Frequently Asked Questions

Macktez is a New York City technology firm, founded in 1996, that serves as the primary managed service provider (MSP) for most of its clients and as a senior consulting partner for all of them. We lead with strategy: an assessment, a roadmap, and a written Recommendation before any work begins. Then we design, install, and run the systems themselves.

That work covers identity and single sign-on, devices, networks and Wi-Fi, servers and cloud, backup, security, email and domains, and increasingly AI and automation. It is organized into four practice areas: Technology Consulting, Managed Services, Buildout & Installation, and Ephemeral Infrastructure for events and temporary spaces.

Every engagement is led by a senior practitioner, and in many of them Macktez acts as a fractional CTO or CISO, working directly with the CFO, COO, CTO, or CIO.

A managed service provider (MSP) is an outside team that runs an organization’s technology day to day for a flat monthly fee, rather than being called only when something breaks. That typically means managing identities and devices, keeping networks and servers healthy, verifying backups, maintaining domains and email, and handling the help desk.

For most of our clients, Macktez is the MSP: not a layer on top of another provider, but the team running the environment. Where a client has internal IT, we can instead be the senior layer above it, sharing responsibilities, which reduces both scope and cost.

An IT consultant advises: assesses your environment, recommends and designs, perhaps manages a project, and then leaves. A managed service provider (MSP) operates: runs your technology day to day under a monthly subscription and is accountable when something breaks. Most organizations need both at different moments. The common mistake is hiring one and expecting the other: a consultant who disappears after the roadmap, or an MSP that keeps the lights on but never tells you what to do next.

Macktez does both inside one relationship. Engagements usually begin with Strategy & Advisory work, an assessment, a roadmap, and a written Recommendation. The resulting projects are delivered as fixed-fee work, and for most clients we then stay on as the MSP running the environment. If you already have an MSP you are happy with, we can be the strategic layer above it as fractional CTO. If you already have strategy and need someone to run things, we can be the MSP.

Macktez fits organizations whose leadership is involved in technology decisions: teams that need a real MSP rather than only a help desk, that have IT coverage but no strategic direction, or that are planning a significant infrastructure initiative. Established organizations use us for strategic work alongside internal IT. Growing companies use us to build the foundation from day one. Smaller teams have us implement foundational systems and either train their people or manage the systems for them.

We are not the right fit for lowest-bid commodity IT, for purely transactional break/fix with no ongoing relationship, or for organizations unwilling to invest the time and budget that doing things properly requires.

Yes. Our clients are often based in New York City, but we work with organizations anywhere. All engagements run on New York City time. Remote collaboration works well, and in-person work is available when appropriate. Most buildout and event work takes place in and around New York.

From lean teams of a few people to organizations of several hundred. Our managed service packages start at a minimum of 5 identities (Essentials) and 10 identities (Core Suite), and organizations of 100 or more employees often benefit from economies of scale in pricing.

The case studies give a sense of the range: a foundation with a small staff and a large endowment, a 100-person architecture firm, a national law firm doubling its workforce, a nonprofit with 45 locations, and a park that welcomed 1.7 million visitors in its first year.

Creative and design firms, nonprofits and foundations, cultural institutions and parks, financial services, media and publishing, architecture, audio and video post-production, event production, education, healthcare, professional services, manufacturing, retail, logistics, and technology companies.

What those organizations have in common matters more than the industry: leadership that is involved in technology decisions and an environment that has to work every day.

Yes. Many engagements are co-managed: your team handles what it is best placed to handle, we take the senior and back-end work, and the division of responsibility is written down. Because our scope is smaller, there is often room for reduced pricing.

When a client’s help-desk volume grows large enough to warrant someone in the building, we help hire and onboard that person and stay on as the senior layer above them. Fractional CTO work follows the same pattern: for organizations with existing IT staff or another provider, Macktez complements rather than replaces.

A team assigned to you, led by a senior practitioner. Routine requests go to technicians, trickier configurations to systems engineers, and architecture and security to senior practitioners, so you are never paying senior rates to reset a password and never waiting for a junior to escalate something that needed judgement. A technical account manager owns the relationship and checks in with you regularly.

Every engagement is led by a senior practitioner from day one, and many of our client relationships are measured in decades, so the people who know your environment tend to be the same people next year. Where a first pass is handed to a digital colleague, as our support agent does for ticket investigations, a Team Member still reviews the findings and decides.

Start with a free 40-minute conversation with our client services team about where your organization is and where it needs to be over the next 12 to 24 months. You can book it online or write in and someone from the Team will get back to you.

If there is alignment, the next step is usually an Initial Assessment, which runs $3,000 to $5,000 and takes about four weeks. From that we produce a scope and proposal: objectives, deliverables, timeline, and investment. Then the engagement begins, senior-led from day one.

No. Every system we build is documented so it can be run by Macktez, by your own team, or by someone else. Clients who prefer to run systems themselves get complete documentation and a handoff rather than a dependency.

Project work is priced as a fixed fee against a fixed scope. Managed services are monthly subscriptions reviewed with you each quarter. Advisory engagements carry a three-month minimum. The specific terms are set in your proposal.

You do, in both cases, and you always did. Your email, files, and systems live in your own tenants and accounts, Microsoft 365, Google Workspace, your directory, your cloud subscriptions, registered to your organization, with Macktez holding administrative access rather than ownership. Your domain is registered to you. When a relationship ends we remove our access. Nothing has to be migrated out of a Macktez-owned system, because nothing lived there.

Documentation is a deliverable, not a trade secret. The Initial Assessment produces an environment overview, a network overview, and a topology, and managed services keep records such as topology diagrams, VLAN schedules, rack diagrams, and firewall rules current. That documentation is yours, and it is what makes a handoff to an internal team or another provider orderly.

Since 1996. Macktez was founded in New York City by Noah Landow and Michael Horst and has focused on infrastructure for thirty years.

Several client relationships are measured in decades: a 30-year partnership with the design firm 2x4, nearly twenty years with the audio post-production house Sonic Union, and ten years with the Jerome L. Greene Foundation.

A fractional CTO or CIO is a senior technology leader who works with your organization part time: joining leadership meetings, setting the roadmap, reviewing vendor contracts and insurance questionnaires, and making sure technology decisions serve the business. You need one when technology decisions are being made without that perspective, which is common in organizations too small for a full-time executive.

Macktez provides fractional CTO and CISO leadership through ongoing monthly engagements or project-based work. Typical work includes multi-year roadmaps, disaster recovery planning, cybersecurity assessment oversight, network strategy, vendor and contract review, and incident post-mortems. Advisory engagements carry a three-month minimum.

The titles overlap more than they differ. A fractional or virtual CIO (vCIO) usually focuses on how technology serves operations and budget, a fractional CTO leans toward architecture and build decisions, and a fractional CISO focuses on security. In a small or mid-size organization one senior person typically covers all three, and that is how our fractional CTO and CISO work is structured: quarterly leadership meetings, board roadmaps, vendor and contract review, insurance questionnaires, and incident post-mortems.

The independence question is fair. A vCIO employed by your MSP will recommend things the MSP then gets paid to do. We handle that conflict in the open. Every project starts with a written Recommendation you approve. Projects are a fixed fee against a fixed scope, so there is no incentive to let work expand. And every system is documented, so you could take the recommendation elsewhere. For organizations that keep another MSP, our fractional CTO role is purely advisory and complements rather than replaces that provider.

It depends on the work, and we do not quote a number before we understand what you need. The first conversation is free. An Initial Assessment runs $3,000 to $5,000. Projects are priced as a fixed fee against a fixed scope. Managed services are a flat monthly subscription priced per unit: per identity, per endpoint, per site, per domain, per server. Ongoing help desk and advisory work run on a monthly retainer.

We generally do not bill hourly, because it misaligns our incentives with yours. Where hourly work does happen, rates run from $150 to $500 an hour depending on the work. The pricing page lists every published figure.

