Most small businesses do not have an IT department. They have a shared inbox, a pile of laptops of mixed vintage, and one person who “knows computers” because they once set up the Wi-Fi.

That arrangement works. Until it does not.

The first real outage, the first invoice-scam a director nearly pays, the first leaver account that stays live for six months. Then IT stops being a background cost and starts eating the week.

This is a practical look at small business IT support in the UK. What has to be in place, what you can ignore, and when “we’ll deal with it when it breaks” has run out of road.

What small businesses are actually buying when they buy IT

Search for IT support and you get a fog of products. Managed services. Cloud. Cyber. Microsoft 365. Helpdesk. None of that is the thing you are trying to buy.

You are trying to buy three outcomes:

1. People can work.
2. The business does not lose its data.
3. A bad email does not become a bad month.

Everything else is packaging.

CAMBITION was built on a blunt observation: firms often pay for services they do not need, do not want, or do not understand. A 12-person accounts practice does not need the same stack as a 200-seat office. It does need the same outcomes.

If a quote cannot be explained in those three lines, it is probably selling you theatre.

The four jobs IT has to do

You can ignore a lot of the catalogue. You cannot ignore these.

1. Someone answers when it breaks

A printer jam is annoying. A locked Microsoft 365 admin account on a Monday morning is a trading problem.

Small business IT support starts with a real person who can remote on, reset the right thing, and not vanish into a ticket void.

If your current “support” is a freelancer who replies when they are between jobs, you do not have support. You have a hope.

2. The unglamorous maintenance actually happens

Updates. Patches. Disk space. Licence renewals. The account for the person who left in March.

Nobody gets a thank-you for this work. That is why it does not get done. It is also why the ransomware story usually starts with an unpatched laptop and an old admin password written in a notebook.

The UK government’s Cyber Security Breaches Survey 2025 found that only 32% of businesses have a policy to apply software security updates within 14 days. Most firms run the basics. Far fewer run them on time.

3. Security that is more than an antivirus icon

Phishing is still the main event. Of the businesses that identified a breach or attack in the last year, 85% said it included phishing. Forty-three per cent of UK businesses identified some kind of cyber breach or attack in that period.

Yet only 40% of businesses use two-factor authentication, and only 19% ran any staff training or awareness in the last year. Those are not exotic controls. They are the cheap ones that stop the common attacks.

You do not need a war room. You do need:

• Multi-factor authentication on email and admin accounts
• A password manager, not a shared spreadsheet
• Up-to-date malware protection that someone actually checks
• A simple rule for what staff do with a suspicious email
• Admin rights limited to the people who need them

Cyber Essentials is the government-backed baseline. Only 12% of businesses have even heard of it. Nine per cent of micro firms. You do not have to get certified on day one. You should be able to pass the test.

4. A backup you have restored, not just scheduled

“We have backups” is the most comforting sentence in small-business IT. It is also frequently untrue in any useful sense.

A backup that has never been restored is a rumour. Cloud sync is not a backup if ransomware encrypts the folder and the sync helpfully encrypts the copy too.

You want a copy that sits somewhere the live systems cannot reach, and a date in the diary when someone proved they could get a file back. That is the whole job.

Break-fix is not cheaper. It is just later.

The old model is simple. Nothing happens, you pay nothing. Something breaks, you pay an hourly rate and wait.

It feels thrifty. The bill arrives on the worst possible day, and nobody was watching the thing that caused it.

Managed IT support flips the invoice. You pay a fixed fee. In return, someone monitors the estate, patches it, and answers the helpdesk before the outage becomes a story you tell at the pub.

For a sole trader on one laptop who can survive a bad afternoon, break-fix can still be honest. Once you have a handful of people sharing email, files and a customer list, the downtime costs more than the retainer.

UK quotes are usually priced per user or per device, per month. Treat any figure that looks like a bargain with suspicion. Ask what is out. Licences, on-site visits, security tools and backups are the usual disappearing act.

CAMBITION’s own SME support package is built the other way: a flat fee per device and per server, with remote support included, so a smaller firm is not buying an enterprise MSP it will never use. That is the point. Fit the package to the business, not the brochure.

What you can stop paying for

Here is the bit most IT articles skip, because it does not sell.

A new laptop every time someone complains. Replace the ones that fail, standardise the rest, and stop treating hardware as a personality.

A separate product for every fear. You do not need five overlapping security tools and a dashboard nobody opens. You need a short list that is switched on.

On-site visits for jobs that take eight minutes remotely. If your provider still bills a call-out to restart a service, you are funding their petrol, not your uptime.

An internal “IT person” who is actually your office manager. If their real job is running the business, every password reset is stolen time. Either give them proper cover or stop pretending this is a side task.

How to tell you have outgrown DIY

A few tells are enough.

• The same three people are the only ones who can “make the Wi-Fi work”
• Microsoft 365 is a collection of personal accounts, not a tenant you control
• You could not say, today, who has admin rights
• Backups exist on a USB stick in a drawer, or only in someone’s OneDrive
• A leaver still receives email
• The last security update was “whenever Windows nagged us”
• You have no idea what you would do if the office burned or the cloud tenant locked

If three of those are true, you are already running a managed service. You are just running it badly, in the evenings, for free.

A working setup for a typical small firm

For a UK SME of, say, eight to forty people on Microsoft 365, a sane baseline looks like this.

• One business tenant. No personal Gmail for client work.
• Multi-factor authentication on every account, no exceptions for directors.
• Shared files in a proper team site, not a maze of email attachments.
• Device encryption and a screen lock. Lost laptop, shrug, not a GDPR incident.
• A monitored backup of the data you could not recreate in a week.
• A named support desk with a way to raise a ticket and see it move.
• A short acceptable-use note people have actually read.
• A restore test twice a year. Put it in the calendar like VAT.

That list is not glamorous. It is why some firms have a boring year, and others have a very interesting one.

If you are the person who knows the Wi-Fi password, the 365 admin and the alarm code, you are a single point of failure with a company attached. Handing that stack to a provider is not giving up control. It is deciding you can still trade when that person is on a beach.

Get the right amount of help

If you want a second pair of eyes on what you have now, CAMBITION will do a free initial consultation. No theatre, no 40-page deck. We look at the estate, say what is actually at risk, and price only the work that changes the three outcomes: people can work, data stays put, a bad email stays an email.

Call 01223 656 156 or use the contact form. If you are closer to a micro firm than a full MSP brief, ask about the SME support package rather than a wholesale takeover.

IT should get out of the way of the business. That is the whole product.

Frequently asked questions

Do small businesses need IT support?

Yes, once a few people share email, files or a customer list. A sole trader can often wait for break-fix. A team cannot.

What should small business IT support include?

A helpdesk that answers, routine patching, multi-factor authentication, tested backups, and a way to remove leavers.

Is managed IT better than paying only when something breaks?

For most firms with five or more staff on shared systems, yes. Break-fix looks cheaper until the first outage lands on a trading day.

How much does IT support cost for a small business in the UK?

Quotes are usually per user or per device, per month. Cheap headlines often exclude security, backup or on-site work. Ask what is out of the fee before you compare numbers.