonate its own clients’ infrastructure with a single update, why would any reasonable person rush to install one?

The honest answer: because the alternative is worse. The CrowdStrike incident was a high-profile disaster caused by a vendor skipping proper testing. Unpatched software is a slow disaster caused by no one paying attention. Both are bad. One of them is preventable with a sensible patch management approach. The other requires you to trust your vendors, which is a different problem.

What most professional services firms are missing is not a policy of “update everything immediately” or “never update without waiting six months.” It is a practical framework for deciding which updates get installed when, and who is responsible for knowing the difference.

What Are Different Software Updates?

Not all updates are the same, and treating them as one category is where most patch management confusion starts.

Security patches fix known vulnerabilities. When a software vendor discovers a hole in their product that attackers can exploit, they push a patch to close it. These are not optional. Once a vulnerability is publicly disclosed, the clock starts. Attackers know about it the moment the patch is published, because the patch itself tells them what was broken. The question is whether they can exploit you before you close the door.

Feature updates add new functionality or change existing workflows. These are optional in the sense that your system will not be compromised if you delay them, though they often include bundled security fixes underneath the new features, which complicates the calculus.

Driver and firmware updates affect the underlying hardware. These tend to be low-frequency but high-impact. A firmware update for a network card or a storage controller touches something close to the machine’s foundation. When they go wrong, they go badly wrong.

Operating system updates are a category unto themselves. They are large, they require restarts, and they can affect how every other piece of software on a machine behaves. They also carry the most significant security implications, since the operating system is the surface that everything else runs on.

When to Install Immediately

Security patches for actively exploited vulnerabilities go in fast. If a vendor marks a patch as critical and there is evidence of active exploitation in the wild, that is not a patch to sit on. Your endpoint management services should have a process for deploying these within 24 to 72 hours of release.

The vendors that matter most for professional services firms, Microsoft, Adobe, and the major browsers, publish their critical patches on a predictable schedule. Microsoft uses Patch Tuesday, the second Tuesday of every month, for its regular security releases. Out-of-band patches released outside that cycle are almost always responding to something urgent. Treat them accordingly.

If your firm uses any software that handles client financial data, tax records, legal documents, or personal information, those applications go to the front of the line. An unpatched vulnerability in your document management system or your accounting platform is not a theoretical risk. It is the kind of thing that ends up in a breach notification letter.

When to Wait

Not every update needs to go on every machine the day it drops. This is where a staging approach pays off.

For major operating system updates and large feature releases, a reasonable practice is to let a patch cycle through for a week or two before deploying firm-wide. Check whether your software vendors have flagged compatibility issues. Watch for reports of problems from other organizations running similar environments. If nothing surfaces, proceed.

This is not the same as ignoring updates. It is deferring non-critical ones by a controlled amount of time while monitoring for issues. The CrowdStrike incident is the cautionary tale here. Their update skipped adequate testing. A brief deferral period, combined with monitoring for problems in the broader user community, would have saved affected organizations from the worst of it.

For firms running specialized software, legal document management platforms, property management systems, accounting applications, coordinate update timing with those vendors directly. Major operating system updates in particular can break integrations that your line-of-business software relies on. Your IT team or provider should be in contact with those vendors before any significant OS update goes firm-wide.

When to Worry

You should start paying attention when any of the following are true.

A machine has not received updates in more than 30 days. That is not a delay, that is a gap. Something broke in the update process and no one noticed.

You are running software that the vendor no longer supports. End-of-life software does not receive security patches at all, which means every vulnerability discovered after the end-of-support date is permanently open. Windows 10 reached end of support in October 2025. If you have machines still running it, that is worth addressing now.

Updates are being skipped because “we can’t afford the downtime.” That calculus almost never holds up. The downtime from a properly managed update cycle is measured in minutes. The downtime from a ransomware incident that entered through an unpatched vulnerability is measured in days, and sometimes the data does not come back at all.

Your team is approving or dismissing update prompts without any policy about which ones get approved. Individual employees making ad-hoc patch decisions is not patch management. It’s hoping for the best.

What a Sensible Approach Looks Like

For most professional services firms in the 50 to 150 employee range, the goal is not a complicated patch management platform. It is a clear, documented process that someone is responsible for.

