FIRST WORD
Hello,
Yesterday I said The Steelbrook Brief was on its way. Here’s the first full issue.
This week’s theme is the gap between what you assume is covered and what actually is. It shows up in IT agreements, where the monthly price rarely tells you what’s included. It also shows up in your inbox, where a fake invoice can look exactly like a real one.
None of this takes a technical background to fix. Mostly it takes asking the right questions, and this issue gives you a few.
Chris Moore
Chief Vision Officer, Steelbrook Technology Group
The Monthly Price Is The Least Useful Number In An IT Quote
Why it matters: Two managed IT quotes can differ widely in price because they aren't quoting the same thing. The monthly fee tells you what you'll pay, not what you're getting.
An example: One proposal covers help desk support, with security, backup, and after-hours help billed as add-ons. Another builds those into the monthly fee. What a quote leaves out rarely makes the summary page. It's usually buried in the agreement.
What to compare:
What the monthly fee includes, and what’s billed separately
Whether cybersecurity and backups are covered
Support response times and after-hours coverage
How projects and third-party licenses are billed
The catch: The exclusions usually aren’t in the headline number. Hardware, projects, software licenses, and some emergency work may cost extra, and you often find out after you sign.
The question to ask: Ask any provider, including your current one: “What will you take responsibility for every month, and what will I still have to manage myself?”
The bottom line: Compare what each provider takes off your plate, not just the price.
What The First 30 Days Revealed
When we take over an environment from another provider, the first month shows what was actually being managed. Here’s one recent example from a mid-size construction-sector firm.
By the numbers:
About 6,000 → 3,234: Unique vulnerabilities after one patching pass. There was no vulnerability management program.
60% → 90%: Devices covered by endpoint protection.
0 → 90%: Devices inventoried. No inventory existed.
Expired: The server backup platform license.
The hidden cost: Of the first 38 machines scanned, 15 were running design software whose licenses had been out of maintenance since 2023. Nobody was tracking that exposure.
The takeaway: “Nothing’s broken” isn’t the same as “it’s managed.” If your provider can’t show you a device count, a vulnerability trend, and the date backups were last verified, you don’t have a baseline.
FBI’s 2025 Report: $3 Billion Lost to Business Email Fraud
What’s happening: The FBI’s latest Internet Crime Report logged 24,768 business email compromise complaints in 2025, with about $3.05 billion in reported losses, up from $2.77 billion in 2024. These scams impersonate a vendor or executive to redirect payments.
The trap: Training staff to spot typos and awkward wording. The FBI notes that AI chat tools can quickly write official-sounding emails, so a fake invoice may have nothing obviously wrong with it.
The business takeaway: Make verification a process, not a judgment call. Any change to payment details triggers a callback to a number you already have on file (not one from the email), and a second person approves before money moves.
Ransomware 2025: The SMB Playbook
A short, prioritized guide to preventing ransomware attacks, catching them early, and recovering with less disruption.
You get:
Five steps in order: prevent, detect, prepare, respond, and recover
The common mistakes that slow recovery, and how to avoid them
Specific benchmarks to check against, like how often to test backups and how quickly to patch critical systems
Who it’s for: Business leaders who want to know what a solid ransomware plan includes and what to ask their IT team.
Button: Read the SMB Playbook
October 13, 1983: The First Commercial Cell Phone Call
On this date, Ameritech launched the first commercial cellular network in Chicago, U.S. An executive placed the first call from outside Soldier Field to a descendant of Alexander Graham Bell. The phone was a Motorola DynaTAC 8000X: nearly two pounds, about 30 minutes of talk time, and priced at nearly $4,000.
The twist: Forty-three years later, that same invention is one of a business's simplest defenses against fraud. The fastest way to check a suspicious invoice is still to pick up the phone and call a number you already trust.