The best part of this job is not the technology. It is the ten minutes after the real meeting ends, when the laptop is closed and somebody walks you out to your truck and says “hey, while I have you, can I ask you something dumb?” It is never dumb. It is usually the question they have been carrying around for two years, the one that felt too basic to put in an email, and it is almost always a better question than anything that got asked in the meeting.
So we are starting a mailbag. This is the first installment of an ongoing series where we answer the questions small business owners actually ask us, in the words they actually use. These are not questions from named people and we are not quoting anybody. They are the ones that come up over and over across years of walking people out to their trucks, phrased the way they usually get phrased. If yours is not here, send it in, because the next installment gets built from whatever lands in the inbox.
Questions About Money and Who Does the Work
- “Why would I pay every month when nothing is broken?” This is the single most common question we get, and it deserves a straight answer instead of a sales pitch. The honest version: you are not paying for repairs, you are paying for the stuff that prevents repairs, which is invisible when it works. Updates get applied, backups get tested, alerts get investigated at 6am before anyone notices. The alternative, calling somebody only when things break, is called break/fix, and it works fine right up until the week it does not. The real difference is who absorbs the risk. On a monthly plan, your provider loses money when your systems are unstable, which aligns their incentives with yours. On break/fix, they make money when things break. Neither is dishonest. They just point in different directions.
- “Do I actually need cyber insurance?” Probably, and increasingly the decision is being made for you. Contracts with larger customers often require it, and lenders sometimes ask. But here is the part people miss: applying for a policy has become a security audit. The application asks whether you have multi-factor authentication, which means requiring a second proof of identity beyond a password, whether backups are separated from your main systems, and how you handle administrator accounts. Answering those questions honestly is a useful exercise even if you never buy the policy. Answering them dishonestly is how claims get denied.
Questions About the Machines
- “Windows comes with antivirus. Do I need to buy something else?” The protection built into Windows is genuinely good now, and it is a real improvement over the free tools of fifteen years ago. What it does not do is tell anybody. If it catches something on the laptop in your bookkeeper’s home office at eleven at night, that information stays on that laptop. The upgrade worth paying for is not better detection, it is central visibility, sometimes sold as endpoint detection and response, or EDR, which simply means the security software reports what it sees to a place a human being is watching. Detection without notification is a smoke alarm in an empty house.
- “Are Macs safer than Windows machines?” Less than people think, and less than it used to be true. The historical gap came mostly from market share, since criminals build for the biggest target. More importantly, the attacks that actually hurt small businesses do not care what operating system you run. Fake login pages, fraudulent invoices, and stolen passwords work identically on a MacBook and a Dell. Buy whichever platform your team is faster on, then secure the accounts rather than the hardware.
- “Can my employee just use their own laptop?” They can, and you should decide the terms before it happens rather than after. The problem is not the hardware, it is that your company data ends up on a device you cannot see, cannot update, and cannot wipe when that person leaves. There are reasonable middle grounds. You can require that company data only be reached through a browser and never downloaded, or provide a company account with controls attached. What does not work is the unwritten arrangement, where nobody has decided anything and three years of customer records are sitting on a personal machine that also belongs to a teenager.
Questions About Where the Stuff Lives
- “Do we still need a server in the closet?” Many small businesses do not, and a fair number still do. The honest answer depends on one thing: what specific software do you run that requires it? If the answer is an industry application that has no cloud version, you need the server, and the conversation shifts to keeping it healthy. If the answer is “that is where the shared files are,” you are probably paying to maintain, cool, and eventually replace a box that a cloud service could handle. Just go in clear eyed, because the cloud is just someone else’s computer. You are not eliminating the risk, you are transferring it to a company with better staff and worse phone support.
- “Isn’t a password manager just putting all my eggs in one basket?” It is, and that is the point. Right now the eggs are in dozens of baskets, most of them the same three passwords with a number on the end, several of them written on a note under a keyboard. One strong basket that is locked, encrypted, and protected by multi-factor authentication beats twenty weak ones. The math here is not close. The genuine risk with a password manager is losing access to it yourself, which is solved by setting up the recovery options on day one instead of promising to get to it later.
Questions About AI
- “Should I let my team use AI tools?” Yes, with a written rule about what they may paste into one. Your people are almost certainly using these tools already, and a ban you cannot enforce just moves the activity somewhere you cannot see. The framing that works best: treat it like a junior staff member. Fast, tireless, eager, occasionally confidently wrong, and never the last set of eyes on anything that goes to a customer or a regulator. Have a real person check the work, and never paste customer records, financials, or anything covered by a contract into a tool you have not vetted.
- “Is it worth waiting until this AI stuff settles down?” Understandable instinct, wrong conclusion. The tools are the dumbest they will ever be today, which means the version you dismiss this quarter is the worst version you will ever be offered. The cost of experimenting on something low stakes, like drafting first passes of routine documents, is a few hours. The cost of being three years behind your competitors on a capability that compounds is harder to recover from. Start small, keep a person in the loop, and let the low stakes experiments teach you where the real ones are.
The Bottom Line
Almost none of these questions are technical. They are questions about risk, money, and where to draw a line, which is exactly what an owner should be asking. The technology part is the easy half.
If you have been carrying one of these around, or one we did not cover, send it over. We will answer it in a future installment, and we will not use your name or your company. If you would rather just get a straight answer about your own setup instead of waiting for a blog post, we work with businesses across Denton County, from Lewisville and Flower Mound to Highland Village, and the first conversation costs nothing. Reach us at https://harrisonward.com/contact/.
Comments are closed