Critical security patches deploy within 72 hours of release. Major updates get staged on a test machine or small pilot group before rolling out firm-wide. Software that touches client data gets updated on a priority schedule, and someone reviews the update queue weekly rather than letting it accumulate.

A managed software patching service handles this automatically for firms that do not have internal IT staff to manage it. The value is not just the patching itself. It is the monitoring, the exception handling, and having someone who notices when a machine has fallen out of the update cycle before it becomes a problem.

Technology is going to fail at some point. That is not a pessimistic statement. It is just honest. What separates firms that recover quickly from firms that do not is usually whether they were paying attention before something went wrong.

If you want a clear picture of where your firm’s patch management stands right now, we can walk through it with you in about an hour.

Contact C2 Technology Partners for a patch management review

Meta Description: Updates break things. But skipping updates is worse. A realistic guide to software update strategy for professional services firms in 2026.

Go look up Microsoft 365 Business Basic on Microsoft’s website right now. It is $6 per user per month. Some IT companies charge $60 for it. They do not tell you that.

I have had clients come to me after years with another provider, and when I pull up what they were paying for Microsoft licensing versus what Microsoft charges, the reaction is always the same. A long pause, and then some version of “I had no idea.” That gap, between what software costs and what a managed IT provider charges for it, is one of the dirtiest open secrets in this industry. I am tired of pretending it is not there.

What the Industry Does

Managed IT providers have a few ways to make money. They charge for labor, which is straightforward. They charge monthly fees for monitoring and support, which is also reasonable. Then there is a third category: software and hardware resale, where the markup practices range from modest to, in my opinion, genuinely indefensible.

Microsoft 365 licensing is the most common example. Microsoft publishes its prices publicly. Any business can see exactly what each tier costs. Despite that, markups of 200 to 1,000 percent on Microsoft licenses are evident across the industry. The justification is usually something about bundled expertise or account management. Sometimes there is no justification at all because the client never asked and the provider never volunteered the information.

Hardware is similar. A laptop that costs $1,200 on the manufacturer’s website might appear on a client invoice at $1,800 with no explanation of where that difference went.

I am not saying every firm doing this is acting in bad faith. In most cases, markup is warranted. But the client cannot evaluate that tradeoff if they do not know the spread exists.

What We Do Instead

When a client buys hardware through us, we mark it up about 20 percent over our cost. We tell them that upfront. The 20 percent covers the time and internal costs of procuring, vetting, configuring, and delivering the equipment. It is not a secret profit center. It is a disclosed service fee.

For software licensing, we pass through at or near cost and charge separately for the actual work: setup, administration, account management, and ongoing support. Those are real services worth paying for. They should just show up as line items, not hidden inside an inflated license fee.

The reason I run it this way is not because I am allergic to profit. It is because the math eventually catches up with you. Clients who feel taken advantage of leave. In professional services communities, where accounting firms, law offices, and property management companies all know each other and talk, that reputation travels. I have been doing this for over 35 years. The relationships are the business. You do not protect relationships by hiding what you charge.

What Fair Pricing for Managed IT Support Services Looks Like

Fair-priced managed IT services are not necessarily the cheapest. Good IT support costs real money, and firms that chase the lowest per-user rate almost always pay for it in downtime, slow response times, and technicians who do not know their environment.

What fair pricing looks like is this: you can see what you are paying, understand what each line item is for, and ask questions about any of it without getting a runaround.

You should be able to get a straight answer to the question, “How much of my Microsoft 365 fee goes to Microsoft?” If your current provider cannot or will not answer that question, you have your answer.

Hardware purchases should come with a disclosed margin or, at minimum, a clear explanation of what the markup covers. Software renewals should not quietly increase year over year without anyone telling you why.

Monthly service fees will have complexity baked into them, and that is legitimate. A flat per-user number oversimplifies what it takes to run an IT environment for a 75-person firm. There are infrastructure costs, tool costs, after-hours coverage, and vendor relationships that do not map neatly onto a per-seat calculation. However, your provider should be able to walk you through the general structure of what drives that number, even if the full breakdown is complicated.

