Category: insight

Clients care about their financial information and money being secure. Focus on that, and you’ll pass the SEC exam every time, and never have to touch the incident response plan your compliance officer drafted.

Your compliance officer just finished another exam. Clean report. No findings. The SEC signed off.

That piece of paper tells you nothing about whether your clients’ data is actually safe. Nothing.

Here’s the fact your firm needs to sit with: An RIA can hold a written Reg S-P program the SEC has reviewed, and still have no idea whether its laptops are encrypted or who is inside its email. In the last eighteen months, a dozen SEC-registered advisers filed breach notices in California alone. Every one of them had the binder.

That’s not a hypothetical. That’s not fear-mongering. That’s a fact. Hard stop.

What your firm writes into its Reg S-P policy, what it demonstrates in an audit, what it hands the SEC during a routine filing, none of that measures your true security posture. It’s a plan for what to do after the breach. After the data loss. After the compromise already happened. It’s reactionary by design.

Here’s the real gap. A firm can satisfy the letter of Reg S-P with a solid post-incident process, a documented plan, a clean 30-day notification procedure, and still have no meaningful barrier standing between an attacker and the intrusion happening in the first place. Right now, every RIA in the country is racing to satisfy the new Reg S-P amendments. Almost none of that effort is going toward actually securing the firm.

ATG wants that incident response plan to sit in a drawer. Untouched. Unused. Forever. Zero client notifications, not because you got lucky, but because there was nothing to notify anyone about. Satisfying Reg S-P puts a smile on your CCO’s face. Fine. That’s their job. But it has nothing to do with whether your firm has an actual preventative security framework standing between your clients’ data and the people trying to steal it. Nothing.

Managing partners have hidden behind one excuse for years: “I’m not a technical person.” That excuse is dead. You use technology all day, every day: trading platforms, custodial portals, email, your phone. (And yes, your phone, your laptop, your email need to be highly secured and monitored too. That’s a conversation for another day, but it’s worth saying out loud here.) You are not intimidated by technology. You’re intimidated by the idea that you’re responsible for securing it. Those are different things.

Fraudulent ACH wires don’t happen because attackers are geniuses. They happen because attackers continue to exploit your ignorance, and your choice not to bring your security and your org chart into the modern era.

You don’t need to become technical. You need to understand how the modern org chart is supposed to look, and make sure yours actually matches it. Because right now, at most RIAs, it doesn’t.

Attacks on RIAs and their clients are ramping up at an alarming rate. Now, not next year. Managing partners already know this. They read about it every day. This isn’t a knowledge gap. It’s a choice gap. And too many are choosing not to act, because they have a shield ready: “We passed our SEC exam.”

That shield means nothing to the client whose $150,000 just got wired to an account nobody at the firm recognizes. Passing an exam doesn’t unwind a fraudulent wire. It doesn’t get their money back.

Your compliance officer is not technical. That’s not an insult. It’s their job description. Their job is regulatory. Is cybersecurity part of compliance? In a narrow sense, yes. But running on a cloud-based technology stack, it’s really just strong security practice, full stop. Treating it as a compliance sub-function is where firms get the org chart wrong.

IT should sit under the CFO or the COO. The CISO, or whoever functionally plays that role, should report directly to the CEO, with authority to hold the IT team accountable. Blur that line, and you don’t get efficiency. You get a conflict of interest: the person grading the exam and the person securing the network can’t be the same reporting chain. Your IT team pays for it too, taking direction filtered through someone who isn’t technical, aimed at a target that’s already outdated.

Your stakeholders don’t accept the accounting team’s own report as proof the numbers are right. They want an audited financial statement, from an independent party with no stake in making the numbers look good. Cybersecurity deserves the same standard. Right now, most RIAs run on the equivalent of trusting the accounting team’s own report. The same IT function that builds and maintains the systems is also the one telling you those systems are secure. That’s not oversight. That’s self-grading.