Because the quotes are rarely for the same thing. One per-user price may include help desk, security tooling, backups, and onboarding. Another may bill each of those separately, cap tickets or hours, or exclude after-hours and projects. The cheapest number is usually the narrowest scope, and the gap shows up later as change orders or as work that simply is not done.

To compare fairly, line the proposals up on the same questions. What is included per user and per site? What costs extra: projects, after-hours, data recovery, major upgrades? Who does the work, and at what level? How is setup priced? What is the minimum term? What documentation do you receive, and how do you leave? Our pricing page publishes every figure for exactly that reason: per-unit prices, package minimums, typical setup ranges, and what is excluded.

Our two packages are Essentials at $50 per identity per month (minimum 5 identities) and Core Suite at a $500 monthly base plus $75 per identity (minimum 10 identities). Core Suite is the most common choice.

Services are also available à la carte: Identity Management $30 per identity, Endpoint Management $35 per endpoint, Network Management $300 per site, Security & Domain $400 per domain, Server Management $350 per server, Backup Management $12 per user, and Cybersecurity Awareness $5 per identity, all per month. Minimums apply to some services, and Windows and specialized servers are priced individually.

Essentials is the minimum entry point: Identity Management and Endpoint Management for $50 per identity per month, with a 5-identity minimum. It is very often paired with a Managed Support retainer for the help desk.

Core Suite bundles all five management services, Identity, Endpoint, Backup, Domain, and Network, with consolidated billing, for a $500 monthly base plus $75 per identity, with a 10-identity minimum. The base license covers one domain, one location, and a password-management SCIM bridge; identity, endpoint, and backup are licensed per identity. It costs less than buying the same services à la carte.

Setup costs are quoted per engagement, and the pricing page gives ballpark ranges rather than rigid quotes: roughly $2,500 and up each for identity and endpoint management, $2,000 and up each for network and server management, $4,500 and up for security and domain, $500 and up for backup, and about $15,000 and up for a full Core Suite onboarding.

Setup means agents installed, systems configured, automated alerts set, and your team assigned. When an engagement begins with an Initial Assessment, that part typically takes about four weeks, depending on the state of your documentation and the availability of your team.

Rarely. We strongly prefer a fixed fee against a fixed scope: you know the cost before we begin, and we carry the risk of execution. Most of our project work is structured that way, and anything definable is pulled out of a retainer and priced as a project.

When hourly work does happen, rates are not fixed. They run from $150 to $500 an hour: cabling and display mounting at the low end, senior advisory such as joining a board meeting as fractional CTO at the top.

An Initial Assessment is a structured audit of your current technology, and it is how most new engagements begin. It runs $3,000 to $5,000 and typically takes about four weeks, contingent on documentation quality and staff availability. Candidly, we usually lose money on it.

It records your key assets and credentials, every on-premises and cloud service, the network topology, security and backup posture, the IT budget, and the pain points, and it produces basic support documentation and initial recommendations. Afterward we deliver a strategic roadmap and become available for incident support and service requests.

Every Macktez project starts with a written Recommendation. It lays out what we will do, why, and how; what it will cost in equipment, labor, and licenses; the timeline; and what you need to provide for it to succeed.

It is the document you approve before work begins, and it is why our project pricing is a fixed fee: the scope is settled first.

Advisory and strategy engagements are structured on a monthly retainer with a minimum three-month commitment. Managed services are flat monthly subscriptions with minimum identity counts (5 for Essentials, 10 for Core Suite) and are reviewed with you each quarter. Project work is a fixed fee for a fixed scope. The specific terms are set in your proposal.

Managed Support retainers start from an educated estimate for new clients and are adjusted quarterly. After six months to a year we understand your usage well enough to forecast the year and amortize it evenly.

Anything definable enough to be a project. New systems, installations, migrations, and enhancements are scoped and priced separately as fixed-fee projects rather than absorbed into a retainer. Major operating system version upgrades and third-party application support are project-scoped. Data recovery after an incident, hardware remediation, and third-party vendor support are separate engagements from Backup Management. Custom policy development is separate from the awareness subscription. After-hours and emergency response are arranged separately. Hardware, software licenses, and cloud consumption are itemized in the Recommendation.

The principle is that defined work is pulled out as a fixed-fee project and the retainer is reserved for the genuinely undefinable. That keeps the monthly number stable and means you approve larger spending before it happens, not after.

Two things reliably do. Organizations of 100 or more employees often benefit from economies of scale. And when we work alongside your internal IT team and share responsibilities, our scope is smaller, so there is often room for reduced pricing.

Choosing Core Suite over the same services à la carte also costs less, and pulling definable work out of a retainer into fixed-fee projects keeps the retainer itself smaller.

Seven areas, each available on its own or bundled. Identity Management runs your directory and single sign-on: MFA, SSO, and authentication logging. Endpoint Management keeps devices patched, protected, encrypted, and inventoried. Network Management monitors your switches, firewalls, and wireless continuously. Server Management covers monitoring, security patching, health alerts, and backup verification for on-premises and cloud servers. Backup Management monitors and verifies your Microsoft 365 or Google Workspace backups. Security & Domain Management handles registration, DNS, and email authentication (SPF, DKIM, and DMARC). Cybersecurity Awareness provides staff training and policy on an annual subscription.

Those services are back-end work. The hands-on help desk, onboarding, offboarding, and everyday troubleshooting are handled through a Managed Support retainer.

Help desk requests and incident response, employee onboarding and offboarding (accounts, access, and device provisioning), device configuration and everyday troubleshooting, password and login assistance, onsite help when something cannot be resolved remotely, a dedicated portal to submit and track requests, and regular check-ins with a technical account manager.

Work is routed to the right level: technicians for routine requests, systems engineers for trickier configurations, and senior practitioners for architecture and security, so you are never paying senior rates to reset a password. Larger work, such as new systems or installations, is scoped separately as a fixed-fee project, and after-hours and emergency response are arranged separately.

Support runs on New York City time, through the request portal, by email at support@macktez.com, and by phone. After-hours and emergency response are arranged separately rather than assumed.

We do not publish a single response-time figure, because retainers are sized to each client and reviewed quarterly. Expectations for your organization are set in the proposal, and a technical account manager checks in regularly to make sure they are being met.

Yes. Mixed fleets are the norm for our clients. We manage Macs and Windows PCs through JumpCloud, Microsoft Intune, or both, including zero-touch enrollment, disk encryption (FileVault and BitLocker), screen lock, remote lock and wipe, and automated patching.

Because JumpCloud works across Mac, Windows, and Linux, and Intune now offers Platform SSO for Mac as well as Windows, the choice of directory does not have to follow the choice of hardware. We have run hybrid enrollment across JAMF, JumpCloud, and Intune where a client needed it.

Automated patching of security and operating system updates, antivirus and malware protection, asset tracking, remote lock and wipe (macOS), and enforcement of screen lock and disk encryption, all for $35 per endpoint per month. It is back-end work: remote access is used for diagnostics and patch management, not for user-facing assistance, which comes through Managed Support.

Major operating system version upgrades and third-party application support are scoped as projects.

Through your directory. Each person has one identity that grants access to their device and applications, so onboarding means creating that identity and binding a device to it, and offboarding means disabling it. Where applications support SCIM provisioning, accounts are created and removed in every connected application automatically. Revoking access at the single sign-on level removes platform access at the same time, and a lost or departing device can be locked or wiped remotely.

The hands-on work of onboarding and offboarding is part of Managed Support. Identity Management keeps the back end, the directory, MFA, and authentication logging, running underneath it.

Yes. Microsoft and Google keep your services running, but they do not protect you from deletion, ransomware that reaches synced files, a departed employee’s account, or a retention window that has passed. A separate backup does.

Backup Management, $12 per user per month, monitors Google Workspace and Microsoft 365 backups automatically, verifies their integrity periodically by hand, and responds to alerts. For infrastructure we follow a 3-2-1 strategy with encrypted off-site copies and regular, verified restore testing. Actual data recovery is handled as a separate engagement.

The monitoring runs continuously. Our monitoring platform collects a snapshot of every client’s network, server, and backup health every five minutes, keeps the history, and applies health rules automatically. Endpoint protection and email authentication work the same way, around the clock.