The Question Worth Asking Your Current Provider

If you are not sure where you stand, the simplest test is to ask your provider what they pay Microsoft for your licensing tier and what they charge you. You do not need to be aggressive about it. It is a reasonable question that any transparent provider should be able to answer in about 30 seconds.

If the answer is evasive, or if you are told that the pricing is “bundled” in a way that cannot be broken out, that tells you something. Not necessarily that you are being gouged, but that the relationship is not being run on the terms of transparency that you deserve.

Clients who have been with us for a decade know what they pay and why it changes. That is the standard. If yours is not meeting it, it may be time for a second opinion.

Most firms set their technology priorities in January with the best of intentions. By June, those intentions have been buried under client deadlines, staff turnover, and whatever fire needed putting out that particular Tuesday.

I’ve been doing this long enough to know that the gap between what a firm’s IT environment is supposed to look like and what it actually looks like tends to widen quietly, without anyone noticing, until something breaks. That’s what makes mid-year the right time to look. You still have six months to fix what you find.

This is the list I walk through with my own clients right now. It is specific to accounting practices, law offices, and property management companies because these businesses handle a particular combination of sensitive client data, regulatory exposure, and lean administrative staff.

1. Does Your IT Roadmap Still Reflect Where the Business Is Going?

Has the business changed since you last reviewed your technology plan? A second location, five new staff, or an absorbed partner’s book of business means the hardware you budgeted, the software you licensed, and the backup capacity you sized were all built around a version of the company that may no longer exist. Pull out your IT roadmap and compare it to where you actually are.

2. Review Your Backup and Recovery Setup

A backup that has never been restored is a theory. I have seen firms discover mid-incident that their backup solution had been failing silently for months because notification emails went to an inbox no one checked. Pick a date in July. Run a test restore. Document what happened. This takes two hours and eliminates what would otherwise be a catastrophic week.

3. Audit Who Has Access to What

People leave, change roles, and accumulate permissions without anyone removing the old ones. A paralegal who transferred departments still has full access to the client billing system. A former office manager’s account was never disabled. Access creep is how small breaches become large ones. Pull a list of active accounts, compare it with your current staff, and revoke those that should not be there.

4. Check Your Cybersecurity Insurance Policy Against Your Environment

Insurers ask whether you have multi-factor authentication, endpoint detection software, offsite backups, and regular security training. Those answers were true when you filled out the application. Whether they are still true depends on whether anything has changed. A staff member disables MFA because it was inconvenient. A license lapses. Review the policy against your current state before your renewal, not after a claim.

5. Evaluate Your Vendor Relationships

Every firm I work with has at least one vendor relationship that is no longer serving them well. A software subscription for a tool three people use. A support contract with a provider that takes 72 hours to respond. List every technology vendor, what you are paying, and whether you are getting value. Most of the time it surfaces one or two things worth addressing, which pays for the hour it took to do the review.

6. Test Your Password and Authentication Policies

If your firm does not have a formal password policy, you have one. It is just the one each employee invented for themselves. Review whether MFA is active across all critical systems: email, document management, accounting software, and remote access tools. Password hygiene accounts for roughly 22 percent of all data breaches, according to Verizon’s 2025 Data Breach Investigations Report.

7. Review Remote Work Security for Your Current Setup

The policies put in place in 2020 have not necessarily kept pace with how people work now. Staff connect from personal devices. Home routers never got firmware updates. Someone is using personal Gmail to send client documents because it is easier. Ask your IT provider to give you a current picture of who is connecting from where and how.

8. Confirm Your Compliance Documentation Is Current

Cyber insurance carriers require documented security policies. State bar associations are publishing guidance on attorney obligations for client data security. Compliance documentation decays. If it has not been reviewed since it was written, treat that as a gap.

9. Look at Your Network Infrastructure

Switches, wireless access points, and firewalls that are two or three years old and have had no firmware updates applied are running vulnerabilities that have been publicly documented for years. Attackers run scans, identify outdated hardware running outdated software, and exploit known vulnerabilities. Ask when your network equipment was last audited. If no one can tell you, that is the audit.

10. Have an Honest Conversation About the Rest of the Year

What is the one technology investment that would make the biggest difference to how your firm operates? What is the one vulnerability you have been aware of but keep putting off? What has changed in your business that your technology has not caught up to? Those three questions, answered honestly, will tell you more about where to focus than any framework.

