Most owners look at their IT only after something has already gone wrong. A file will not open, a laptop will not start, or an invoice gets paid into a stranger’s account. By that point the fix costs several times what prevention would have.
Almost none of it happens without warning. The backup that fails when you finally need it had been failing quietly for weeks. The account an attacker used belonged to somebody who left last year. Thirty minutes a month is usually enough to catch that class of problem.
Why a monthly look pays for itself
Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches began with attackers exploiting software that had not been patched, making unpatched software the most common way in, ahead of stolen credentials. The same report put the median time to fully remediate a known problem at 43 days.
Read that again. Most attacks use a problem that was already public, with a fix already available. Nobody had installed it yet.
The six-item check
1. Updates. Look at whether Windows updates are actually installing on your machines, or sitting at “restart required” week after week. Do the same for phones and for the software your team uses most. If people keep clicking “remind me later,” that is a pattern to fix, not a personal failing.
2. Backups. Open your backup tool and read the last few runs. You want recent successes, not a wall of errors. Then ask when anyone last restored a file from it. Backup that has never been tested is a hypothesis, not a control.
3. Who has access. Pull the user list in Microsoft 365 and read it line by line. Every name should be somebody who still works for you. Look for departed staff, contractors who finished months ago, and shared logins like “office” or “reception” that several people use. Disable what you do not need.
4. Multi-factor authentication. Confirm MFA is on, and that it is on for everyone rather than just the people who set it up first. Pay closest attention to administrator accounts and anyone who handles money. Microsoft’s own research puts MFA’s effectiveness against account compromise above 99%.
5. Devices. Look at what is connected to your systems. An unfamiliar laptop or phone needs an explanation. While you are there, confirm laptops are encrypted and that any phone carrying company email has a passcode or biometric lock.
6. Subscriptions and licenses. Open the billing page and read what you are paying for. Businesses routinely pay for licenses belonging to former employees, or for two tools doing the same job. It is also how you discover software somebody signed up for without telling anyone.
Make it a routine, not a project
Put it in the calendar on a fixed day, like the first Monday of the month, and give it to the same person every time. That is you, or whoever runs the administrative side of the business.
Keep a running note of what you checked and what you found. After a few months the pattern shows up. If the same problem keeps returning, it does not need clearing again, it needs fixing properly.
One discipline makes the thirty minutes realistic: do not stop to fix things along the way. Write down what you find and deal with it afterward.
Who fixes what
Most of what you turn up is small. A laptop that needs restarting, a license to cancel, an account to disable. Handle those yourself.
Send the rest to your IT provider: backups that keep failing, MFA that will not enable for someone, a device nobody recognizes, updates that fail on the same machine every month. Those usually indicate something larger behind them.
What this check does not replace
This is not monitoring. A managed environment has tools watching systems around the clock and flagging things no monthly glance would ever surface. Our remote monitoring and management platform reports on patching, backup status, and endpoint health continuously, and Managed EDR watches for the behavior that precedes an incident.
The monthly check covers what those tools cannot know. They do not know who resigned last month, which subscription you actually approved, or whose laptop is whose. You do.
If you only have ten minutes
Backups and updates. Without working backups you can lose everything you have stored, and unpatched software is now the most common way attackers get in. Everything else on the list can wait a month. Those two cannot.
Where to start
If you do not know where to find any of this, ask your IT provider to walk you through it once and write down where each item lives. Most providers, ours included, can also send you a monthly summary covering most of the list automatically, which turns thirty minutes into ten.
If you go through this and the answers are uncomfortable, that is useful information rather than bad news. It is worth a conversation.