Alerts are worked by people during business hours on New York City time. After-hours and emergency response are arranged separately, so if your organization needs someone acting on an alert at 3 AM, that is set up deliberately in your proposal.

Yes, because most attacks are not aimed at anyone in particular. Phishing campaigns, credential stuffing, and ransomware are run at scale against every mailbox and every exposed system they can find, and a small organization with a reused password or an unpatched firewall is simply an easier door than a large one with a security team. Attackers also use small organizations as a route into the larger ones they do business with.

The practical consequence is that the basics matter more than the exotic. MFA on every account, managed and encrypted devices, verified backups, and email authentication close the doors that automated attacks try first. None of that requires an enterprise budget, and it is where our security work with small organizations and nonprofits starts.

Five things, in roughly this order, and none of them exotic. Turn on multi-factor authentication for every account, with phishing-resistant methods for administrators. Put every laptop and phone under management so it is encrypted, locked, patched, and running endpoint protection. Make sure backups exist, live off site, and have actually been restored at least once. Authenticate your email domain with SPF, DKIM, and DMARC so nobody can send as you. Give everyone a password manager so passwords stop being reused.

Those five close most of the doors automated attacks try first, and they are what Management Essentials and Core Suite put in place. Once they are done, a cybersecurity assessment against the NIST framework tells you what to do next in priority order, and the answers to insurance and vendor questionnaires largely write themselves.

No. Our security program is designed and operated to align with the controls in the NIST Cybersecurity Framework (CSF) 2.0, ISO/IEC 27001:2022, and the SOC 2 Trust Services Criteria, but Macktez is not currently the subject of a SOC 2 attestation and is not ISO 27001 certified. We say so plainly because the distinction matters.

We complete security questionnaires and share documentation under NDA, publish a security overview, and help clients become audit-ready for their own SOC 2 or ISO efforts.

Only if a customer or partner is going to require it, and for most small organizations outside software and services, none will. SOC 2 is an attestation report prepared by a CPA firm about your controls, designed for companies that hold other companies’ data. It is expensive and ongoing, and it does not by itself make you more secure.

What most small organizations need is the substance a SOC 2 report would describe: MFA enforced everywhere, managed and encrypted devices with endpoint detection, verified backups, email authentication, a written incident-response plan, and someone accountable for all of it. If you do start being asked for SOC 2, usually because you sell to larger companies, we help clients become audit-ready, and in the meantime we answer vendor security questionnaires and the SIG Lite with you. Macktez itself aligns to SOC 2, ISO 27001, and NIST CSF without being certified, and we say so plainly.

A NIST-based review of your security posture with a gap analysis and a prioritized remediation roadmap. It begins with a self-guided questionnaire, continues with our review and one-on-one clarification sessions with key stakeholders, and analyzes the results against the NIST Cybersecurity Framework.

You receive a cybersecurity readiness report and prioritized remediation recommendations you can act on in order. A short self-assessment is available in Macktez University if you want a sense of where you stand first.

Multi-factor authentication (MFA) requires something beyond a password to sign in: a code, a push notification, or a hardware key. It stops most account takeovers, because a stolen password alone is no longer enough.

Phishing-resistant MFA goes further. Codes and push approvals can be tricked out of a person by a convincing fake login page; a passkey or FIDO2 security key cannot, because it is cryptographically bound to the real site. We enforce phishing-resistant MFA on all of our own administrative access and recommend it for yours.

Yes. Vendor security questionnaires, the SIG Lite, and cyber insurance applications ask the same kinds of questions about MFA, backups, endpoint protection, email authentication, and incident response. As your MSP or fractional CTO we answer them with you, and more importantly make sure the answers are true.

Macktez University has a guide to the SIG Lite questionnaire, and reviewing insurance questionnaires is part of our fractional CTO work.

Most carriers now require the same core controls before they will issue or renew a policy, and they ask about each on the application: multi-factor authentication on email, remote access, and administrator accounts; endpoint detection and response (EDR) on every device; backups that are encrypted, kept off site or offline, and tested; timely patching; security awareness training for staff; and a written incident-response plan. Many also ask about email filtering, privileged access, and whether you have had an incident before.

Answering yes honestly to each of those is what our managed services are designed to make true. Identity Management enforces MFA. Endpoint Management covers EDR, patching, and encryption. Backup Management verifies backups. Cybersecurity Awareness covers training. The disaster recovery and incident plans are written down. We complete the application with you, and more importantly make sure the answers hold up on the day you need to make a claim.

A disaster recovery plan (DRP) is the written procedure for getting your organization running again after a serious failure: how you detect and investigate a problem, when you declare a disaster, how you recover each critical system and in what order, and how you restore normal operations and review what happened. If your organization would struggle to answer “what happens if the server room floods” or “what if ransomware encrypts everything”, you need one.

Our DRP work identifies the critical systems, sets recovery time and recovery point objectives (RTO and RPO) for each, drafts step-by-step procedures, recommends backup and redundancy to meet the targets, and then tests the plan and refines it.

What happens depends almost entirely on the groundwork. Verified backups you can actually restore from, endpoint detection on every device, MFA enforced everywhere, and email authentication that keeps forged mail out are what turn a disaster into an incident.

When something does happen, incident response is part of Managed Support, and we follow a documented incident-response plan with defined roles, clear client-notification expectations, and a post-incident review. Larger recovery work is scoped as a project, and emergency response outside business hours is arranged in advance rather than improvised.

Often you don’t, which is the problem. A compromised account or device can sit quiet for weeks while an attacker reads mail, sets up forwarding rules, and waits for an invoice to intercept. The visible signs are mailbox rules you did not create, sign-ins from places your people are not, MFA prompts nobody requested, customers reporting emails you did not send, files renamed or encrypted, security tools switched off, and password-reset messages you did not ask for.

The dependable answer is to watch for the invisible signs automatically: endpoint detection and response on every device, identity threat detection that flags impossible sign-ins and new inbox rules, authentication logging through your directory, and DMARC reports that show who is sending as your domain. That is what our managed security and identity services put in place, and our support agent now assembles the sign-in history and alert detail for suspicious events before a Team Member reviews them. If you suspect something right now, change the affected password, revoke the account’s sessions, and call us before you start deleting anything.

Yes, as an annual subscription priced at $5 per identity per month. It includes online training resources and exercises, security and electronic-use policy templates, a staff acknowledgment workflow so you can show who has read what, and training for your administrators. It integrates with Identity Management so the roster stays current.

Custom policy development and implementation consulting are available as separate engagements.

A SIEM — Security Information and Event Management — collects log data from across your entire environment (servers, firewalls, endpoints, cloud services) and correlates it to detect threats and anomalies.

The value is in aggregation. A single failed login attempt isn’t interesting. A thousand failed login attempts against one account at 3 AM from an IP in a country where you have no employees — that’s a pattern worth acting on. A SIEM catches it.

Modern SIEMs combine rule-based alerting (triggers you configure) with machine learning (baseline normal behavior, alert on deviations). The ongoing tuning is what makes them useful — raw SIEM data produces enormous noise, and turning it into actionable signal requires both expertise and time.

For most organizations under 500 employees, a standalone SIEM is probably overkill. The more practical entry point is a managed MDR service that includes SIEM capabilities as part of an end-to-end offering.

EDR — Endpoint Detection and Response — is software on your devices that monitors for malicious behavior and provides tools to detect, investigate, and respond to threats. CrowdStrike, SentinelOne, and Carbon Black are examples. It’s the evolution of antivirus: instead of matching known signatures, it watches what processes are doing and stops behavior that looks like an attack.

MDR — Managed Detection and Response — wraps EDR with a team of security analysts who monitor your environment 24/7. The MDR provider watches the alerts from your EDR, triages them, escalates real threats, and often has the authority to take action on your behalf.

The practical distinction: EDR is a tool. MDR is a tool plus a team.