ATG is the independent audit function for your security posture. We work independently of your existing IT support, internal or outsourced, and we report straight to you: the managing partner, the CEO. Not your IT director. Not your compliance officer. Because if we didn’t, there’d be no accountability. Nobody watching the watchers.

We don’t care what your firm’s written plan says. We don’t care what you proved to an examiner last quarter. We care about one thing: protecting your clients’ assets under management.

It comes down to three doors. Device. Identity. Data loss. Those are the pillars that have to be watched every second of every day, and the instant one gets triggered, it gets shut down. Not reviewed next Monday. Shut down, immediately, 24/7. That’s not a philosophy. That’s an operating requirement.

I’ve spent a long time looking for an RIA firm that’s actually getting this right. Not “passing exams” right. Actually right. I found exactly one. My own RIA.

The only reason I have full confidence in him is that he adopted the protocol ATG built. If he hadn’t, I would have fired him. My money and my family’s future don’t get to sit behind hope and a compliance binder. Neither does yours. Neither do your clients’.

Hope is not a security strategy. Ignorance is not a security strategy. “We passed our exam” is not a security strategy. The bad guys are smart. They are organized. They are patient. They are extremely technical. They are sneaky and creative. They are winning.

This message is for managing partners and CEOs. Not compliance officers, not IT directors. Security is a top-down mandate or it’s nothing. If the person running the firm doesn’t require it, adopt it, and enforce it, it does not happen. You cannot delegate this down and hope it sticks. You have to own it.

Your clients trusted you with their life savings. They didn’t audit your cybersecurity plan before they signed. They assumed you had it handled. Make sure that assumption is true, not just on paper, but in practice, every hour of every day.

Compliant is easy. Secure is a discipline. Choose the one that actually protects the people who trusted you.

In Q3 2026 alone, our clients avoided over $1.2 million in fraudulent wire transfers and payments to accounts controlled by criminals.

These attempts started with a phishing email that got an employee to hand over credentials. A second was worse: an attacker hijacked an SMS-based MFA token and walked straight past the “second factor” that leadership assumed was protecting them.

Case in point: Microsoft is retiring SMS and voice as authentication methods in Entra ID. Passkeys became the default sign-in experience as of September 2026. Microsoft-provided SMS and voice delivery is being phased out entirely by February 2027.

Microsoft doesn’t fast-track anything. When a company running identity infrastructure for a meaningful share of the Fortune 100 moves that fast to kill a feature, that’s not a UX decision. That’s an admission that SMS-based MFA has become a major, active liability.

Every financial firm still leaning on a text-message code as its “second factor” should read that as a five-alarm signal, not a line item for next year’s roadmap.

The pivot needs to happen now. Firms need single sign-on consolidated through a real identity provider, paired with phishing-resistant authentication, a hardware security key or a passkey held in a password manager. Not a text message an attacker can intercept. Not a SIM they can swap.

I’m not writing this to brag about the save.

I’m writing it because every one of those catches happened despite how most financial firms are organized, not because of it. And I’m tired of the security industry tiptoeing around the actual cause.

Here it is, plainly: nobody’s arguing that compliance, security, and IT call for different skill sets. Everyone already agrees on that.

Where financial firms get it wrong is the chain of command. They let security report through IT, or through compliance, or through whoever’s convenient, instead of giving it its own accountability straight to the top.

That structural failure, a chain of command built by boards and executive teams with no security expert in the room to challenge it, is why the bad guys keep winning.

The FBI’s BEC numbers climbed again this year. They climbed because security isn’t a priority with the authority to say no.

Employees call IT to fix problems. Compliance checks boxes. Security is the overwatch.

A Security Operations Center watches and monitors continuously. When it finds a problem, it acts before the problem becomes an incident. Everyone else in the org chart reacts.

A good SOC doesn’t solve problems. It stops them before they ever have the chance to happen.

When you bury that function inside IT or hand it to compliance as a side responsibility, you don’t just create an inefficiency. You arm the attacker.

