What to look for in a new IT provider

Why the choice matters more than ever

According to the Australian Signals Directorate’s Annual Cyber Threat Report 2024–25, the ACSC received over 84,700 cybercrime reports in the year, about one every 6 minutes. The average self-reported cost per report was $56,600 for small businesses (up 14%) and $97,200 for medium businesses (up 55%). Your IT provider is now one of the main things standing between your business and those numbers.

1. A real response SLA, in writing

Ask for agreed response and resolution times by priority (for example, critical, high, normal), how tickets are prioritised, and how the provider reports against those targets each month. “We’re usually quick” is not an SLA. Xen IT’s support is SLA-driven, with an average response under 15 minutes.

2. Proactive, not reactive

Look for 24/7 monitoring of servers, endpoints and network devices, scheduled patching with reporting, and regular health checks. Ask what percentage of issues they detect before the client notices. A break-fix mindset earns more when things go wrong; a proactive provider earns the same fee and is motivated to prevent problems.

3. Security you can evidence

Business email compromise was among the top cybercrimes reported by Australian businesses in 2024–25. Ask how the provider enforces multi-factor authentication, which endpoint detection and response (EDR) tool they use, whether email is protected with DMARC, DKIM and SPF, whether backups are immutable and test-restored, and whether there is a 24/7 security operations centre (SOC). Then ask for a sample report you could hand to your insurer.

4. Who you will actually speak to

Ask whether you will have a named engineer or account manager, how big the team is, and how often the same person handles your tickets. A small senior team that already knows your setup resolves issues faster than a rotating first-line queue reading from a script.

5. Industry experience

Law firms need LEAP or Smokeball support and trust account protection. Medical and dental practices need clinical software uptime and Privacy Act alignment. Construction firms need site connectivity and mobile device fleets. Ask for examples from businesses in your industry and the outcomes they achieved.

6. A roadmap and budget

A good provider gives you a three-year technology roadmap and meets with your leadership quarterly to review risks, projects and spend. That turns IT from a stream of surprise quotes into a budget you can plan around.

7. Compliance support

If clients, tenders or insurers ask about Essential Eight, ISO 27001 or SMB1001, your provider should be able to assess your current position, implement the missing controls and produce the evidence.

8. Fair contracts and a clear exit

Be wary of three-year lock-ins and vague exit terms. Ask for the notice period, who owns your documentation and passwords, and how a handover would work if you ever left. A confident provider earns your business month to month.

9. A clear onboarding plan

Ask how they will audit your environment, coordinate with your current provider, and fix security and documentation gaps in the first weeks. Xen IT runs a structured onboarding of up to 45 days before moving to ongoing management.

Questions to ask in your first meeting

What is your response SLA and how do you report on it? Who will be my main contact? How do you evidence MFA, EDR and backups for my insurer? What happens in the first 45 days? What is the notice period?

Sources

Australian Signals Directorate, Annual Cyber Threat Report 2024–25 (cyber.gov.au). Figures are self-reported averages per cybercrime report.

Keep reading

All articles

→

Back to the blog.

Book a free IT assessment

→

Talk to a senior engineer.