EDR alone requires someone internal to monitor and respond to alerts — something most IT teams don’t have the bandwidth or specialization for. MDR solves that by outsourcing the watch function to specialists. For organizations that want serious security coverage without building an internal SOC, MDR is typically the right answer.

Yes, under the vendors’ own vetting programs. Macktez is an approved organization in Anthropic’s Cyber Verification Program (CVP), which allows vetted security teams to use Claude for legitimate security work such as vulnerability analysis and authorized testing, and in OpenAI’s Daybreak Blue program (Trusted Access for Cyber), which covers defensive work such as vulnerability triage, detection engineering, and incident response.

In practice that means our security investigations, including the automated ones our support agent runs on sign-in anomalies and endpoint alerts, can use frontier models without tripping the safeguards that block that work for unverified users.

Single sign-on (SSO) means one identity, with one password and one MFA method, grants access to every application a person uses. Instead of forty passwords of varying quality, there is one that is strong, protected by MFA, and controlled by you.

It matters as much for a 15-person organization as for a 1,500-person one, because the risks are the same: a reused password, a forgotten account that still works after someone leaves, no way to know who has access to what. With SSO, disabling one identity closes every door at once. It is also the unit we price managed services by: an identity is any SSO account with a username and password, tied to a person or a service account.

It depends on what you already run and how complex your application environment is. If your organization is Microsoft-first, you already have Entra ID with Microsoft 365, and the question is how well you are using it: conditional access, MFA, Intune, and Autopilot are all there. If you run a mix of Macs and Windows, or you are cloud-first without a structural reason to be Microsoft-first, JumpCloud gives you directory, device management, SSO, MFA, RADIUS, and LDAP in one place without assembling Microsoft’s full stack. Okta suits large, complex application environments with hundreds of SaaS integrations and multiple identity sources.

Macktez implements all three. Our own identity runs on JumpCloud and Microsoft Entra, we are JumpCloud’s MSP Partner of the Year for the Americas, and we know when each is the right answer and how to make them coexist, including federating JumpCloud with Entra ID.

Probably not, if your people work from laptops that leave the office and your applications are in the cloud. On-premises Active Directory was built for desktops inside a physical network. Keeping it means keeping a domain controller, a VPN for it to be useful remotely, and a backup and patching obligation for a server whose main job is sign-in. Cloud directories now do that job without the server: JumpCloud for mixed Mac and Windows fleets, Microsoft Entra ID for Microsoft-first organizations, Okta for large application estates.

You still need a directory. What goes away is the server in the closet. We have migrated organizations from Active Directory to JumpCloud and to Entra, and the usual sequence is to move identity first, bind the devices to the cloud directory, move file shares to SharePoint, Google Drive, or a NAS, and retire the domain controller last. The case for keeping it is a line-of-business application that requires it, and even then it can usually be hybrid-joined rather than primary.

JumpCloud is a cloud-based directory-as-a-service platform that manages user identity, device management, and application access from a single place. If you’re familiar with Active Directory — Microsoft’s on-premises directory — JumpCloud is roughly the cloud-native equivalent, designed to work across Windows, Mac, and Linux without requiring an on-premises server.

What JumpCloud does in practice: it’s your central system for managing employee accounts, controlling what those accounts can access (via LDAP, RADIUS, or SAML), managing device policies, and connecting your organization to cloud applications via Single Sign-On.

For organizations with a mix of Macs and Windows machines, or that have moved fully to the cloud, JumpCloud is frequently the right directory choice. It handles the full employee lifecycle: provision the new hire, configure their device, grant access to the applications they need, and revoke everything when they leave.

Macktez manages JumpCloud for several clients — it’s our most common recommendation for organizations that don’t have a structural reason to be Microsoft-first.

Microsoft Entra ID — formerly called Azure Active Directory — is Microsoft’s cloud-based identity and access management service. It’s the system that verifies who someone is and controls what they can access.

When an employee signs into Microsoft 365, SharePoint, or any application connected via Single Sign-On, Entra ID is doing the authentication in the background. It’s also where you manage user accounts, groups, licenses, and access policies.

Entra ID is not the same as on-premises Active Directory, though Microsoft has worked hard to bridge the two. On-premises AD is the traditional Windows domain system designed for users inside a physical network. Entra ID is cloud-native and designed for the reality that users access resources from anywhere.

The features that matter most: conditional access (require MFA from unmanaged devices), device compliance integration with Intune, and the ability to serve as your central identity provider for hundreds of third-party applications via SAML and OIDC. If you have Microsoft 365, you already have Entra ID — the question is how well you’re using it.

A password manager stores every credential in an encrypted vault, generates strong unique passwords, and fills them in for you, so people stop reusing passwords and stop keeping them in spreadsheets. For an organization, it also means shared service-account credentials live in a vault with an access record instead of in someone’s inbox.

We use and recommend 1Password. Our own administrator credentials and secrets live in a managed 1Password vault, and we deploy it for clients with executive, departmental, and shared vaults, integrated with single sign-on through JumpCloud or Entra so that revoking a person’s SSO access removes their vault access automatically. Core Suite includes the password-management SCIM bridge that makes that work.

Both are capable, well-run password managers, and Bitwarden’s open-source model and lower price make it a reasonable choice for a team that will administer it themselves. We recommend and deploy 1Password because of how it fits into a managed environment. Its single sign-on integration with JumpCloud and Entra means access is granted and revoked through your directory. Its SCIM bridge keeps the user list in sync automatically. Its vault structure, executive, departmental, and shared service-account vaults, matches how organizations actually share credentials. And we use it ourselves for every administrator credential and secret.

If you already run Bitwarden well, we will manage it. What matters is that every person has a manager, every shared credential lives in a vault with an access record, and leaving the organization removes vault access automatically.

Disable the identity first, within the hour, because everything else hangs off it: suspend the directory account, revoke active sessions and tokens, and reset any shared credentials the person knew. Then the device: lock or wipe it remotely, and recover it. Then the trail: redirect or delegate the mailbox, transfer file ownership, remove the person from groups, shared mailboxes, and distribution lists, rotate any API keys or service passwords they held, and remove them from the SaaS tools that are not behind single sign-on, which is where most leaks happen. Finally, write down what was done and when.

Where single sign-on and SCIM provisioning are in place, disabling the one identity removes access to every connected application at once, and password-manager access goes with it. The hands-on offboarding work is part of Managed Support, and the directory setup that turns it into a single action is Identity Management.

Zero trust is the principle that no device or connection is trusted because of where it is. Being on the office network proves nothing; every request is checked against who the person is, whether their device is managed and healthy, and what they are allowed to reach. In practice it is built from single sign-on, enforced MFA, device trust, conditional access, and least privilege.

It is how we run our own environment and how we design identity for clients: conditional access policies that require a compliant device, device trust for employee-owned phones and laptops, and permissions scoped to what each role needs.

SAML — Security Assertion Markup Language — is the protocol that makes Single Sign-On work for enterprise applications. It allows users to log into one system (the identity provider, like JumpCloud or Entra ID) and automatically gain access to connected applications (service providers, like Salesforce, Slack, or Workday) without entering separate credentials.

How it works: your employee clicks “Log in with [your company]” in Salesforce. Salesforce redirects them to your identity provider. Your identity provider confirms their identity and sends back a signed assertion. Salesforce accepts it and logs them in. The employee has no Salesforce password — their identity provider is the credential that matters.

SAML has been the dominant enterprise SSO standard since 2001. If you’re configuring SSO for a business application today, it almost certainly supports it. Understanding SAML matters when SSO breaks — tracing a failed authentication usually comes down to a misconfigured assertion or a mismatched entity ID.

SCIM — System for Cross-domain Identity Management — is the standard for automating user account provisioning. Where SAML handles “who is this person?”, SCIM handles “create this account” and “disable this account.”

Without SCIM: when someone joins, your IT team manually creates accounts in every application they need. When someone leaves, you manually go through each one to disable or delete their access. The gap between someone’s last day and when their accounts are actually disabled is a real security window.

