Michael J. Bannach: The Most Expensive IT Plan Is the One Without an Agreement

“We have a guy.” The owner of a 70-person engineering firm says it in the first five minutes. The guy comes when something breaks, bills by the hour, and has kept the lights on for nine years. Nothing has gone badly wrong. The owner is sure this is the cheap option.

Michael J. Bannach, President and CEO of Stealth Technology Group (STG), hears that sentence most weeks. STG was built by combining three regional IT providers in Boston, Tampa and Sarasota, so Bannach has seen the hourly model from the provider’s side of the invoice as well as the client’s. “The plan without an agreement is the most expensive plan in the building,” he said. “It just never arrives as one invoice.”

Where the Money Actually Goes

The hourly model has a design flaw an owner can state in one line: the provider gets paid when something fails. Nobody is paid to make sure it does not. Patching, backup testing, access reviews and monitoring are the unbilled work, so they are the work that quietly stops.

The real cost shows up in places the IT invoice never touches. A firm with 40 billable people at $150 an hour loses $6,000 for every hour its systems are down, and a half-day outage costs $24,000 before the repair bill arrives. The office manager becomes the help desk. The owner spends an evening on a password reset. The after-hours rebuild comes at an emergency rate, and the answer to “when will it be back” is “Monday.”

Then come the outside questions. The cyber insurance application asks who enforces multifactor authentication, who tests the backups and how often systems are patched. A client’s security questionnaire asks the same things in more detail. The firm with a guy answers from memory. “Every question on those forms assumes someone is doing that work every month,” Bannach said. “If nobody is, you are either guessing on a document you signed or losing the deal.”

The Numbers Behind the Argument

Verizon’s 2026 Data Breach Investigations Report found that 48 percent of breaches now involve ransomware, and that 31 percent of breaches start with a software vulnerability, which has overtaken stolen passwords as the top way in. A vulnerability is a patch nobody applied.

Sophos’s 2026 State of Ransomware survey of 2,158 respondents in 17 countries put the average cost of recovering from a ransomware attack at $1.7 million, before any ransom. Only one in three smaller organizations stopped the attack before data was encrypted, and 48 percent of organizations with 100 to 250 employees said a lack of people or capacity played a role in the compromise. Coalition’s 2026 Cyber Claims Report found ransomware the costliest claim type at an average loss of $269,000, with email compromise averaging $27,000 and funds transfer fraud $141,000, and credited the companies that fared better with working backups and incident response plans.

“Every one of those figures is a line item the hourly model never shows you until the week it happens,” Bannach said.

What a Managed Agreement Is Supposed to Buy

A managed agreement is not an unlimited help desk. Bannach says the document should name the work and the cadence: patching on a schedule with exceptions reported, multifactor authentication and endpoint detection on every device, backups that are restored on a schedule rather than just taken, a documented environment, a named person accountable for the firm’s technology risk, a quarterly review with the owner of what IT costs and delivers, and evidence an insurer or client can read. “If the agreement doesn’t name the cadence and the evidence, you bought a help desk,” he said. “That is not a managed service.”

The Five Objections, Answered

Nothing has broken. “You don’t know that,” Bannach said. The hourly provider usually has no monitoring in place to tell either of you, and 31 percent of breaches begin with the patch nobody applied. The news usually arrives from a client, an insurer or a ransom note.

We are too small to be a target. Attacks are automated and size is not a filter. In the Sophos data, the smaller organizations were the ones least likely to stop an attack in time, and the ones most likely to say they lacked the people to do so.

A managed agreement costs more. Bannach asks owners to add up last year’s IT invoices, then add the hours their people spent waiting, the emergency rates and the owner’s own evenings, and then put the insurance and client exposure next to it. “Most owners stop arguing at that point,” he said.

Switching is too disruptive. STG moves clients through a process it calls Stealth SmoothSwitch: Discover, Document, Mirror, Cut, Delight. The new provider documents and mirrors the environment before anything is cut over, so the switch is a dated plan rather than a leap. “If a switch is painful, the provider planned it badly,” Bannach said.

We will do it when a client or an insurer makes us. A regional nonprofit that came to STG was running its operations on a single cloud server until a donor asked for proof of how its data was protected. It moved to fully managed IT and security after that question, not before. “The outside question always comes,” Bannach said. “The only choice is whether you answer it on your schedule or on theirs.”

Start With the Numbers on Your Own Firm

STG starts provider conversations with a fixed-scope Stealth 360 Assurance Baseline, delivered within 20 business days, that shows an owner what the current arrangement covers and what it leaves open, with a 90-day roadmap to close the gaps. Owners who want that picture can book a replace-your-MSP fit call with STG.

“Nobody keeps a guy because the math works,” Bannach said. “They keep him because nobody has done the math. Do it once, and the decision makes itself.”

Michael J. Bannach is President and CEO of Stealth Technology Group (STG), one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies and defense suppliers. STG is a Cyber AB Registered Practitioner Organization with teams serving Tampa, Sarasota, Boston and Greater Philadelphia. A CISSP with more than 25 years in enterprise IT and cybersecurity, Bannach also holds CCNP Enterprise and CCNP Collaboration certifications, a certificate in AI products and services from MIT, and an Executive MBA from Saint Joseph’s University. Learn more at michaelbannach.com and stealthtech365.com.