Compliance turns security into a checkbox: policies written, audits passed, breach happens anyway.

IT turns security reactive: respond to the ticket, keep the lights on, worry about the phishing-resistant MFA migration next quarter.

Either way, the one function built to act before the damage is done gets stripped of the authority to act at all.

Let’s be precise about this, because too many boardrooms still conflate two things. A financial firm can pass an SEC exam with flying colors, sail through a compliance audit, and get breached the next morning.

Compliant and secure are not the same thing.

One measures whether you followed the rules on paper. The other measures whether an attacker can get in.

You can score 100% on the first and still be wide open on the second. And if compliance is the only lens your firm uses to judge its own security, you will not find out which one you actually are until it’s too late.

That’s exactly where ATG plants its flag.

We are not in the business of helping you pass an SEC exam. That’s compliance’s job, and it should be, because the SEC has real authority to pull a license or levy a penalty, and someone at your firm needs to own that risk.

ATG is in the business of one thing: making sure client data and the assets under management sitting behind your systems are 100% secured.

Compliance’s job is passing the exam. IT’s job is keeping the lights on. ATG’s job is making sure the data and the AUM are actually secure. Three different jobs. Firms keep collapsing them into two, folding security into whichever one is convenient. It unequivocally needs to be three. Hoping the SEC catches the gap before an attacker does is not a strategy, and it isn’t working, not according to what the FBI is reporting.

Stop Assuming Security Is a Function of Compliance, or Something IT Can Handle

Five years ago, folding security into IT or compliance was almost defensible. Most financial firms were still running on-premise, and the attack surface was mostly contained inside your own walls.

Then COVID hit. Everyone went remote overnight, and firms rushed to the cloud just to keep functioning, which was every cyber criminal’s dream: exposed endpoints, home networks, VPNs stood up in a weekend, employees clicking on anything that looked like a helpdesk request.

That shift is exactly what should have pulled security out into its own independent role. For a lot of firms, it never did.

Everything evolved but the org chart.

Security just stayed assumed into whichever function was already in the room: compliance treats it as a subset of the regulatory checklist, or IT treats it as another ticket type.

Either way, security never becomes its own function. It becomes a chore quietly attached to somebody else’s job description.

Look at the actual job descriptions and you’ll see why this fails on its own terms. The compliance officer’s job description is clear, and it matters: interpret the regulation, file the paperwork, pass the exam.

IT’s job description is just as defined, and it’s a list of fires: fix the printer, resolve the blue screen, replace the broken laptop, order the new monitor, reset the password nobody remembers. That’s a full day before lunch.

Security can’t be a line in either job description. It’s the one thing everyone agrees matters, that almost nobody fully understands the complexity of, and that nobody has the time to prioritize. So it gets kicked down the road, and that’s how security holes get created.

That complexity isn’t static, either. Security is dynamic: threats change, systems change, and everything today is connected to everything else. A vendor’s API, a home network, a cloud app nobody remembers approving: any one of them can be the way in. That interconnectedness is exactly why getting this role right matters more now than it ever has.

So what does real security ownership actually look like, day to day? The CISO, or in ATG’s case the SOC (security operations center), is there to question everything. Every access grant, every application, every third-party connection into the tech stack gets scrutinized and assigned a risk factor.

Nothing gets a pass because it’s convenient, because IT is in a hurry, or because a vendor relationship predates the last security review.

If it touches the tech stack, resides on a laptop, or has a login, it gets questioned. If it can’t justify itself, it gets flagged, restricted, or removed.

This Isn’t a Budget Problem. It’s an Org Chart Problem.

None of this requires a bigger org chart. It requires three decisions your firm’s leadership has probably been avoiding:

Compliance keeps regulatory interpretation and attestation, and loses the authority to run security operations or wave off a security exception.

IT keeps infrastructure and uptime, and loses the authority to slow-walk a security finding because it’s inconvenient for this quarter’s roadmap.

