You have probably seen the slide. A grid of logos, each with a confident label: endpoint protection, email security, backup, dark web monitoring, security awareness training, threat detection. It looks thorough. It looks expensive in the right way. And it is easy to sign, because who would argue against more protection?
The trouble is that a slide shows what was bought, not what is being done. Tools do not protect a business on their own. People configure them, watch them and act on what they find. When IT is sold off a slide deck, that last part is often the piece nobody owns.
How IT gets sold off a slide
Security and IT software companies sell through partners, and they invest heavily in making their products easy to sell. A provider can receive a ready-made presentation, pricing and marketing material for a tool stack before anyone on its team has deep experience running it. A capable salesperson can present that material well.
That is not dishonest. The tools are usually real and often good. But it changes the question the sale answers. The slide answers “what will we install?” Your business needs an answer to “what will happen when something goes wrong?”
“We use X” is not “X is handled”
Almost every security tool has three parts that matter more than its name.
Configuration
Most tools arrive with default settings designed to suit everybody, which means they are tuned for nobody. Someone has to decide what to block, what to allow, which alerts matter and which computers need different rules. A powerful tool left on its defaults may do much less than the brochure suggests, or may get in your staff’s way until somebody switches part of it off.
Watching
Tools produce alerts. Lots of them. An alert that nobody reads is just a line in a log file. Ask who reads them, how often, and what happens on a Saturday night. “The system will notify us” is not an answer unless you know who “us” is and when they look.
Acting
When an alert matters, someone has to do something: isolate a laptop, block a sign-in, call a staff member, restore a file. That takes a person with the skill and the authority to act, and a process that says who it is. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, advises MSP customers to make sure contracts state whether the provider or the customer owns responsibilities such as detection and incident response. That is exactly the gap a slide deck can leave open.
Tools augment the work; they don’t replace it
A common sales line goes something like this: buy our new tool, and it will do everything. That is far from the truth. A good tool makes skilled people faster and better informed. It does not replace the people.
We have seen a pattern often enough to warn about it. A provider sells a client on a capable, full-featured platform, and then, after the contract is signed, uses only a small part of it, often little more than a way to connect to computers remotely. The monitoring, automation and reporting the client was shown on the slide are never switched on. In other cases the tool that was sold is later swapped for something cheaper the provider thinks it can get by with, and the client is never told what changed. Either way, the client is paying for capability that is not being used for them.
Signs you were sold the slide
- You can name the tools, but nobody can tell you what they caught last month.
- You get no reports, or reports full of numbers that nobody explains.
- When you ask how a tool is set up for your business, the answer is “it’s the standard package.”
- Your backups are listed on the invoice, but nobody can say when a restore was last tested.
- Each new problem is answered with a new product to buy.
- Different tools send alerts to different places, and nobody looks across them together.
Questions to ask about every tool
- Why this tool? What risk in my business does it reduce?
- Who configured it, and what did they change from the defaults for us?
- Who watches it, and how often, including nights and weekends?
- Who acts when it raises an alarm, and what will they do?
- How will I know it is working? What did it find or stop in the last quarter?
- What would we lose if we removed it?
A provider who runs its tools well will answer these quickly and in plain English. If the answers keep coming back to the slide, that tells you something.
Fewer tools, done properly
More tools are not automatically better. Each one adds cost, another console, more alerts and more ways for settings to drift. Often a business is better served by a smaller set of well-integrated tools that are configured for its needs and actually watched, than by a long list of logos. Where tools share information, a problem spotted by one can trigger a response in another. We explain why that matters to us in why we chose Sophos.
How FTI does it
FTI is an engineering team, and we choose tools for how they fit the work. Our managed IT services run on Kaseya’s integrated platform, where tickets, documentation, monitoring and backup are connected, and are secured with Sophos. Our engineers configure them for each client. An AI layer works alongside the engineers, watching across those systems and putting the full picture in front of them, and people decide and act. Behind it is a 24/7 help desk with senior engineers. If you would like a second opinion on what your current tools are actually doing, ask us.