With SCIM: your identity provider (JumpCloud, Entra ID, Okta) pushes changes to connected applications automatically. Add someone to the Engineering group in your directory, and SCIM provisions their GitHub access. Remove them when they leave, and every connected application gets the deprovisioning event simultaneously.

SCIM is one of those features that looks administrative but has direct security implications. It’s worth prioritizing in any SSO implementation.

OIDC — OpenID Connect — is a modern authentication standard built on top of OAuth 2.0. Like SAML, it enables Single Sign-On. Unlike SAML, it uses JSON rather than XML and is designed for both web applications and mobile apps.

If SAML is the enterprise SSO standard, OIDC is the modern web standard. Consumer apps (Sign in with Google, Sign in with Apple) use OIDC. Many newer enterprise applications prefer it as well.

The practical distinction: SAML and OIDC accomplish the same goal — SSO — but OIDC is lighter weight, easier to implement, and better suited to modern applications and mobile. Most identity providers support both.

When setting up SSO for a new application, you’ll be asked which protocol it supports. SAML is the safe default for legacy enterprise apps; OIDC is increasingly common in newer products. Understanding which one you’re working with matters for troubleshooting — a failed SAML assertion and a failed OIDC token exchange fail differently and require different investigation.

Either can be run well, and we manage both. Microsoft 365 is the stronger fit for organizations that live in Outlook, Teams, SharePoint, and Excel, that have Windows-heavy fleets, or that want Entra ID, Intune, and Autopilot as their identity and device stack. Google Workspace suits organizations that collaborate in shared documents, run mostly on Macs and Chromebooks, and want simpler administration.

The decision usually turns on how your people actually work, what your key applications integrate with, and which AI assistant you want built in (Microsoft 365 Copilot or Gemini). We can federate either one with JumpCloud or run it on its native identity, and our Identity Management setup includes a single email-provider federation.

With mobile device management (MDM) tied to your directory. A Mac enrolled through Apple Business and managed by JumpCloud or Intune arrives at the employee ready to sign in: FileVault encryption on, screen lock enforced, required apps installed, and the device bound to the person’s identity so one login opens the Mac and their applications. If it is lost, it can be locked or wiped remotely.

For personal devices we use device trust rather than full management, so a person’s own iPhone can reach company email only if it meets your requirements, without your IT team controlling the phone.

If Macs are a small share of a Windows fleet and you already pay for Microsoft 365 Business Premium or E3, use Intune. Platform SSO for Mac, FileVault enforcement, compliance policies, and Apple Business enrollment all work, the licensing is already paid for, and one console covers everything. Jamf is the deepest Mac-specific tool and earns its cost when Macs are the majority, when policy changes have to land on devices within minutes, or when you run a large Apple fleet with complex app deployment. JumpCloud is the answer when you want directory, single sign-on, and device management for Mac, Windows, and Linux in one place without Microsoft’s full stack.

We have run all three, including hybrid enrollment across Jamf, JumpCloud, and Intune in a single environment. The deciding factors are usually the Mac share of the fleet, what you already license, and who will administer it day to day.

Apple Business, formerly Apple Business Manager, is Apple’s free portal for organizations that own Apple devices. It enrolls Macs, iPhones, and iPads automatically at first power-on, lets you buy and reassign app licenses in volume, and creates Managed Apple Accounts that belong to the organization rather than the employee. It costs nothing. You need a D-U-N-S number to register.

You need it if your organization owns more than a handful of Apple devices, because without it you are managing them like a consumer: enrolling each by hand, buying apps on personal accounts, and losing both when someone leaves. Apple Business does not manage devices by itself. It hands them to your mobile device management (MDM) tool, Intune, JumpCloud, or Jamf, which applies the policies. We set up both together as part of Endpoint Management.

Mobile device management (MDM) is the system that enforces your policies on laptops, phones, and tablets wherever they are: encryption, screen lock, required apps, operating system updates, and remote lock or wipe. Microsoft Intune, JumpCloud MDM, and Jamf are examples.

If your organization owns devices, or lets employees reach company data from their own, you need MDM. Without it you cannot prove a lost laptop was encrypted, cannot remove company data from a departed employee’s phone, and cannot show an insurer or auditor that your devices meet your own policy.

Windows Autopilot is Microsoft’s zero-touch device deployment system. When a new Windows PC powers on for the first time, Autopilot handles everything automatically — joining it to your directory, installing required apps, applying security policies, and getting it ready for the employee — without IT ever touching the machine.

The practical impact: a new hire can receive a laptop in the mail, power it on, sign in with their corporate credentials, and have a fully configured work machine in under 30 minutes. No imaging, no manual setup, no shipping to IT first.

Autopilot works in tandem with Intune for device management and Entra ID for identity. For organizations already in the Microsoft ecosystem, it’s one of the highest-leverage tools available. The ROI comes from the first hire onboarding that doesn’t require an IT staff member to babysit a laptop.

The catch: it requires proper upfront configuration — Intune enrollment policies, app deployment packages, and device registration with your hardware vendor. Done right, it works beautifully. This is one of those things worth doing correctly once rather than cobbling together over time.

Microsoft Intune is a cloud-based device and application management platform. It’s the system that enforces your IT policies across every device in your organization — Windows laptops, Macs, iPhones, Android — regardless of where they are.

What Intune does day-to-day: it pushes software to devices, enforces security policies (screen lock, disk encryption, VPN configurations), manages certificates, wipes lost or stolen devices remotely, and reports on device compliance.

For Microsoft-first organizations, Intune is the device management backbone. It integrates directly with Entra ID, which means you can define policy like “require a compliant, enrolled device to access company email” — and Intune enforces it automatically.

The distinction that matters: Intune manages the device. Entra ID manages the identity. Together they form Microsoft’s modern device management stack, replacing the older model of on-premises domain joins and Group Policy.

Most often because your domain is not telling receiving mail servers which senders are legitimate. Three DNS records do that: SPF lists the servers allowed to send for your domain, DKIM signs each message so it can be verified, and DMARC tells the world what to do when a message fails those checks and sends you reports on who is sending as you. Missing or misconfigured records, especially after adding a new marketing or ticketing tool that sends on your behalf, are the usual cause.

The fix is to inventory every service that sends mail for your domain, authenticate each one, then move DMARC to enforcement carefully so you do not block your own mail. It is part of our Security & Domain Management service, and we have written up a deliverability engagement as a case study.

DMARC — Domain-based Message Authentication, Reporting, and Conformance — tells receiving mail servers what to do with messages that fail email authentication checks. It’s the enforcement layer that sits on top of SPF and DKIM.

Here’s the context: email was designed without authentication. Anyone can send an email claiming to be from any address. SPF and DKIM address this, but they’re detection mechanisms — DMARC is what tells the world to act on what they detect.

A DMARC policy says: “If email claiming to be from my domain doesn’t pass SPF or DKIM checks, [do nothing / send to spam / reject it] — and report to me what you saw.”

Without DMARC, anyone can send phishing emails that appear to come from your domain. With a properly configured DMARC policy at p=reject, those emails never reach your customers or partners.

The hierarchy: SPF specifies which mail servers can send on your behalf. DKIM cryptographically signs each message so recipients can verify it wasn’t tampered with. DMARC tells the world what to do when either check fails, and sends you reporting data on who’s sending mail that claims to be from you.

Getting to p=reject requires care — you need to confirm all legitimate email sources are properly authenticated first. Moving too fast blocks your own mail. It’s worth the effort.

Every organization that sends mail to Gmail or Yahoo addresses now has to authenticate it, whatever the volume: SPF or DKIM must pass, your sending domain needs valid forward and reverse DNS, and your spam-complaint rate has to stay low. Senders of 5,000 or more messages a day to Gmail are classed as bulk senders and must also have both SPF and DKIM, a DMARC policy of at least p=none, one-click unsubscribe on marketing mail, and spam complaints below 0.3 percent.

So a 20-person firm is not strictly required to publish DMARC. We set it up anyway, because the requirement is the floor, not the point. DMARC is what stops someone else sending as your domain, and its reports show you every service that sends on your behalf, which is how you find the ones that are not authenticated. It is part of Security & Domain Management. Donor mailings, newsletters, and ticketing tools all count toward the bulk-sender threshold.

