At 15 people, informal IT works fine. At 35, it starts costing you money you cannot see.
There is a specific point in a growing business where the IT setup that carried you from ten people to twenty-five simply stops working. Almost nobody sees it coming, because nothing dramatic happens to mark the moment. No system crashes. No single bad day. It is a slow build-up of friction that gets absorbed, mostly by the founder or MD, until it becomes normal.
I see the same pattern again and again. The business has grown well. Revenue is up, the team has doubled, maybe there is a second office or a hybrid workforce. But the way technology is run has not changed since the days when everyone sat round one table and the most technical person in the room “did the IT”.
Why it happens between 25 and 35 people
In the early days, informal IT is the right answer. Decisions are fast, everyone knows everyone, and the cost of getting something slightly wrong is small. The founder picks a few tools, an MSP handles the laptops and the email, and it works.
The problem is that complexity does not grow in a straight line with headcount. Every new person adds accounts, devices, permissions, data and another way for things to go wrong. Every new team tends to bring its own tools. Research from BetterCloud shows how quickly this happens: young companies of one to two years old typically start with around 29 SaaS apps, and by the time they are three to six years old that figure has jumped to about 103. Nobody sat down and decided to run a hundred systems. It just happened, one sensible decision at a time.
Around the 25 to 35 mark, the volume of change finally exceeds what one busy founder and a reactive support contract can absorb. The exact point varies depending on how technical the founding team is and how fast growth has been, but the symptoms are remarkably consistent.
The five warning signs
1. Onboarding takes days, not hours
When access provisioning is manual and undocumented, every new starter becomes a small project. Someone has to remember which systems they need, who has admin rights to each one, and what the laptop should have on it. Inevitably something is missed.
This is not unusual, but it is expensive. One industry study found that 43% of new hires waited more than a week for basic workstation logistics and tools, and 18% waited over two months for the tools they needed. Even a short delay adds up. As one estimate puts it, two days of onboarding delay for a well-paid employee means roughly two days of paid time with nothing to show for it, and across 20 hires in a growth year that becomes a significant direct loss, before you count the time spent by whoever is doing the provisioning.
For a business hiring steadily, that is real money leaking out every month. It also sends new starters the wrong message in their first week.
The flip side matters just as much. Offboarding is usually worse than onboarding. If you cannot say with confidence that every leaver lost access to every system on their last day, you have a security problem as well as an admin one.
2. Nobody has a complete list of your systems
Ask most growing businesses for an authoritative list of every system they run, who owns it, what data sits in it and what it costs, and you will get a pause. The list exists in pieces: in the finance system as card payments, in people’s heads, in an MSP’s asset register that only covers the hardware.
This matters for three reasons. First, cost: unused and duplicate subscriptions are common, and Zylo’s research found that 53% of licences go unused within 30 days. Second, risk: you cannot protect data you do not know you hold. Third, resilience: if a key person leaves, the admin rights and institutional knowledge for a critical system can leave with them.
3. The MSP has become reactive
Many MSP relationships start well. When the business is small and simple, tickets in and fixes out is exactly what is needed. But as the business grows, you need someone thinking ahead: planning for the next office move, the next 20 hires, the renewal of your main line-of-business system, the security controls your biggest customer is now asking about.
That forward-looking work is rarely in a standard support contract, and it is not the MSP’s job to set your technology direction. So it falls into a gap. The MSP waits to be asked, the business does not know what to ask, and the relationship drifts into pure break-fix. When something does go wrong, the MSP calls the founder.
4. Security gaps open up because nobody owns the question
This is the most serious sign, and the one most often hidden. In a growing business, security is everyone’s problem and therefore no one’s. The MSP assumes the business will tell them what it needs. The business assumes the MSP has it covered.
The UK data backs this up. According to the government’s latest Cyber Security Breaches Survey, 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Crucially, the rate climbs with size: 65% of medium businesses reported a breach, compared with 42% of micro and 46% of small businesses. A business crossing from 25 to 50 people is moving directly into that higher-risk bracket, often without changing how it manages security at all.
Yet ownership remains thin. Only 31% of businesses have someone at board or senior management level with explicit responsibility for cyber security. Only a quarter have a formal incident response plan, meaning most businesses that suffered a breach responded without a defined approach. And just 5% of UK businesses hold Cyber Essentials certification, while fewer than half use two-factor authentication.
Supplier risk is a growing blind spot too, and highly relevant when you depend on an MSP and dozens of SaaS providers. The survey found only 22% of small businesses review risks from their immediate suppliers, and 10% review their wider supply chain.
The consequences are getting more serious. The proportion of businesses reporting loss of revenue or share value after a breach rose from 2% to 5%. Increasingly, the question is not just about attacks either. Larger customers, insurers and investors now ask pointed questions about your controls during procurement, renewals and due diligence. A business that cannot answer them loses deals, pays more for cover or takes a hit on valuation.
5. The founder is still the IT department
Underneath all of this sits the most expensive symptom of all. The founder or MD is still the person who gets pulled into IT decisions, often several hours a week. Approving a new tool. Chasing the MSP. Resetting the admin password on the website. Answering the security questionnaire from a prospective customer at 10pm.
Individually, each of these takes a few minutes. Together, they take a real slice of the most valuable time in the business, and they pull attention away from sales, people and strategy at exactly the point where growth demands it most. Because the cost never appears on an invoice, it rarely gets challenged.
This is a governance problem, not a technology problem
The instinct at this point is often to buy something: a new platform, a bigger support contract, another tool. Sometimes that helps. But the root cause is almost never a lack of technology. It is a lack of ownership, visibility and decision-making structure around the technology you already have.
The businesses that navigate this stage well do a few simple things:
- They give someone clear accountability for IT and cyber risk at leadership level, even if that person is not full-time.
- They build a single register of systems, data and suppliers, with named owners and renewal dates.
- They standardise joiners, movers and leavers, so access is granted and removed consistently and quickly.
- They reset the MSP relationship around agreed outcomes, regular reviews and a forward plan, not just ticket volumes.
- They put the basics in place: multi-factor authentication everywhere, tested backups, a written incident response plan, and a recognised baseline such as Cyber Essentials.
- They report IT and cyber risk to the board in plain business terms, so decisions are made deliberately rather than by default.
None of this requires a full-time IT director on a large salary. For most businesses at this size, fractional or part-time oversight is enough to set direction, hold suppliers to account and take the founder out of the loop.
The key is timing. Bringing in oversight before the friction becomes a crisis is far cheaper than doing it after a breach, a failed audit or a lost contract.
Is this you?
A quick self-check. If you answer “no” or “not sure” to more than a couple of these, you are probably at the inflection point:
- Can a new starter be fully productive on day one?
- Could you produce a complete list of your systems and who has access to them within an hour?
- Are you confident every leaver lost access to everything on their last day?
- Does your MSP bring you ideas and plans, or just close tickets?
- Is a named person at leadership level accountable for cyber risk?
- Do you have a written incident response plan that has been tested?
- Have you stepped back from day-to-day IT decisions?
If new starters are waiting days for access, or you are still the person the MSP calls when something breaks, it is worth a conversation.