Are you paying too much, paying too little, or simply paying for the wrong things?
It’s a question I hear regularly from advice firms: “How much should we actually be paying for IT?”
Unfortunately, there isn’t a magic number.
At one end of the spectrum, there’s DIY. Someone in the business looks after the technology because they’re “pretty good with computers”.
Then there’s the classic: “I have a friend or relative who helps us with IT.”
And yes, plenty of advice firms still operate this way. It might have worked when the business was smaller, and it might still feel like the cheapest option. But given the amount and sensitivity of client information advice firms hold, I’d suggest moving up this spectrum fairly quickly.
The next step might be an IT professional you engage ad hoc when you need them, often around $200–$250 an hour.
Then we get to Managed Services Providers (MSPs), where you might pay somewhere around $150–$250 per team member, per month for ongoing IT management and support.
And then there are Managed Security Services Providers (MSSPs), where the cost might be closer to $250–$350 per person, per month, depending on the services and security capabilities included.
These are indicative figures, of course. But they raise an important question.
What are you actually paying for?
Technology providers have two main jobs.
The first is making your IT work really well.
The second is cybersecurity, which involves stopping your IT from working too well.
Good security can mean restricting access, blocking certain applications, removing administrator privileges, enforcing authentication, monitoring suspicious activity and occasionally making technology a little less convenient.
That distinction matters when comparing IT providers and their costs. A provider focused on keeping everything running smoothly is not necessarily delivering the same service as one actively monitoring, detecting and responding to security threats. Some providers do both extremely well, but firms need to understand what is actually included.
The small business problem
Advice firms have an interesting challenge.
You might be a five or ten-person business but think about the amount of sensitive information you can hold about each client.
Identity documents. Dates of birth. Addresses. Bank details. Income. Superannuation. Investments. Insurance. Assets and liabilities. Family information. Sometimes even health information.
Your core advice platforms may be sophisticated financial services technology, but they still operate within a broader environment of computers, email, identities, applications, networks and people that need to be protected.
So, how do you achieve an appropriate level of security when you have the budget of a small business?
That’s the challenge.
Am I paying too much?
If you have ten people and you’re paying $250 per person each month, $2,500 a month can feel like a lot of money.
But perhaps we’re comparing it with the wrong number.
Instead of comparing $2,500 with a cheaper IT bill, compare it with the potential cost of a serious cyber incident.
What could losing client information cost your business?
What about business interruption? Regulatory consequences? Reputational damage? Lost client relationships? Or the impact on the value of the business you’ve spent years building?
Suddenly, another $1,000 a month spent on appropriate security doesn’t look quite as expensive.
That doesn’t mean paying more automatically makes you more secure. Nor does it mean every advice firm needs the most expensive IT provider available.
It means firms need to understand what they’re paying for, what risks are being managed and, importantly, what isn’t included.
Because $300 a month for IT might sound like a bargain.
But depending on what you’re getting for it, it might not be enough.
Perhaps the better question isn’t, “Am I paying too much for IT?”
It’s “Am I spending enough to appropriately protect the information my clients trust me with?”
And if you’re looking at your monthly IT bill and genuinely don’t know what you’re getting for it, reach out. I’m always happy to help you work out what questions you should be asking.
Fraser is Founder of The Cyber Collective.