Brand Indicators for Message Identification (BIMI) is a DNS record that lets your logo appear beside your messages in supporting mail clients such as Gmail and Apple Mail. It only works once DMARC is enforced at quarantine or reject, and most clients also require a Verified Mark Certificate tied to a registered trademark.

It is a visible reward for finishing the authentication work rather than a security control in itself, and a useful signal to recipients that mail carrying your logo really came from you.

Someone who treats it as critical infrastructure, because it is. Your domain is your email, your website, and your identity to every service you sign in to. A lapsed renewal or a stale DNS record can take all of them down at once, and a domain registered under a former employee’s personal account is a problem waiting to happen.

Our Security & Domain Management service, $400 per domain per month, covers registration and renewals, DNS, and SPF, DKIM, and DMARC, with the domain registered to your organization and administered by us. It is included in Core Suite.

The organization, with the registrar account owned by the organization too. The registrant is the legal owner of the domain. The registrar is the company you rent it from. Domains registered under a founder’s personal email, a former employee’s account, or a web designer’s agency login are the most common way an organization loses control of its own email and website, usually at renewal time or when a relationship ends badly.

To take one back, start by asking the current holder to transfer it or to update the registrant to the organization; most will. If they will not or cannot be reached, the registrar’s ownership-dispute process accepts evidence such as incorporation documents, trademark registrations, invoices showing the organization paid for the domain, and the domain’s use for your business email and website. In the worst case a UDRP complaint or legal claim follows, which is slow. Our Security & Domain Management service registers domains to the organization, administers them on your behalf, and tracks renewals so this never comes up.

A distribution list forwards a copy of each message to every member’s own inbox. Nobody can see whether a colleague replied, so it suits announcements rather than requests. A shared mailbox is one mailbox several people open, with its own sent items, so everyone can see what has been answered. It suits info@, billing@, and support@, and it costs no license in Microsoft 365 or Google Workspace. A Microsoft 365 Group or a Google Group adds a shared calendar, files, and conversation history on top, which suits a team or a project rather than an address.

Our rule: a shared mailbox for any address that receives requests, a group for a team that needs more than mail, and a distribution list only for one-way announcements. When the volume at an address grows into real queue work, a help desk tool with a ticket per request replaces the shared mailbox.

Yes, extensively. Nonprofits and mission-driven organizations are one of our largest groups of clients, from foundations and cultural institutions to human-services organizations with dozens of locations.

Examples with public case studies include ten years of executive-level IT partnership with the Jerome L. Greene Foundation and its governance-first adoption of AI, a zero-touch device rollout across 45 locations for a HIPAA-regulated nonprofit, a multi-region cloud migration and a remote-preserve wireless network for a multinational nonprofit, and the network behind a gala at the Metropolitan Museum of Art that raised $4.59 million over Wi-Fi.

Yes, the base edition is free. Eligible nonprofits, 501(c)(3) organizations validated through Google for Nonprofits, which uses TechSoup in the United States, get Google Workspace for Nonprofits at no cost, with business email, Drive, Docs, Meet, and Calendar. Schools, hospitals, and government entities are not eligible. The paid editions, Business Standard, Business Plus, and Enterprise, are available at steep nonprofit discounts.

The free tier is enough for many small organizations’ daily work. It is usually not enough once you need the things funders, insurers, and auditors ask about: advanced security and audit controls, Vault for retention and e-discovery, larger storage, and the business-grade Gemini features. Our usual recommendation is the free edition for most staff and a discounted paid edition for the roles that need the controls, configured and connected to your directory as part of Identity Management.

It can be, with three decisions made deliberately first. Who can turn it on, and in which meetings, because a notetaker that joins every call will transcribe donor conversations, personnel discussions, and legal advice alongside routine updates. Where the transcripts and summaries are stored and who can open them, because they are records, and in many cases discoverable ones. And how long they are kept, because once the minutes are approved the verbatim transcript is usually a liability rather than an asset.

That is how we configured meeting intelligence for the Jerome L. Greene Foundation: summaries and action items stored in secure internal locations available only to the people who would ordinarily have access, treated as drafts a person reviews, and governed by the same permissions as everything else. Business tiers of Zoom AI Companion, Microsoft 365 Copilot, and Gemini do not use your meetings to train their models, which we confirm in the admin console. The board should still decide, as a matter of policy, which meetings are recorded at all.

Usually one of four things: access points in the wrong places or too few of them, channels crowded by your own or a neighbor’s networks, building materials and obstructions that block signal in ways a floor plan does not show, or configuration left at defaults. “Slow Wi-Fi” is also sometimes a wired problem, an internet circuit problem, or a single misbehaving device, which is why guessing is expensive.

The reliable fix starts with measurement: a site survey of actual coverage and interference, a look at the configuration and channel plan, and then placement and tuning based on what the data shows. One of our case studies walks through exactly that for a headquarters that had already replaced its access points.

A review of your network topology documentation, then a comprehensive on-site coverage survey. We evaluate access point placement and coverage, obstructions and building materials, interference, configuration and channel use, and what your people actually experience.

You receive a report with the data, a diagnosis, and prioritized recommendations, which may range from configuration changes to repositioning or adding access points. It is scoped and priced per site.

Fewer than square footage suggests and more than headcount suggests, and the honest number comes from a survey rather than a formula. What drives it is how many devices are active at once in each area (a conference room with twenty laptops and phones needs its own access point), what the walls are made of (glass and drywall pass signal; concrete, brick, and metal ceilings do not), and how the building is shaped. Rules of thumb based on square footage are where estimates start and where many bad installs end.

Our approach is to survey the actual space, place access points where the devices and the obstructions are, and then tune channels and power once people are using it. Too many access points on the same channels can perform worse than too few. A Wi-Fi assessment includes the survey and a report with prioritized recommendations, and wireless installation in a buildout is driven by the same survey.

We design networks from the ground up on Cisco switching (Cisco Business series for cost-effective environments, Catalyst for mission-critical uptime) and SonicWall firewalls, which we standardized on after evaluating Cisco, Juniper, and Fortinet. For wireless we deploy and manage Ruckus and Juniper Mist, among others, and we manage existing Fortinet and other equipment for clients who have it.

Every piece of hardware is pre-configured before it arrives at your site, and every network is documented: topology diagrams, VLAN schedules, rack diagrams, and firewall rule records.

For an office, yes. The firewall is what separates your staff network from guest Wi-Fi and from printers, cameras, and door controllers; it is what gives you a VPN into the office, policy-based routing across two internet circuits, and content filtering; and it is the one device that sees every connection in and out. “Everything is in the cloud” describes where your data lives, not where your people and devices are.

We standardize on SonicWall, the TZ series for small and mid-sized offices and the NSA series for larger ones, and prefer paired deployments in active/standby so that a failure fails over in seconds. There are no open inbound management ports, and firmware is managed through the cloud console.

Continuous infrastructure monitoring, uptime tracking, and health verification for your switches, firewalls, and wireless, performed remotely and in the back end, for $300 per site per month. Our monitoring platform snapshots every client network every five minutes, keeps the history, and maps the live topology across firewalls, switches, and access points from different vendors.

Hands-on changes requested by your staff come through Managed Support, and larger upgrades are scoped as projects.

Less than most people expect, because the work happens before the cutover. We pre-configure every switch, firewall, and access point remotely, document the plan down to the patch schedule, and then execute the cutover in a single maintenance window, often an evening or weekend.

Two case studies show the pattern: a complete server and network overhaul for MakerBot executed over a single holiday closure, and a ground-up redundant network for a 100-person architecture firm that has had zero downtime since deployment.

Many organizations don’t, and some still do. If the server’s jobs were sign-in, file sharing, email, and printing, each now has a cloud home: a cloud directory for sign-in, SharePoint or Google Drive for everyday files, Microsoft 365 or Google Workspace for mail. For a 20-person professional services firm, the closet server can usually be retired at its next replacement cycle, and the money goes to the subscriptions and to managing them.

