Managed IT / MSP

Managed IT built around patch speed, identity and tested recovery.

Most small business breaches start with an unpatched system or a stolen login. Texwan manages endpoints, servers and Microsoft 365 or Google Workspace tenants so those two doors stay closed, and so recovery works when something else fails.

Request an assessment

01 / Threat Briefing

Threat Briefing

Exploitation of vulnerabilities became the top initial access vector in the Verizon 2026 DBIR at 31% of breaches. Only 26% of vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025, and the median time to full resolution rose to 43 days. (Verizon 2026 DBIR)

For small and midsize businesses, compromised credentials appeared in 38% of breaches and exploited edge-device vulnerabilities in 29%. Ransomware was present in 48% of all breaches. (Verizon 2026 DBIR)

The FBI logged $3.05 billion in business email compromise losses and $2.13 billion in tech support fraud losses in 2025. The IC3 notes that its ransomware loss figures generally exclude lost business, time and remediation costs. (FBI IC3 2025)

02 / Risk and Compliance Matrix

Risk and Compliance Matrix

Risk	Control or compliance mapping	Business impact
Unpatched operating systems, browsers and line-of-business apps	NIST CSF 2.0 ID.RA and PR.PS; CISA KEV remediation; PCI DSS v4 Req. 6.3.3 (PCI SSC)	Direct entry point for ransomware and data theft; failed card-data and cyber-coverage audits
Password-only access to email, VPN and admin accounts	CISA phishing-resistant MFA guidance (fact sheet); PCI DSS v4 Req. 8.4; FTC Safeguards Rule 16 CFR 314.4(c)(5) (FTC)	Business email compromise, wire fraud and mailbox takeover
Backups that are online, untested or reachable with the same admin credentials	NIST CSF 2.0 RC.RP; NIST SP 800-34 contingency planning (NIST); HIPAA 45 CFR 164.308(a)(7) (HHS)	Ransomware recovery fails and downtime extends from days to weeks
No central logging or alerting on endpoints and identity	NIST CSF 2.0 DE.CM and DE.AE; HIPAA 164.312(b) audit controls	Intrusions run undetected; no evidence for breach notification decisions
Personal data exposure without a response plan	Texas Business and Commerce Code 521.053 (Texas statute): notify affected individuals within 60 days, and the Texas Attorney General within 30 days when 250 or more Texans are affected	Regulatory exposure, notification costs and customer loss

03 / Architecture and Remediation Directives

Architecture and Remediation Directives

Inventory every endpoint, server and cloud tenant in the RMM. Anything not reporting is treated as unmanaged and flagged.
Patch operating systems and third-party applications on a fixed cadence, and expedite anything that appears in the CISA KEV catalog. Report patch compliance per device monthly.
Enforce MFA on every remote access path and every administrator account. Prefer phishing-resistant methods (FIDO2 security keys or passkeys) for admins, per CISA guidance.
Remove local administrator rights from daily-use accounts. Use separate, monitored admin accounts.
Deploy endpoint detection and response on every managed device, with alerts routed to a person, not only a dashboard.
Follow the 3-2-1 backup pattern with at least one immutable or offline copy, and run a documented restore test at least quarterly, as recommended in the CISA #StopRansomware Guide.
Centralize endpoint, identity and firewall logs with defined retention so an incident can be reconstructed.
Write down an incident response contact sheet and decision tree before it is needed: who to call, who can authorize shutdowns, and who handles notification.

04 / Vendor-Neutral Verification Checklist

Vendor-Neutral Verification Checklist

Three checks you can run yourself, with or without us.

Patch evidence. Ask your provider for a per-device patch report dated this month. Pick three critical items from the CISA KEV catalog that apply to your software and confirm they are installed.
MFA coverage. List every way into your business remotely (email, VPN, remote desktop tools, firewall admin, payroll and banking portals). Try each one: any that accepts only a password is an open finding.
Restore test. Ask for a file and a full server or mailbox to be restored to a point you choose from last week. Time it. If nobody can do it, or it takes longer than your business can tolerate, the backup does not count yet.

Next step

Request a managed IT assessment

We review endpoints, identity, backups and logging against the directives above and send a written findings list.