If your business has outgrown DIY IT, the signs usually show up as small everyday friction long before anything breaks badly.
When a business is young, everybody does a little of everything. The owner handles sales, operations, billing, hiring, and technology. The employee who is “good with computers” sets up the new laptop. A family member installs the Wi-Fi. Someone creates a shared spreadsheet with passwords. When a problem happens, the team searches online, calls the software vendor, or texts whoever originally set everything up.
That is not failure. That is a small business using the resources it has. The problem is that the business grows, but the technology process stays the same. Eventually, the system that worked for three people becomes a risk for ten, twenty, or fifty. Nobody officially decides that DIY IT has ended — the warning signs simply start appearing. Here are ten of them.
01The owner is still the help desk
If employees message the owner when they forget a password, cannot print, need software, or have trouble logging in, the company is paying the most expensive person in the business to do work that should have a process. The real cost is not only the five-minute interruption — it is the mental load of being responsible for a system you do not have time to manage.
Many of our best clients were the IT department before we came in. Every technical problem, for every employee, ran through the owner’s hands, leaving no time to actually work on the business. The relief on their faces when they no longer have to carry that is one of the most rewarding parts of what we do — and watching the business grow once the owner can focus on it is even better.
02One employee is “the computer person”
This person may be capable and helpful. They may also have an entirely different job. When all technical knowledge lives in one employee’s head, the business has a single point of failure: if that person is out, leaves, or becomes overwhelmed, nobody knows how things were configured. Good intentions are not documentation.
I have seen both sides of this. On one, the “computer person” holds every login and all the access — then gets frustrated and takes the whole company’s access with them. I helped recover two companies from exactly that in the first quarter of 2026 alone.
On the other side is the capable person with no ill will who is simply buried. IT was never in their job description, but in a small business everyone pitches in — so they burn out, quietly stop doing their real job for weeks, and put out so many fires that nobody notices production has stalled. If they are not your dedicated IT person, pairing them with someone who is feels like water to somebody who has been in the desert too long.
03New employees are set up differently every time
One person gets a new laptop. Another inherits an old one. One account has multifactor authentication; another does not. Software is installed from memory. Access is copied from the last employee “because they had a similar role.” Inconsistent onboarding creates support problems and unnecessary access. A mature process uses role-based standards, a checklist, approvals, and a documented handoff.
04Former employees may still have access
This is one of the clearest signals. If nobody can confidently say that a departing employee’s email, files, remote access, applications, shared passwords, and devices were handled correctly, the company has outgrown informal IT. Offboarding is not only disabling one email account — it is understanding every place the person could reach.
05Nobody knows whether the backup can be restored
“We have backup” is not the same as “we can recover.” Maybe a cloud icon says files are synchronized. Maybe a program was installed two years ago. Maybe somebody receives alert emails nobody reads. The questions that matter are:
- What is backed up?
- How often?
- Where is it stored?
- Who checks for failures?
- How long is it retained?
- Has a restore been tested?
- How long would recovery take?
If the business cannot answer, it is relying on hope — and that is if a backup exists at all. So many businesses I talk to have none. They reason that because they have never needed one, they never will. But you never got into a car accident either; does that mean you stop wearing your seatbelt? I recovered my own website because I had a backup in place, and recovered deleted messages after a disgruntled employee because we had set up email backups. Backups. Use them.
06Every outage becomes a vendor blame game
The internet provider blames the firewall. The software company blames Windows. The copier company blames the network. The phone provider says everything looks fine. Meanwhile, the employees still cannot work. A growing business needs someone who can understand the complete environment and coordinate the vendors. The goal is not to win the argument — it is to own the problem until the business is operating again.
One client’s ISP kept insisting the problem was their equipment. We proposed a network overhaul to our standard, and within the first week the logs narrowed it to the ISP’s own modem — dropping several times a day with latency spiking past 500 ms. Within 24 hours the ISP sent someone to fix it. Two years of internet issues, resolved in one week of logs and a single service call.
07Technology purchases happen during emergencies
A computer dies, so somebody drives to a store and buys whatever is available. A new employee starts Monday, so a laptop is ordered Friday. Storage fills up, so the company upgrades without understanding why. Emergency purchasing usually costs more and produces an inconsistent environment. Technology should be planned: lifecycle, standards, warranties, workload, budget, and replacement timing.
08Security decisions are based on assumptions
Some of the most common things I hear:
These statements are common because security is difficult to see. But cloud services still depend on identities, permissions, configurations, devices, users, vendors, and recovery. If security has never been assessed, the business does not know whether it has a strong program — only that nothing obvious has happened yet. Far too many people are surprised by our onboarding audit and what it finds, both hidden and in plain sight.
09Important technology exists without documentation
Who owns the domain? Which account controls the internet service? Where are the recovery codes? Which vendor installed the cameras? What model is the firewall? Which licenses renew annually? Who has administrator access? If the answers require searching an old employee’s inbox or calling “the guy who set it up,” the business has accumulated technical debt. Documentation is not exciting, but it is the difference between controlled support and archaeology.
When I took over for a client whose previous IT person left nothing documented, it was the same as starting from scratch. They had the admin passwords — but so did everyone else. Five locations, five different networks, different computers, no standards, no centralization. A year later it was all documented, so whether they wanted to build their own IT department or faced an audit or a breach, everything was ready for review.
10Technology decisions are no longer small decisions
When the business had three people, changing an application was simple. Now a change affects payroll, customer communication, access, training, data retention, integrations, security, compliance, and the way 20 people do their jobs. At that point, technology is not an office supply — it is an operating function. The company needs planning, standards, accountability, and somebody who can connect technical choices to business outcomes.
How many signs mean you have outgrown DIY IT?
There is no magic score, but here is a practical way to think about it:
The number of employees is not the only factor. A five-person financial practice may need more structure than a 15-person company with simple systems and little sensitive information. Dependence, complexity, risk, and downtime matter.
We manage well over 100 endpoints at once, and when the standard is applied the difference is stark. At 1,000 endpoints — then 10,000 — that standard has to hold across the board, or expectations cannot. Because we do not want to let anyone down, we put security first as a repeatable standard for everyone: it protects our clients and our service quality alike.
The transition does not have to be dramatic
The U.S. Small Business Administration recommends formalizing IT and security practices well before a company scales past ad hoc support.
Moving beyond DIY IT does not mean replacing everything on day one. A responsible transition may begin with:
- 01Inventorying users, devices, services, and vendors
- 02Securing administrative access
- 03Reviewing Microsoft 365 and multifactor authentication
- 04Confirming backup and recovery
- 05Documenting the network and critical accounts
- 06Establishing onboarding and offboarding
- 07Identifying unsupported or high-risk equipment
- 08Building a realistic improvement plan
Then the business can prioritize instead of panic. The goal is not to make technology more complicated — it is to make responsibility clearer. Employees know where to get help. The owner is not the help desk. Access follows a process. Vendors are coordinated. Backups are checked. Purchases are planned. Security is assessed. The environment is documented.
Technology becomes less visible because somebody is finally taking care of it on purpose. That is the point where DIY IT becomes managed IT.