You still need one, or a network-attached storage system, when the work is large files that have to open fast (video, audio, CAD and BIM, photography), when a line-of-business application requires Windows Server, when you need local surveillance recording, or when the volume of data makes cloud storage and egress cost more than hardware. Those cases are common among our creative, architecture, and production clients, which is why we still design and run Dell PowerEdge, Synology, and VMware infrastructure. The honest answer comes from a total cost of ownership comparison, which is part of every engagement.

Sometimes. Cloud is the right answer for disaster recovery, for reaching applications from anywhere, for workloads that spike, and for organizations that no longer want a server room. For large datasets and performance-sensitive work such as video, CAD, and large file shares, on-premises infrastructure often delivers better economics. Many of our clients run both.

We model the total cost before anyone commits, and we have done it in both directions: replacing a ten-year-old data center with multi-region Azure for a multinational nonprofit, giving a Mac-only architecture firm GPU-accelerated Windows applications in Azure, and keeping video post-production on local storage where it belongs.

All three, with Microsoft Azure as our primary cloud platform. Our Azure work includes migrating virtual machines from on-premises, multi-region domain controllers, Azure Virtual Desktop for Windows applications on Macs, hub-and-spoke networking with Azure Virtual WAN, and Azure Site Recovery for disaster recovery.

We also build and manage AWS environments, including a complete rebuild of an overbuilt AWS environment for a quantitative trading firm with all infrastructure defined in Terraform, and our own monitoring platform runs on AWS. Managed cloud administration covers ongoing administration, cost optimization, and security posture across Azure, AWS, and Google Cloud.

Our recommendation by situation: Azure if you run Microsoft 365 or need Windows desktops and domain controllers in the cloud, AWS if you are building software or data pipelines or your developers already know it, and Google Cloud when the rest of your stack is Google. Most of our clients land on Azure for the first reason.

Usually because cloud bills charge for things that were free or invisible on premises: storage you forgot about (orphaned disks and snapshots from deleted machines), data leaving the cloud (egress), logging and monitoring that scales with volume, virtual machines sized for peak and never resized, and resources left running in test environments. Reserved pricing that was never applied is the other common one.

Stopping it is a management task rather than a one-time fix: tag every resource to an owner, set budgets and alerts, right-size machines against actual usage, apply reservations or savings plans to steady workloads, and review the bill monthly with someone who can act on it. Cost optimization is part of our managed cloud administration for Azure, AWS, and Google Cloud, and it is one reason we model total cost before a migration rather than after the first bill.

Yes. We design, procure, and manage on-premises infrastructure built on Dell PowerEdge servers, Synology storage, and VMware or Hyper-V, and we have run that same stack internally for over a decade. Every engagement includes a total cost of ownership analysis so the decision between on-premises, cloud, and hybrid is made on numbers rather than fashion.

Server Management, $350 per server per month for standard Synology instances, covers remote monitoring, security patching, health alerts, and backup verification. Windows and specialized servers are priced individually.

Keep the active work local and use the cloud for sharing, archive, and backup. Editing 4K video, working in large Revit or AutoCAD models, or opening multi-gigabyte design files is bound by storage speed and the network between the file and the workstation, and a 10-gigabit connection to a Synology with SSD caching will beat any internet connection to cloud storage. The cloud wins for collaboration with people outside the building, for finished-project archive, and as the off-site copy in a 3-2-1 backup.

The hybrid we usually build: a NAS or server on a 10-gigabit network for current projects, replication to a second site or to cloud storage for protection, and SharePoint or Google Drive for documents and client sharing. Where a firm needs Windows-only applications on Macs, Azure Virtual Desktop with a GPU can move the application to the cloud while the files stay where they are fast. Our audio, architecture, and design clients run some version of this.

Broadcom’s 2023 acquisition of VMware brought new subscription licensing, and some organizations have seen cost increases of as much as tenfold at renewal. If you run VMware, your options are to right-size under the new licensing, to move some or all workloads to Hyper-V or another hypervisor, or to move them to the cloud.

We operate VMware internally and help clients work through all three: Broadcom licensing consultation and cost analysis, migration assessments, and disaster recovery with Azure Site Recovery where that is the right destination.

Three copies of your data, on two different kinds of storage, with one copy off site. The point is that no single failure, whether a dead drive, a flooded server room, or ransomware spreading through a network, can take every copy at once.

We follow a 3-2-1 strategy with encrypted off-site copies for our own infrastructure and for clients, and the part most organizations skip is the one we insist on: regular, verified restore testing. A backup that has never been restored is a hope, not a plan.

Recovery time objective (RTO) is how long a system can be down before the damage becomes serious: minutes for a payment system, perhaps days for an archive. Recovery point objective (RPO) is how much data you can afford to lose, measured in time: an RPO of one hour means your backups must be no more than an hour old.

Setting them is the first real decision in a disaster recovery plan, because they determine what the backup and redundancy have to be and what they will cost. We set documented RTO and RPO targets for each client and tune the backups to meet them.

Start with the work, not the tool. Your team already knows which tasks take too much preparation and which questions keep coming back. Most organizations fit one of three starting points: helping your team use the AI tools it already has well, connecting the information a recurring task needs so an assistant or agent can prepare it, or extending something that already works into the next workflow.

For most clients the first step is an assessment of a piece of work the team understands, which produces a practical scope: the people and systems involved, the information required, the decisions that need a person’s review, and the outcomes the project should improve. Sometimes the answer is configuring tools you already pay for. Sometimes it calls for custom software or an agent.

An AI agent is software that uses a language model to do a defined job on its own: it reads what it needs, decides what to check, uses tools to gather information or take an action, and produces a result, on a schedule or when something triggers it. The difference from a chat assistant is that nobody has to type the question.

Our own support.agent is an example. Every 30 minutes it reads our ticket queue, picks out the tickets it can help with, checks the relevant platforms and our own history for that client, and writes up what it found before a person opens the ticket. It has its own identity, its own permissions, and its own audit trail, and it never changes a client system. A Team Member decides what happens next.

It depends on the task, the platforms you already run on, and how each vendor handles your data. Microsoft 365 Copilot fits organizations that live in Teams, Outlook, and SharePoint. Gemini fits Google Workspace environments. Claude and ChatGPT are the strongest general-purpose assistants, and both offer business tiers with admin controls and data commitments. Our deepest experience is with Claude, which we use for our own operations and for client work where an AI needs to use tools and take steps on its own.

We work daily with all four and have no religious position. In practice most organizations end up with the assistant built into their productivity suite for everyday work, plus one general-purpose assistant for heavier tasks, both on business tiers provisioned through their directory.

We start with a piece of work your team already understands well: something repeated often, slowed by scattered information, or dependent on a few experienced people. We look at your workflows, where your data lives, the tools you already pay for, and your team’s capacity to take on something new.

The result is a practical scope rather than a strategy deck: the people and systems involved, the information the work needs, the decisions that must be reviewed by a person, and the outcomes the project should improve. From there we either configure the tools you already have, or build the connection, workflow, or agent the work calls for.

There is no fixed package or workshop format. The assessment is sized to the work, and for most clients it is part of the same relationship we already have as their managed service provider.

Less than most people expect for the model, and more than most expect for the people. We do not publish a fixed price for AI projects, because the cost is set by the workflow and the systems it has to reach. Our own numbers give a sense of scale: the agent that prepares our support tickets runs on a standard Claude plan, about $25 a month, plus a few cents a month for a small classification model, at the prices when we built it. Building it ran on one month of a premium plan, about $125.

The larger investment was the Team’s time to design, build, and supervise it, and the connections to our systems that already existed. That is the honest shape of most AI projects: the model is cheap, and the work is in the integration, the permissions, and the people who review the output.

Not under the business tiers we configure. Claude for Teams and Enterprise, ChatGPT Team and Enterprise, Gemini for Google Workspace, and Microsoft 365 Copilot each commit in their business terms not to use your inputs to train their models. We confirm that setting in the admin console rather than assume it, and document it for you.