None of these items requires weeks of analysis. Most require someone to look, ask a question, and write down what they find. The firms that consistently avoid major technology problems are not the ones with the most sophisticated systems. They are the ones who check in regularly and address what they find before it becomes urgent.

If you want to run through this list with someone who knows how professional services firms actually work, schedule a conversation with us. No pitch. Just a practical look at where you are and what actually needs attention.

Meta Description: Halfway through 2026, it’s time to review what’s working and what’s not. An IT consultant’s practical checklist for professional services firms.

Every vendor in the technology industry will tell you to move to the cloud. What they won’t tell you is whether moving to the cloud is the right decision for your firm.

I’ve been doing this for 35 years. I’ve watched the industry cycle through mainframes, desktops, servers, and the cloud, and in every era, the companies selling infrastructure find a way to make their solution sound like the only one that makes sense. The cloud is genuinely useful, but also genuinely oversold. My job is to tell you which is which for your specific situation.

What “The Cloud” Means for a Professional Services Firm

Before we get into when to migrate and when not to, let’s be clear about what we’re talking about.

When most firms ask about cloud migration, they’re usually asking about one of three things: moving email and productivity tools to a hosted platform like Microsoft 365 or Google Workspace, moving file storage and document management off local servers and into a cloud service, or moving line-of-business software like practice management, accounting, or property management platforms to hosted versions.

These are different decisions with different tradeoffs. Treating them as one question is where a lot of firms go wrong.

Where Cloud Migration Makes Clear Sense

Email and productivity tools

This one is mostly settled. Running your own on-premises Exchange server to host email for a 50-person accounting firm stopped making practical sense years ago. Microsoft 365 deployment handles uptime, security patching, spam filtering, and backups at a cost that no small firm can match when running their own infrastructure.

The same goes for collaboration tools. When your attorneys or accountants work from multiple locations, cloud-based document access and real-time collaboration in Microsoft 365 or Google Workspace are genuinely better than the alternatives. This is a cloud migration decision where the answer is almost always yes.

One thing to watch: deployment matters as much as the decision to migrate. A poorly configured Microsoft 365 environment with the wrong license tier, no multi-factor authentication, and default security settings is not better than what you had before. Cloud migration support from someone who knows professional services firm requirements is not optional. It’s the part that makes the migration work.

This is also a decision that intersects with your firm’s specific software needs. If you’re weighing which platform fits best, the considerations for law firms and accounting practices differ enough to warrant a closer look. We cover that comparison in detail.

.

Remote and hybrid work infrastructure

If your team works from anywhere, cloud infrastructure is not a preference, it’s a practical requirement. Local servers that staff can only access via a fragile VPN setup, or document storage that lives only on office desktops, break down quickly in a distributed work environment.

Cloud-based file storage, access controls, and productivity platforms built for remote access are what make hybrid work viable. For firms that have embraced any degree of remote work, this is another area where the migration decision usually has a clear answer. For a closer look at the security side of that equation, Remote work security for professional services firms is worth reading alongside this post.

Disaster recovery and backup

Your backup strategy should have a cloud component. Full stop. Local backups that reside in the same building as the systems they back up are not a recovery strategy. They’re a false sense of security. Cloud-based backup solves that problem directly, and the cost is low enough that there’s no reasonable argument against it for any firm.

Where the Cloud Argument Gets Weaker

Specialized line-of-business software

Many professional services firms run software that is specific to their industry. Tax platforms, legal document management systems, and property management databases. The hosted versions of these applications are not always better than on-premises versions, and they are often significantly more expensive on a per-user subscription model.

Before migrating a line-of-business application to a hosted cloud version, do the math. What is the annual cost per user for the cloud version versus the cost of running the application on your existing server infrastructure? Include the IT support cost for server maintenance, but be honest about it. For firms with managed IT support already in place, the incremental cost of maintaining a single application server is often lower than many assume.

There are cases where the cloud version wins. There are cases where it doesn’t. The calculation is worth doing before the vendor does it for you.