Security, whether an in-house CISO or an outsourced SOC, gets its own reporting line straight to the top, with explicit standing to flag risk in what compliance signs off on and what IT ships.

Most firms don’t actually need to hire a CISO, and not for the reason you’d expect.

Hire one, and the first thing that CISO does is start assigning security roles and responsibilities.

From there, there are only two paths: build a dedicated security team under them, which is expensive and slow to stand up, or hand those roles back to whoever’s already in the building, which almost always means IT.

That second option is the fatal blow. You just spent the budget and the political capital to install independent oversight, and the first real decision that CISO makes recreates the exact conflict of interest this entire piece is about: it hands the security function right back to the IT team.

If you’re too small for a full-time CISO, that’s not an excuse.

It means your outsourced security function still needs to report to leadership independently of whoever runs your IT. It should not live as a line item buried inside the IT services contract, where it has no teeth.

And when I say “outsourced security function,” I don’t mean a single contractor wearing a CISO title. I don’t mean a call center triaging your tickets by whoever happens to pick up.

One person can’t be the security apparatus for a financial firm. The scope of it, the round-the-clock monitoring, the breadth of systems and access to watch: it isn’t a one-person job, no matter how good that person is.

ATG’s answer is a Security Operations Center: a dedicated team of six people assigned to your account, specifically. Not a rotating queue.

The same team handles every email, every phone call, every Teams meeting. They’ve spent the time becoming experts inside your business: your systems, your risk profile, your people. That’s instead of starting from zero on every ticket like a help desk would.

The $1.2 Million Wasn’t a Tooling Win. It Was an Authority Win.

Every one of those catches happened because a team with real independence looked at a transaction or a login and had the standing to say “this doesn’t check out” before anyone hit submit. Compliance wouldn’t have caught this. IT wouldn’t have caught this. Structure did.

The FBI’s BEC numbers do not have to keep climbing every year.

They keep climbing exactly as long as CEOs and managing partners keep treating security as IT’s problem or compliance’s checkbox instead of what it actually is: an independent function with the authority to stop a loss before it happens.

Fix the org chart, and that number starts moving the other way.

Leave it broken, and you’re not unlucky when it happens to you. You’re next.

The FBI’s numbers need to stop climbing. ATG is going to make that happen.

Last week, I attended the Financial Planning Association of Colorado’s Annual Forum, where Michael Kitces presented research on a question every advisory firm eventually has to confront: what actually makes a financial advisor more productive?

The answer was notable for what was on the list.

It was even more notable for what was not.

Kitces Research identifies four primary drivers of advisor productivity: serving more affluent clients, having the confidence to price services appropriately, maximizing productive face time with clients, and building the right team structure. Technology, despite the amount of attention and capital devoted to it across the wealth management industry, did not make the list.

In fact, when Kitces Research compared annual spending on financial planning technology with revenue per advisor, it found no clear relationship between technology spending and productivity. Firms spending the most on planning technology even showed a slight decline in revenue per advisor in some cases, potentially because additional technology facilitated additional services that clients were not necessarily willing to pay more for.

That conclusion should make every RIA owner think carefully about what they are actually trying to accomplish with technology.

The goal is not more IT.

The goal is a more productive advisory firm.

Technology Is Infrastructure, Not the Product

There is an important distinction here.

Kitces Research is not saying technology has no value. Quite the opposite. The research found that revenue per employee increased from $250,000 to $310,000 between 2022 and 2024 among repeat survey participants, with improved operational efficiency and evolving technology allowing firms to generate more revenue without necessarily adding equivalent back-office headcount.

Technology creates leverage.

But leverage is not the same thing as value.

The client does not hire an RIA because its Microsoft tenant is exceptionally well configured. They do not refer their neighbor because the firm’s endpoint management platform has an elegant dashboard. They do not willingly pay an additional 20 basis points because the firm has six overlapping SaaS applications instead of four.

They hire an advisor for judgment, expertise, communication, and trust.

Technology should make those things easier to deliver.

