Plenty of good businesses run on one IT person. It works, often for years, because that person is capable and because they carry the whole environment in their head. That is also precisely the problem, and it only becomes visible on the day they resign, get sick, or go on vacation during an outage.
This is not an argument against the person. The best internal IT staff we work alongside are excellent. It is an argument against the structure.
What Actually Leaves With Them
The obvious loss is the skill. The expensive loss is the undocumented knowledge: which server that odd application really depends on, why the firewall rule that looks wrong is deliberately there, the vendor who has to be called in a particular way, and where the passwords are.
We have picked up environments where the previous administrator was the only human being who could authenticate to the domain, and others where a critical system was licensed to a personal email address. None of it was malicious. It was simply never written down, because writing it down was never anybody’s priority while everything worked.
The Three Risks That Matter Before Then
Nobody is watching at night. One person cannot monitor a network around the clock, and attacks are timed for exactly the hours when nobody is. This is not a criticism of the individual, it is arithmetic.
Security competes with the printer. When the same person handles both the immediate and the important, the immediate always wins. Patching slips, reviews get postponed, and the backup nobody has time to test stays untested. The urgent work is visible and the security work is invisible until it is not.
There is no second opinion. Every technical decision is made by one person with no peer to challenge it. Good people still make choices that a colleague would have questioned, and those choices compound quietly over years.
What To Do About It Without Firing Anyone
The instinct is to frame this as internal versus outsourced. That is a false choice and usually the wrong one, because your internal person knows the business in a way no provider ever will.
The version that works is co-managed. Your person keeps the relationships, the institutional knowledge and the day-to-day, and gets three things they cannot provide alone: monitoring and response outside their working hours, specialist depth for the projects that come along twice a year, and cover so that a vacation is a vacation.
The measure of whether it is working is simple. Your internal person should be doing more of the work they are good at and less of the work that wakes them up.
Four Things To Fix This Month, Whatever You Decide
Get the passwords out of one head. A business password manager with a shared vault, owned by the company, with more than one person holding emergency access. This is the single highest-value hour you will spend.
Write down the environment. What runs where, what depends on what, which vendors matter and how to reach them. Two pages beats nothing, and nothing is what most companies have.
Check the licenses and accounts are in the company name. Domain registration, certificates, cloud tenants, vendor portals. Anything registered to an individual is a hostage.
Agree what happens at 2 AM. Right now, who gets called, who is allowed to make the call to shut something down, and what happens if that person does not answer. Decide it in advance or discover it during an incident.
None of this requires a decision about headcount. It requires an afternoon and a willingness to look at the answer.
If the co-managed model sounds like the fit, our co-managed IT support is built to strengthen an internal team rather than replace it. If you would rather see the whole picture first, a free cyber assessment documents what you have, what is missing and what it would take to close the gap, and those findings remain yours even if you never hire us.
The NIST Cybersecurity Framework is a useful, vendor-neutral way to structure the conversation internally before anyone talks to a provider.