When your connection is the problem

Cloud infrastructure runs on internet connectivity. If your office has unreliable internet or your team works in locations with limited bandwidth, moving critical applications to the cloud can create a reliability problem that didn’t exist before.

I’ve seen firms migrate enthusiastically, then discover that their 25-person office shares a business internet connection that simply wasn’t designed for the load. Before any significant cloud migration, your network infrastructure needs an honest assessment. This step is skipped more often than it should be.

When compliance requirements restrict your options

Accounting firms, law offices, and property management companies handle sensitive client data. Depending on your specific situation, the cloud environment you choose and how it’s configured may need to meet particular security and compliance standards.

This doesn’t mean you can’t use cloud platforms. Microsoft 365 and Google Workspace both have configurations that meet demanding compliance requirements. This means the migration needs to be designed with those requirements in mind, not retrofitted after the fact. If your cyber insurance requires specific data handling controls, or your clients have contractual requirements around data residency, those need to be on the table before you sign up for a cloud service.

Cyber insurance requirements around data handling have tightened considerably in the past two years. Understanding what your policy requires is a conversation in itself.

The Question Nobody Asks

I find myself having this conversation fairly often. A managing partner or office manager tells me they want to move everything to the cloud. When I ask why, the answer is usually something like, “because that’s where everything is going” or “because our current setup is frustrating.”

Those are not the same problem, and they don’t have the same solution.

If your current setup is frustrating because local servers are aging, backups are unreliable, and remote access is painful, cloud migration probably does solve that. If your current setup is frustrating because your software is poorly configured, your hardware is underpowered, or your IT support isn’t keeping up, migrating to the cloud can move the same problems into a new environment and add a subscription fee on top.

The cloud is a location, not a fix.

Before any migration conversation, I recommend an honest technology assessment. What’s breaking? What does your team need? What does it cost to solve the problem on-premises versus in the cloud? Once you have real answers to those questions, the right path forward is usually obvious.

If you want to work through that assessment for your firm, that’s a conversation worth having. C2 Technology Partners works exclusively with professional services firms in Southern California, and we’ve been through this decision enough times to give you a straight answer without a sales agenda attached.

Primary Keyword: cloud migration support 

Secondary Keywords: Microsoft 365 deployment, Google Workspace setup

Meta Description (155 chars): Not everything belongs in the cloud. When cloud migration makes sense for professional services firms, and when on-premises is still the better choice. 

I have had this conversation more times than I can count. Someone buys a laptop at Costco for $300, hands it to a paralegal or a bookkeeper, and calls it a day. Six months later, they’re on the phone with me, wondering why everything is slow and what we’re going to do about it.

What I tell them is that the $300 laptop and the $1,300 laptop look almost identical in the store: same screen, same keyboard, same ports. On the surface, they act the same, too, for about the first three months. After that, the differences become very clear, and they’re the kind of differences that cost you real money.

What You’re Paying For

Consumer-grade laptops sold at big box retailers are built to a price point. That’s not an opinion, it’s a manufacturing reality.

The components inside a budget machine are sourced for cost, not durability. The processor handles basic tasks but struggles under the load of business software. The storage drives are slower and wear out faster. The build quality is lighter because lighter means cheaper materials, and cheaper materials mean shorter lifespans. Memory is often the minimum required for the thing to boot.

Business-class laptops are built differently. The processors are selected for sustained workloads. The storage is faster and rated for higher read-write cycles. The chassis is more durable because the people buying them need them to last four or five years, not one or two. Quality assurance testing is more rigorous because the buyer notices when a machine fails.

None of that is marketing. It’s component selection.

The Real Math on Cheap Technology

A $300 laptop that lasts two years before becoming a productivity problem costs your firm significantly more than the purchase price.

Consider what happens when that machine starts underperforming. Staff spend time waiting on slow load times. IT support time goes up. If the device fails outright, you’re dealing with downtime, potential data recovery costs, and the disruption of getting a replacement deployed quickly. Factor in lost billable hours for the person who can’t work normally during any of that.

Research cited by Atlassian puts the average cost of IT downtime at $5,600 per minute, and a failing laptop is a reliable, recurring source of exactly that kind of unplanned outage.

