Pricing tells you what it costs. It does not tell you what actually happens, who does what, or how long you are exposed while it happens. Pick the situation you are actually in below and this page rewrites itself around it, all the way through to booking the one meeting that starts it.
Four situations. One of them is yours. Everything after this point changes depending on which one you pick, because the first thirty days genuinely are not the same.
Nothing is submitted by choosing. You can switch paths at any point.
Nothing has burned down yet, so nothing has forced the issue. That is not a strategy, it is a streak. The good news is that starting from nothing is the cleanest build there is: no previous provider's shortcuts to unpick, no undocumented decisions to reverse engineer.
Twenty minutes on the phone. We ask what you have, who touches it, and what you are afraid of. You get a straight answer about whether you even need us yet. Some businesses your size do not, and we will say so.
You need: a rough headcount and a guess at how many computers.
We come onsite and inventory everything: machines, accounts, network gear, where the data actually lives, who has access to what. Most owners learn something uncomfortable during this week. That is the point.
You need: two hours of somebody's time and the keys to the closet.
Identity and access control, endpoint protection on every machine, verified backups, patching on a schedule, and documentation that did not exist before. Built once, built properly, so it is not rework in two years.
You need: to approve the plan. We handle the rest.
Monitoring is live, the SOC is watching, and problems get resolved before you hear about most of them. You get a quarterly review with what broke, what we fixed, and what we recommend next.
You need: nothing. That is the entire product.
The businesses that call us with no IT provider almost never call because they wanted one. They call because something already happened. The median first incident for an unmanaged small business is a compromised email account, and the median cost of cleaning one up after the fact is several times what a year of baseline coverage would have been.
You are not looking for IT support. You already have it. You are looking for the version of it you thought you were buying. That is the most common call we get, and it is also the easiest one to fix, because the gap between what you pay and what you receive is usually measurable within the first week.
Twenty minutes. We go line by line through what you are billed and what it buys. This is usually the call where somebody discovers they have been paying for seats that left the company in 2023.
You need: recent invoices and your current contract if you can find it.
We assess your environment without touching your current provider's arrangement. What is actually monitored, what is actually backed up, when the last restore was tested, which admin accounts exist and who holds them. You get that document whether or not you hire us.
You need: read-only access. Nothing changes yet.
We take custody of every credential, stand up our tooling alongside theirs, verify it is working, then decommission theirs. Your notice period runs while we are already covering you. There is no day where nobody is responsible.
You need: to send one notice email. We write it if you want.
Sixty days in you get a side by side: response times then versus now, incidents then versus now, spend then versus now. If it does not read better, you have a decision to make and no contract stopping you from making it.
You need: nothing. The numbers arrive on their own.
The instinct is to fire the incumbent first and find a replacement second. Do not. Your current provider holds domain registrar access, tenant admin, RMM agents, backup credentials and licensing. Leaving before that inventory is documented is how businesses lose their own email. We run the transition with the outgoing provider still in place, and we have never needed them to cooperate for it to work.
This is the situation nobody wants to say out loud: the business runs on one person, that person has not taken a real holiday in years, and everyone quietly knows what happens if they leave. We are not here to replace them. We are here to make them replaceable in the only sense that matters, which is that the business survives a fortnight without them.
The fastest way to sink a co-managed arrangement is to arrange it over your IT person's head. First call includes them. We ask what they want off their plate, and it is almost always the same three things: after hours, patching, and the security work they never get to.
You need: your IT person in the room, genuinely.
We agree in writing who owns what. They keep the applications, the users and the institutional knowledge. We take monitoring, patching, the SOC, escalation and the 2 a.m. calls. No overlap, no ambiguity about who is picking up a ticket.
You need: an hour to agree the split.
Everything in one person's head goes into a system: network topology, licence keys, vendor contacts, the reason that one server cannot be rebooted on a Tuesday. This is the deliverable that makes them able to take a holiday.
You need: to protect a couple of hours a week for them.
Your internal person stops being a help desk and starts being the person who improves things. Overnight and weekend coverage stops being their problem. Retention improves, which is the return nobody puts in the proposal.
You need: nothing. Ask them how it is going in month three.
Single-person IT is not a cost saving, it is an uninsured liability sitting on the balance sheet. When that person leaves, and eventually they do, the successor spends their first six months rediscovering decisions that were never written down. Co-managed coverage is the cheapest insurance policy against that specific failure, and it is the one small businesses skip most often.
If you are mid-incident, the rest of this page can wait. The number is (732) 743-5472 and it reaches a person. Incident response is billed at $90 per hour with no minimum, no retainer and no requirement to become a client afterwards. Read the rest of this later, once it is quiet.
We get on the phone and work out what is spreading and how to stop it moving. Isolate first, diagnose second. If it is ransomware or a compromised mailbox, the sequence matters and there is a correct one.
You need: to call. (732) 743-5472.
Restore from whatever clean copy exists, or rebuild if it does not. We tell you plainly which one you are in within the first hour, because the answer changes what the rest of the day looks like.
You need: someone who can authorise decisions quickly.
A written root cause, not a shrug. What the entry point was, how long they were inside, what they touched, and what you are legally required to tell anyone. That document exists whether or not you continue with us.
You need: nothing. It arrives.
Once it is stable you decide whether to carry on alone or put coverage in place so the next one gets caught at 2 a.m. instead of 9 a.m. No pressure either way. Plenty of our incident calls stay incident calls.
You need: to decide, in your own time.
In a live incident the first hour decides most of the outcome. Do not wipe anything, do not pay anything, and do not turn machines off if you can isolate them from the network instead: powering down destroys memory-resident evidence and can trigger encryption routines that were waiting for a reboot. Disconnect, preserve, then call.
Sixty minutes, free, no obligation to use us afterwards. We cover three things in that hour, and you leave with the findings whether you hire us or not.
What the business needs from technology over the next two years, and what is currently in the way.
We map the environment: machines, accounts, network, backups, licensing, and where the risk actually sits.
Findings, priorities and an exact price. The findings are yours either way.
Reading is optional. If you would rather just describe the problem to a person, the number reaches one, and the person who scopes your account is the person who shows up.