Always On, Rarely Awake: Why a Sleepless Helpline Isn't the Same as Real Support

Type '24/7 IT support' into a search engine and you will get pages of providers promising a living, breathing human being at the end of the line at three in the morning. It sounds wonderfully reassuring. It is also, for most small businesses in the UK, the least important part of the deal.

Our own name is a deliberate wink at the idea — 25Seven, twenty-five seven, every hour of the week. So let us be honest about what that idea is worth.

The fantasy of the sleepless IT department

Someone sits in a room somewhere, watching a wall of screens. Your printer misbehaves at 3am, a calm voice picks up, and by 3:20 everything is fixed. It is a lovely image, and it made sense when the alternative was a bloke called Dave who came on Thursdays. If your server fell over on a Saturday, you genuinely had nobody to call.

Somewhere along the way, though, the promise morphed from 'we will fix things quickly' into 'we will be awake whenever you are not' — as if insomnia were a security control. It isn't. Being contactable at any hour tells you almost nothing about whether your business is protected.

A helpline cannot see what is coming

Reactive support waits for a person to notice a problem and pick up a phone. For a dead monitor or a forgotten password, that model is perfectly fine. Against the things that genuinely sink small firms, it is close to useless.

Ransomware does not phone ahead. It encrypts quietly while everyone is asleep, and the first sign is usually a finance director staring at a file share full of scrambled documents at 8:15 on a Monday. Likewise, invoice fraud rarely announces itself; it looks like a slightly odd email, a change of bank details, and a payment that clears before anyone thinks twice. A dormant account belonging to a contractor who left in the spring will not ring you either.

By the time you are dialling a support number, in other words, the damage has usually already started. The best IT support is the kind you never have to ring.

The unglamorous work that does the heavy lifting

Proactive managed services are dull in the best possible way. They look like automated monitoring across laptops, servers, network switches and Microsoft 365 tenants, with alerts firing on failed logins, odd outbound traffic or a disk quietly filling up. They look like a documented patching cycle rather than a scramble whenever a critical vulnerability makes the news. They look like backups you have actually restored from, not just backups that report 'success' in a dashboard nobody reads.

Add endpoint detection that can kill a suspicious process before it spreads, email filtering that strips out the obvious rubbish, and a proper joiner-mover-leaver routine so accounts die the day someone hands in their notice. None of that is glamorous. All of it is what keeps a twenty-person firm trading through a bad week.

Response times: read the asterisks

Most contracts promise a response within a set time for a priority-one incident. The phrase doing an enormous amount of work there is 'response'. A polite acknowledgement that your ticket has been received is a response. A fix is not. Ask any prospective provider to spell out, in writing, the difference between response and resolution, and what counts as business hours in their world — because plenty of '24/7' contracts have a helpfully elastic definition of 'critical'.

Out-of-hours cover also deserves scrutiny. Is it included, or billed at a premium? Is the person answering a trained engineer or a call handler reading a script? Some providers subcontract nights and weekends to a third party who has never seen your setup. That is not necessarily a dealbreaker, but you should know.

Why local still counts for something

There is a reason we bang on about being a UK-based team serving UK small businesses. Data protection rules around breach reporting give you 72 hours to notify the Information Commissioner's Office where it matters, and those hours disappear quickly if your adviser is in a different time zone with a different reading of the law. Insurers increasingly want to see evidence of patching, MFA and tested backups before they will quote. Cyber Essentials paperwork is easier to complete when the person helping you knows the scheme. And sometimes a problem simply needs someone to drive over and plug a cable in.

A practical checklist for 2026

When you next review an IT provider — or the one you already have — put these questions on the table:

• Does monitoring cover endpoints, servers, network hardware and cloud email, or just the desktops?
• Can they demonstrate a real restore from a real backup, not just a green tick on a report?
• What is the documented patching window, and who signs it off?
• Is multi-factor authentication enforced everywhere it can be, including remote access?
• Do they have a formal checklist for leavers, and can they prove it is followed?
• What exactly does the service level agreement say about priority-one response and resolution?
• Are out-of-hours calls included in the fee or billed separately, and at what rate?
• Who picks up the phone at 2am, and where are they sitting?
• Do they run phishing simulations and short, repeatable staff training?
• Can they help with Cyber Essentials or an insurer's security questionnaire?
• If you part ways, who owns the admin credentials and the documentation?

The bottom line

Always-on is a nice thing to have. Always-watching is better. A provider that never sleeps but never looks is just an expensive answering service — and your business deserves more than a reassuring voice on the other end of the line.