A $1,300 machine that stays reliable for four to five years, with minimal support overhead, almost always wins on total cost. The math isn’t complicated once you stop looking at the purchase price in isolation.

The Quality Decline Problem Nobody Talks About

This topic is personal for me. I was a Dell advocate for years: reliable machines, consistent business-line products, and good support. I can’t say that anymore. I won’t recommend most of their consumer products today, and I’m not alone in that assessment.

The decline in the quality of technology hardware has been real and measurable over the past decade. What most people don’t know is why.

Before the pandemic, a series of disasters hit semiconductor and component manufacturers across Asia, particularly in Taiwan, Japan, and Malaysia. Floods, fires, and factory shutdowns degraded supply chains that had taken decades to build. That infrastructure has not fully recovered.

Then the pandemic hit, which compounded everything. Component shortages forced manufacturers to substitute materials and suppliers at every level of the supply chain. Some of those substitutions became permanent because the economics worked in the short term.

Layered on top of that is a straightforward business reality: public companies face relentless pressure to extract margin from their products. The easiest place to find margin without raising prices is to reduce the quality of what’s inside the box. Consumers rarely crack open their laptops to inspect the components. That created an opening, and many manufacturers took it.

The result is that you cannot shop by brand name the way you could ten years ago. A brand that produced excellent business hardware in 2015 may be producing mediocre hardware today from the same product line.

What This Means for Device Lifecycle Management

Workstation setup and deployment for professional services firms need to account for all of this.

A replacement cycle of four to five years is standard guidance for business-class hardware, but only if you’re buying business-class hardware to begin with. Consumer devices often can’t make it that far without significant performance degradation, which means you’re replacing them more frequently and paying IT support costs along the way.

The firms I work with that invest in quality hardware upfront have more predictable technology budgets and fewer emergency support calls. The ones that buy cheap get a short-term win on the purchase order and a long-term headache on everything else.

Spend $1,300 on a machine that your attorney or accountant uses reliably for five years, and you’ve spent $260 per year on that device. Buy a $300 machine that needs replacing in two years, and the per-year cost is $150 before you count a single hour of downtime or support.

The numbers get closer than people expect.

A Practical Buying Framework

When I’m advising firms on device procurement, I look at a few specific factors.

What software are these users running? Tax and legal software is resource-intensive. A machine sized for web browsing and email will struggle with it. Match the device to the actual workload, not to the lowest acceptable price.

Who is the user? A partner at a law firm or a CPA signing off on returns needs a reliable machine without fail. An intern doing administrative work might be fine with something less expensive. Not every seat requires the same investment.

What’s the warranty and support structure? Business-class machines from reputable manufacturers typically come with on-site service warranties. Consumer devices don’t. For a 50-person professional services firm, that distinction matters when something breaks.

Finally, what does replacement cost your firm? Include IT labor for setup and deployment, any data migration, and the disruption to the person whose machine just died. 

Once you factor all of that in, the $300 laptop rarely looks like the savings it appeared to be at checkout.

Technology planning for business growth means treating your devices as assets rather than expenses. A device lifecycle management strategy, built around quality hardware and realistic replacement cycles, will cost your firm less over time and save you more headaches than I can count.

If you’re not sure whether your current hardware is serving your team well or quietly costing you, reach out. We do this assessment regularly for professional services firms across Southern California, and the conversation doesn’t cost you anything.

Remote work is no longer a temporary arrangement that your firm is managing. It’s how your people work now, and the security gaps it created are still wide open.

Most professional services firms handled the transition to remote work the same way. They handed out laptops, set up VPN access, and called it done. That approach was fine in 2020 when everyone was scrambling. In 2025, it’s a liability.

The firms we work with across accounting, law, and property management all share similar setups. Attorneys reviewing client files from home networks, accountants accessing tax software from personal devices, and property managers processing payments from coffee shops. Every one of those scenarios introduces a risk that a basic VPN was never designed to cover.

Your Home Network Is Not Your Firm’s Network

Office networks are managed. Home networks are not. That difference is significant.

When your staff works from home, they’re connecting through consumer-grade routers that often run outdated firmware, have never had their default passwords changed, and share bandwidth with every smart TV, gaming console, and doorbell camera in the house. Your firm’s data is traveling through that environment.

