A Perth-metro legal & accounting SMB, with the right SOC reading the environment.

The practice ran on an interstate MSP whose contract was structured around tickets, not outcomes. Tickets opened on Monday sat open until Wednesday. Tickets opened on Friday sat open until the following Tuesday. After-hours reach went to a queue that sometimes returned the call by Wednesday of the following week — a problem when a partner needed a file or a dictation stream recovered at 9pm on a Friday.

On the security side, there was no SOC, no EDR coverage on the partner-track laptops, and no patching cadence. The practice had picked up one confirmed credential-stuffing incident in the quarter before the engagement started, and the team lead described the posture as “finger’s crossed, mainly”.

The internal threshold for action was a partner-driven one, not a ticketing one: confidentiality expectations from clients (legal work in particular), after-hours access patterns (accounting deadlines), and an operating footprint that had grown from one CBD suite to three metro sites without a corresponding investment in IT.

We replaced the per-ticket support model with a managed IT pairing: a rostering share of our SOC reading the environment 24/7 from Perth AWST, and a named on-site engineer carrying one of the three metro sites on a published visit cadence. The partner track ran on EDR with managed detection plus a written runbook for credential-stuffing style attempts; the practice plan covered patching, M365 hardening and a monthly posture check written into the engagement rather than the brochure.

Tickets stopped being the unit of work. The Perth analyst owns the environment end-to-end, so a partner who reports a problem at 9pm gets the same engineer who has been reading their environment all evening — not the next ticket in a different timezone. The on-site engineer carries a defined visit slot at the CBD site and a published road cadence for the Osborne Park and Fremantle branches; on-site is reserved for work that genuinely benefits from being physically present, not the default.

The data-exit runbook was written down at week two rather than at the end of the engagement — same export format, same credential rotation, same access revocation, same written confirmation of log retention deletion. The partners kept the runbook. The point of writing it down was that it was no longer subject to how anyone felt on a given Monday.

Across the 12 months after handover, the practice recorded zero confirmed security incidents — down from the credential-stuffing incident and two near-misses in the quarter before. Patching cadence moved from “whenever we get to it” to a measured weekly pass with a named owner and a weekly report the partners read. EDR coverage on the partner-track laptops went from zero to 100% in the first month, with detection tuned for partner-track usage rather than office-worker defaults.

Ticket SLA, which had been the practice’s primary frustration, moved from a two-day median to a same-business-day acknowledgement and a 4-hour median resolution during the AWST window. After-hours reach, which had been the secondary frustration, stopped returning a callback as a measure of success — the partner on the call was the engineer who had been reading their environment all evening.

Most measurably: the partners stopped describing their IT setup as a thing they worried about and started describing it as a thing they could quote to clients. The engagement does not advertise itself as a reference, in line with the firm’s confidentiality posture — but the FY-by-FY posture delta, measured on the agreed dashboard, is real, and the partners read the dashboard monthly.