No structured IT function
Technology everywhere, and no service desk, patch cycle, access review or verified backup owned by anyone in particular.
Technology scale-up
Outsourcing the IT function a scale-up had not built yet
Sovereign hosting, managed security and day-to-day support, run as one service
A technology company growing faster than its internal processes. There was no IT team in the structured sense — no service desk, no patch cycle, no access reviews — and building one would have consumed exactly the attention the business needed for its product. They bought the function instead: hosting, security and support, run as one service.
- Sector
- Technology scale-up
- Footprint
- Growing fast, no structured internal IT function
- Engagement
- Sovereign hosting, managed security and support
- Pillars
- Sovereign · Resilient
Client identity withheld. Sector and footprint are generalised to preserve anonymity. A reference call with the engagement sponsor can be arranged.
Scale-ups do not lack IT. They lack the boring parts.
A growing technology company always has technology. What it usually does not have is the unglamorous machinery around it: a patch cycle somebody owns, access that gets reviewed when people join and leave, backups that have been restored rather than merely configured, logs that someone actually reads, and a way to get help that does not involve messaging a founder. None of that wins customers. All of it is what a customer's security questionnaire asks about.
The pressure arrives commercially before it arrives technically. A larger client, an investor's diligence, an insurer or a public tender asks how access is managed, where the data sits, and what happens when something breaks at two in the morning. The honest answer at that stage is usually 'informally' — and informally does not pass.
The instinct is to hire. It works eventually, and it is slow and expensive at the wrong moment: one person cannot cover a service desk, a patch cycle, a security watch and a hosting platform, and a first hire spends a year building processes rather than running them.
So this client bought the function rather than the headcount. Hosting on infrastructure whose location and jurisdiction are known and stated. Security monitoring and response as a service. A service desk their people can actually reach. And a named owner on our side accountable for all three, so the seams between them are not the client's problem to manage.
The decision that mattered most was sovereignty. For a company selling to European customers, being able to state where data sits, under which jurisdiction, and what happens if a provider changes its terms turns a diligence conversation from a risk into a differentiator — and it is far cheaper to decide at the start than to migrate into two years later.
The challenges
Diligence outpacing process
Client questionnaires, investor diligence and insurer questions arriving faster than the processes needed to answer them.
Founder attention as the scarcest resource
Every hour spent building internal IT process was an hour not spent on the product and the market.
What we did
- 01
Baseline and triage
What exists, what is exposed, and what would hurt first: identity, endpoints, cloud configuration, backups and the supplier list. Assessed in weeks rather than months, because a growing company cannot pause while it is surveyed.
- 02
Sovereign hosting
Workloads placed on infrastructure whose jurisdiction and data location are known and can be stated to a client in writing, with the migration sequenced so the product team's release cadence is not interrupted.
- 03
Managed security
Monitoring runs continuously. Out of hours, containment is automated and a named on-call engineer is reachable for severity-one events, with an agreed definition of what we act on without asking first.
- 04
Service desk and run
A route for the ordinary things — onboarding, offboarding, access, devices, 'it stopped working' — with response targets, so that the answer to an employee's problem is never 'ask a founder'.
- 05
Evidence and reporting
The artefacts a diligence process asks for: access reviews performed, patch status, incident log, restore tests. Produced as a by-product of running the service rather than assembled under deadline.
What changed
A function, without the headcount
The company has the IT and security capability a client questionnaire expects, without having built a department to get it.
Answers already on file
Where data sits, who has access, what happens in an incident — answered from documents that already exist, at the speed a commercial process needs.
Founder attention back where it belongs
Day-to-day IT stopped landing on the people whose time the business can least afford to spend on it.
If you are in the same position
The signal is rarely a security incident. It is the third client questionnaire in a quarter, and the realisation that the answers are being written from memory each time.
Decide deliberately between buying the function and hiring it. Hiring is right when IT sits close to the product and the volume justifies a team. Buying is right when what you need is coverage, process and evidence — and it is reversible: a well-run outsourced function hands over to your first internal hire with the processes already written, which is a better first day than a blank page.
Settle hosting and jurisdiction early. It is a cheap decision at the start and an expensive migration later, and for anyone selling into Europe it has become a commercial question rather than a technical one.
And insist on one named owner rather than three contracts. Hosting from one supplier, security from another and support from a third leaves every gap between them yours to manage, which is the thing you were trying to stop doing.
Leave with your top three risks documented
Thirty minutes with a senior practitioner. No slideware, no sales engineer.