The fix is not complicated. Requiring employees to connect through a business VPN is a start, but it’s not sufficient on its own. The stronger approach is zero-trust network access, which means every connection is verified before it reaches your systems, regardless of its origin. This is increasingly standard for firms handling sensitive client data, and it also matters for cyber insurance qualification.

If your current IT setup does not include a defined remote access policy, that gap should be addressed first.

Multi-Factor Authentication Is Not Optional

If your staff can log into client files, billing systems, or email with just a username and password, your firm is exposed. Full stop.

According to Microsoft, multi-factor authentication (MFA) blocks over 99.9%  of automated account compromise attacks. It is the single highest-return security measure available to small and mid-sized firms, and it costs almost nothing to implement correctly.

The challenge we see most often is not firms refusing to implement MFA. It’s firms that enabled it inconsistently, or skipped certain applications because they were inconvenient. An accounting firm might have MFA on email but not on their practice management software. A law office might have it enabled for partners but not for support staff.

That inconsistency is where breaches happen.

MFA needs to be applied uniformly across every application that accesses client data. That includes email, document storage, billing, and any line-of-business software your staff uses remotely. Hybrid work infrastructure planning should treat authentication as a foundation, not an afterthought.

Devices Are the Weakest Link in a Distributed Workforce

When everyone worked from the office, your IT team could see every device on the network. They could push updates, enforce policies, and spot problems. Remote work changed that dynamic completely.

The device your paralegal is using at home right now, are you certain it has current security patches? Do you know whether it’s running endpoint protection? If it were lost or stolen, could your team wipe it remotely?

For professional services firms, the answers to those questions need to be yes. Client confidentiality requirements, insurance obligations, and, in many cases, bar association or state CPA board standards require it.

Device management for remote employees means a few specific things in practice. Every firm-issued device should have endpoint detection and response software installed. Automatic updates should be enforced, not left to the discretion of individual employees. Also, remote wipe capability should be configured before devices leave the office, not after something goes wrong.

Personal Devices Are a Different Problem

Many firms allow employees to use personal computers or phones to access work systems. This is common and often unavoidable, particularly in smaller offices. It is also genuinely difficult to manage from a security standpoint.

You cannot install corporate security software on a personal device without creating legal and privacy complications. What you can do is control what those devices can access and how they can access it.

Mobile device management policies can enforce minimum security standards before a personal device is granted access to firm systems. Requiring a PIN, enabling device encryption, and preventing downloads of client files to local storage can all be enforced through the right configuration, even on personal devices. Your remote IT support strategy should account for this distinction.

If your firm has not made a clear decision about personal device access, it is worth making one now. Either allow it with defined controls in place, or restrict it and provide firm-issued devices where needed.

The Security Conversation You Are Not Having With Your Staff

Most data breaches in professional services firms do not start with sophisticated attacks. They start with a staff member clicking a link in a phishing email while working from home, without the informal safeguards that exist in a physical workplace.

In an office, someone might turn to a colleague and ask, “Did you see this email from a client?” That quick check happens naturally. Remote employees make those judgment calls alone.

Security awareness training is not a one-time checkbox. It needs to be ongoing, specific to the threats targeting professional services firms, and directly tied to the tools your staff uses. Credential theft targeting law firms and accounting practices is a documented and growing problem. Your training program should reflect that.

What This Looks Like in Practice

Getting remote work security right for a professional services firm does not require a large IT budget. It requires a clear-eyed assessment of where your gaps are, and a plan to close them in order of priority.

Start with an honest inventory. Which applications can staff access remotely? Which devices are being used? Is MFA enabled everywhere it should be? Are remote access policies documented?

From there, the path forward is usually straightforward. The firms that struggle are the ones that have never asked the questions.

If you want to run through that inventory, C2 Technology Partners offers a no-pressure remote work security assessment for professional services firms in Southern California. It takes about an hour and gives you a clear picture of where you stand.

Your software vendor does not care whether your business survives an outage, a price increase, or a forced platform migration. They care about your renewal. Those are not the same thing, and the sooner you build your IT strategy around that fact, the better off you will be.

