By James Bomer, the owner of StraatVaart Technologies, where we believe every entrepreneur deserves access to honest, no-cost technology guidance.
Last week I flew out to Burbank, California to spend a day with Karim Karawia, who runs Tech Kooks. I’d been wanting to sit down with him for a while. We move in similar circles — both of us spend our days thinking about IT support for Burbank businesses and the rest of the country’s small and mid-sized companies — and I’ve always appreciated how he talks about the work. Not as a vendor pitching services. As someone who genuinely worries about the businesses around him.
We grabbed coffee a few blocks from his office. The conversation drifted, as it tends to with people in our line of work, toward the calls that stick with you. The ones you don’t forget.
Karim told me about a post-production house. Fifteen people, give or take. The kind of shop that does color and finishing work for streamers and ad agencies — the lifeblood of Burbank’s economy. They weren’t Tech Kooks clients at the time. They had a guy. Everyone has a guy. This one was a freelancer who’d set up their network years ago and showed up when things broke.
On a Friday afternoon, one of the editors got an email. It looked like a client deliverable — a link to review cuts, the kind of thing she opened twenty times a day. The address was off by one letter. She didn’t catch it. Nobody would have.
By Monday morning, project files across three active jobs were encrypted. Ransomware. The backup drive sitting under the receptionist’s desk, always plugged in, always connected — encrypted too. The editor who opened the email had been working remote that weekend, finishing a cut, and her laptop had reached into the shared drives and spread it everywhere it could touch.
They called their guy Friday night. Saturday. Sunday. He picked up Tuesday.
By the time Tech Kooks got the call, the damage was done in the way damage usually is — not catastrophic, not the end of the company, but bad. Files were lost. A delivery slipped two days. The shop had to call a client and explain. Anyone who’s run a small business knows what that conversation feels like. You’re not just losing a job. You’re spending trust you spent years building.
What got me about the way Karim told the story wasn’t the crisis itself. It was everything that wasn’t in place beforehand. No offsite backup. No email filtering worth the name. No endpoint detection. No one watching the network on a Friday night. The shop wasn’t reckless — they thought they had IT support. They were paying for it. What they actually had was a friendly contractor who showed up when called.
“The thing people miss,” Karim said, “is that IT support isn’t really about fixing things when they break. By the time something’s broken, you’ve already lost. The job is making sure most things don’t break in the first place, and when something slips through, you can recover in hours instead of days.”
That distinction matters more than I think most small business owners realize. There’s a category of investment that feels like overkill right up until the moment it isn’t. Offsite, immutable backups. Email security that catches lookalike domains. Endpoint monitoring that flags unusual behavior at 2am on a Sunday. A team that answers the phone. None of it is glamorous. None of it shows up in the P&L as revenue. And yet without it, a single moment of inattention from one tired employee can cost a small business a week of revenue and a client relationship that took years to build.
I asked Karim what he tells business owners who balk at the cost of doing IT properly. He didn’t have a slick answer. He said he tries to walk them through what a bad week actually looks like — the lost time, the lost files, the customer conversations, the insurance claims, the staff sitting around unable to work. Then he asks them what their business would do for forty-eight hours with no email, no shared drives, no access to active projects. Most owners haven’t thought about it in those terms. Most can’t answer.
The post-production house, by the way, is now a Tech Kooks client. They got their house in order. Karim’s team rebuilt their environment from the ground up — proper backup architecture, security tooling, monitoring, the works. The owner told Karim something I keep thinking about. He said the worst part of the whole experience wasn’t the ransomware. It was the realization that he’d been paying for protection he didn’t actually have, and he never thought to ask the hard questions.
That’s the part I want small business owners reading this to sit with. If you have IT support today — a vendor, a contractor, a friend, an internal person — you should be able to answer a few questions without picking up the phone. Where are my backups stored, and have they been tested? What happens if a ransomware email gets clicked on Friday at 5pm? Who is watching my network when nobody is in the office? How fast can we recover, and from what point in time?
If you don’t know the answers, that’s not necessarily a sign that your current setup is failing. But it’s a sign worth paying attention to. The shops that get hit aren’t usually the careless ones. They’re the ones who assumed someone else was paying attention.
Karim and I wrapped up our coffee and walked back toward his office. Burbank was doing its usual thing — sunny, traffic, people moving between meetings. Thousands of small businesses operating on the assumption that the technology underneath them would hold. Most of the time, it does. Until the Friday afternoon it doesn’t.