Free and personal accounts are a different matter, and their terms vary. That gap is one reason formalizing AI use is usually the first step: moving staff from personal accounts to managed business accounts, provisioned through your directory, with the data handling you expect.

It depends on which account the person is signed into and what the tool is connected to. On a business tier (ChatGPT Business or Enterprise, Claude for Teams or Enterprise, Gemini for Workspace, Microsoft 365 Copilot), your inputs are not used to train the vendor’s models, administrators control settings and retention, and access is provisioned through your directory and removed when someone leaves. On a free or personal account none of that is guaranteed, and the organization has no visibility into what was pasted.

Two other things decide safety. When an assistant is connected to your systems, it can only see what the signed-in person can see, which is a reason to get permissions right in the systems themselves. And anything confidential that goes into a prompt is now in a vendor’s system, which is why some categories, such as personnel matters, legal advice, or client data under NDA, should be governed by policy regardless of tier. Formalizing which tools, on which accounts, for which work is the first thing we do in an enablement engagement.

By deciding what the agent may do before it starts, and putting those limits in the system’s permissions rather than only in its instructions. Each agent gets its own identity in your directory, separate from any person’s login, with group memberships that decide which connections it can reach.

The connections an agent uses to answer questions are built so that a tool that changes a system cannot be added to them. Where a change is possible, that ability sits behind a separate permission the agent does not hold unless the workflow calls for it. Every call is logged under the agent’s own name, with the tool, the arguments, the target, and the outcome.

Our own support.agent works this way: it investigates on a schedule and writes its findings to internal notes, and a Team Member decides what happens next and makes any change.

Years of completed work leave useful records in tickets, project documents, time entries, and conversations, but that history only helps if someone brings it together. We built a repeatable process that gathers the relevant records, connects related information, and produces reference documents checked against their sources.

Every factual statement in a reference carries evidence from where it came from, and a separate review checks whether that evidence actually supports it. Facts, past remedies, and working theories are kept apart so a fix that worked once is not recorded as the cause of a problem. People can inspect, correct, and add to the references, and those contributions are credited and dated.

Your records stay in your systems. The process reads them under the permissions you grant and writes references you control.

Yes, every day, and we write up the results as case studies. Our support agent prepares investigations for network, support, service-request, and security tickets before a Team Member opens them. A knowledge process turned a year of our own tickets, documents, and conversations into checked reference documents for 46 clients. Our monitoring platform was built with AI-assisted development and reuses the connections built for our AI tools, with no AI in the collection loop. This website was designed, built, and is maintained with Claude Code.

Just as important is what people still do: every finding lands with a Team Member who decides and acts, and every consequential change to a client system is made by a person.

Vibe coding is building software by describing what you want in plain language and letting an AI model write the code, then reviewing and refining in a conversation rather than a text editor. It is genuinely new and genuinely useful, and it is safe for business software only when the fundamentals underneath it are sound: source control, a review step before anything deploys, secure authentication, and someone who can tell when the AI has taken a wrong turn.

This website is the example. It is a fully custom site built and maintained through Claude Code, with GitHub, continuous deployment, single sign-on through our directory, and a private development copy where changes are reviewed before they go live. We build custom websites and internal tools the same way for clients, and we will do it, teach it, or build it with you.

Claude Code is Anthropic’s agentic coding tool — a version of Claude that runs in your terminal and can read files, write code, execute commands, and interact with your development environment directly, rather than just generating code snippets in a chat window.

For developers, it functions as a pair programmer with full context of the entire project, capable of making coordinated changes across many files simultaneously. For non-developers managing technical systems, it can execute complex multi-step tasks — like refactoring a website’s navigation structure — through natural language instructions.

The Macktez website was built using Claude Code running on a dedicated Linux VM. Every case study, every service page, the navigation structure, the SEO improvements — all of it was written and deployed through Claude Code sessions, with human review and approval at each step.

The key distinction from chat-based AI: Claude Code doesn’t suggest code, it runs it. That changes what’s possible.

An API — Application Programming Interface — is a defined way for one piece of software to communicate with another. When your application retrieves data from Salesforce, or your website processes a payment through Stripe, it’s calling an API. APIs are specific to each service and require developers to write custom integration code for each one.

An MCP — Model Context Protocol — is a newer standard developed by Anthropic that allows AI models to connect to external tools and services in a standardized way. Think of it as a universal adapter: instead of each AI tool needing custom integration with each service, MCPs provide a common interface that any compatible AI model can use.

The practical difference: APIs require custom integration code. MCPs let AI models consume capabilities directly. If Slack publishes an MCP server, any MCP-compatible AI assistant can read messages, post updates, or search history without a developer writing integration code for each assistant.

For organizations thinking about AI integration, MCPs dramatically lower the friction of connecting AI to existing systems. The ecosystem is still early, but the direction of travel is clear.

MCP is a protocol, not a security model, so it is as secure as what you build around it. The things that go wrong are predictable. A connection that holds a broad shared API key gives the model everything that key can do. A connection that can write as easily as read lets a wrong guess change something. A model that reads untrusted content, such as an email or a web page, can be manipulated by instructions hidden in it (prompt injection) into using the tools it has. And if nothing logs who called what, nobody can reconstruct an incident afterward.

Our own MCP servers are built against each of those. Sign-in goes through our directory with per-user authorization, so a connection acts as the person or agent using it. Connections that answer questions are built so a tool that changes a system cannot be added to them, and change tools sit behind separate permissions. Consequential actions are reviewed by a person. Every call is logged with the caller, the tool, the arguments, and the outcome. Those are the same four decisions we make for a client’s connections: what is exposed, who may use it, what needs approval, and what is recorded.

Jev is a small, fast language model from TypeSafe that answers narrow questions by choosing from answers you define in advance, with a confidence score, instead of writing free text. That makes it well suited to classification: what kind of ticket is this, did a person write it, is this document useful. It can still choose wrong, but a narrow answer is easy to check and easy to route.

We use Jev as the classifier in our ticket flow and as the screening step in our knowledge process, where it judged tens of thousands of documents in minutes for a few dollars, leaving the writing and checking to Claude. TypeSafe does not train on customer inputs, and we list it as a data processor on our Trust page.

Yes. Buildout & Installation covers structured cabling (Cat6 and Cat6A copper and fiber backbone, labeled at both ends, and documented), server rooms with racks, power distribution, UPS, and cooling, wireless installation driven by a site survey, IP cameras and door access, conference rooms, and audio systems from Sonos to reference-grade McIntosh installations.

It is often the build phase after a Technology Consulting engagement, and it also stands alone for a new office, a server room, or a full fit-out. We coordinate with your architect, general contractor, and electricians, and we pre-configure the network equipment before it arrives.

Yes. Ephemeral Infrastructure is temporary networks and IT for galas and fundraisers (including the payment and registration systems), conferences, festivals with point-to-point links and distributed Wi-Fi, film and live production, and temporary offices or swing space during a move. We design it, deploy it, support it on site during the event, and tear it down with full asset recovery.

Two examples: the network for a nonprofit gala at the Metropolitan Museum of Art that supported 500 devices and raised $4.59 million over Wi-Fi with zero network issues, and a complete temporary network for FoST Fest across twelve landmarked buildings and an 83-acre campus with thousands of concurrent VR and AR devices.

Yes. We design, procure, configure, and install conference rooms end to end: displays, cameras, microphones and speakers, room controllers, and the Zoom Rooms software that ties them together, along with the network and cabling they depend on.

For UltiMaker’s new headquarters we delivered two turnkey systems, a boardroom and an all-hands space, both built as Zoom Rooms.

Yes, as part of Buildout & Installation: IP camera systems, door access control, and alarm integration, designed alongside the network they run on so that cameras and door controllers sit on their own segmented network rather than beside your staff’s laptops.

For Hypebeast’s first U.S. flagship we unified cabling, network, audio, a 113-camera surveillance system, and 27-door access control across seven floors in a single buildout.