I want to be fair here. I am not saying software vendors are villains. They are businesses. They have investors, payroll, and pressure to grow revenue. However, their incentives are structurally misaligned with yours, and pretending otherwise costs businesses money every single year.

What Vendor Mercenary Behavior Actually Looks Like

It rarely announces itself. It shows up in the details.

Licensing that stores your data in proprietary formats you cannot easily export. Price increases that arrive with 30 days’ notice, which gives you no realistic time to evaluate alternatives, negotiate, or move. Support tiers that make what used to be a standard service request into a premium feature. “Integration partnerships” that are really artificial barriers to using competing tools. Security features that exist at enterprise pricing tiers but not the small business plan you are on, which means the capability exists but the vendor has decided your size does not merit access to it.

I see the Microsoft 365 markup issue all the time in this industry. You can look up Microsoft’s pricing directly. A lot of IT firms mark up those licenses anywhere from 200 to 1,000 percent without ever explaining what the markup covers or why. At C2, we tell clients exactly what we are marking up and why. That is not the industry norm. It should be.

None of the behaviors I described above are illegal. Most of them are rational from the vendor’s perspective. But they are not aligned with your interests, and knowing that going in is different from figuring it out when you are locked in.

The Lock-in Nobody Notices Until They Try to Leave

The most expensive vendor relationship is not the one with the highest monthly bill. It is the one you cannot exit without a major disruption to your business.

Think about your practice management software, your document storage platform, your client portal. If you decided tomorrow that you wanted to move to a competing product, what would that actually look like? How long would it take? How much would it cost? What data might you lose or have to manually recreate?

For most professional services firms, the honest answer is “more than we want to think about.” That is not always a problem. Some vendor relationships are worth the dependency because the switching cost is genuinely higher than the cost of accepting the terms. However, you should arrive at that conclusion consciously, not by default.

The firms that get hurt are the ones that discover their exposure when the vendor raises prices by 40 percent and the realistic alternative is six months of migration work at the worst possible time.

What You Can Realistically Manage Yourself

I try to be honest with clients about the line between what they can handle and what they should bring to us.

Things most professional services firms can manage without IT help: exporting your own data periodically to verify you actually can, keeping a plain-language record of what tools you use and what they cost, reading renewal notices before approving them, and maintaining a vendor contact list somewhere outside the software itself. These sound obvious. Most businesses do not do them.

Things you should probably not try to manage without help: migrating data between platforms, evaluating the security implications of a new vendor contract, negotiating enterprise licensing terms, or building redundancy around a tool that is critical to daily operations.

Being clear about that line is more useful than pretending either that you can handle everything or that you need to outsource every decision.

Three Things You Can Do This Month

Export a copy of your data from your two most critical platforms. Just to see if you can. The experience of trying will tell you more than any vendor FAQ. If the export option does not exist or the output is unusable, that is information worth having now.

Read the terms of your next software renewal before you approve it. Look specifically for language about data portability, price adjustment clauses, and what happens to your data if you cancel. It will not be exciting reading. It will be useful.

Ask your IT partner: if we needed to move off this platform in 90 days, what would that actually look like? If your IT partner cannot answer that question clearly and specifically, that is also information worth having.

The Honest Part

Some vendor lock-in is unavoidable and some of it is worth accepting. The goal is not to be vendor-free. It is to make those choices with your eyes open rather than discovering your exposure when the leverage has already shifted entirely to the vendor’s side.

The firms I have watched get hit hardest by this are not the ones that made bad decisions. They are the ones that made no decision at all, and let default inertia build dependencies they were not aware of until something forced them to look.

Technology is a tool. Like any tool, it can be built improperly, it can be misused, and it can fail at the worst possible moment. Understanding who actually controls that tool, and what happens when their priorities stop aligning with yours, is part of running a business in 2026. It is just not a part anyone talks about much.

If you want to take stock of where your real dependencies are and what your options look like, we are happy to have that conversation.

Quick and Easy: Software vendors build their businesses around keeping you subscribed, not around making it easy to leave, and that is a rational business decision that just happens to conflict with yours. Understanding which tools your firm genuinely cannot exit quickly, and what that exposure actually costs, is one of the most underrated parts of technology planning for professional services firms. Start by trying to export your own data and reading the next renewal notice before you click approve.