That distinction matters because the traditional IT model often encourages exactly the opposite behavior: more tools, more complexity, more support capacity, more licenses, more management, and ultimately more overhead.

Given that, the better question is not, “How much technology can we deploy?”

It is, “What is the minimum technology infrastructure required to operate securely, compliantly, and efficiently without distracting the firm from the activities that actually generate value?”

That is a very different economic problem.

The Myth of the One-Person IT Department

One of the strongest findings in the Kitces report concerns team structure.

The most productive configuration in the study was the “1+2” model: one lead advisor supported by two staff members. The model provides enough leverage for the advisor to delegate work that does not require the advisor’s expertise, without introducing the coordination costs and “management tax” that begin to emerge as teams become larger.

There is an important economic principle underneath that finding: the productive advisor does not do every job.

Modern IT increasingly works the same way.

Twenty years ago, a small business might reasonably have hired an “IT person.” Today, even a relatively small RIA operates within a technology environment requiring several distinct areas of expertise. Cybersecurity must be monitored and maintained. Microsoft 365 and cloud infrastructure must be administered. Networks and devices must be managed. Regulatory and compliance requirements must be documented. And, inevitably, someone still needs to troubleshoot Outlook, reset passwords, provision laptops, and figure out why the printer stopped working.

The problem is that these are not interchangeable responsibilities.

A security administrator should not spend the afternoon troubleshooting a printer. A help desk technician should not be responsible for designing the firm’s cybersecurity architecture. And asking one internal employee to maintain deep expertise across security, cloud infrastructure, networking, compliance, and end-user support increasingly means asking one person to do several fundamentally different jobs.

The obvious solution would be to hire specialists.

For most small and midsized RIAs, however, that solution fails a basic economic test.

The firm may need the expertise of a security administrator, cloud administrator, network administrator, and support technician. It is unlikely to need 2,080 hours per year from each of them.

That distinction between access to expertise and ownership of headcount is where the economics change.

The same principle of leverage that Kitces identifies within productive advisory teams can be applied to the technology function supporting them. Instead of requiring the RIA to employ every technical role internally, a shared-services model allows specialized work to reach the appropriate specialist while routine issues remain with the appropriate support resource.

The firm gets the capabilities of a technology team without having to carry the economics of an entire technology department.

This is also where marginal cost matters.

Hiring the first internal IT employee may create substantial value. But as the firm attempts to cover each additional specialty internally, the marginal benefit of another full-time hire can quickly fall below the marginal cost of carrying that employee. The firm is no longer purchasing expertise when it needs it. It is purchasing 12 months of capacity in order to guarantee access to expertise periodically.

In effect, the difference becomes an insurance premium for labor.

ATG’s model approaches the problem differently. Maintain the security and compliance capabilities that must always be present. Maintain access to the specialized expertise the firm cannot afford to be without. Then bring human support capacity to bear when there is actually something requiring human support.

Access the roles. Don’t own the headcount.

Security Is Different

There is one area where “use it only when you need it” is the wrong strategy: cybersecurity.

You cannot install your controls after the breach.

For RIAs, that distinction has become considerably more important under the SEC’s amended Regulation S-P. The amendments require covered institutions, including SEC-registered investment advisers, to maintain written incident-response policies and procedures reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. Those procedures must include assessing the nature and scope of an incident, taking appropriate steps to contain and control it, overseeing service providers, and notifying affected individuals when sensitive customer information has been or is reasonably likely to have been accessed or used without authorization.

The practical implication goes beyond having an Incident Response Plan sitting on a shelf. An RIA should be able to demonstrate how the firm will continue operating and restore critical technology when an incident actually occurs. That means understanding which systems are mission-critical, where recoverable copies of customer information exist, who has authority to isolate compromised identities or devices, how communications continue if Microsoft 365 or another core platform is unavailable, how systems and data are restored, and how the firm validates that restored environments are safe before returning them to production.

This is where incident response begins to overlap with business continuity and disaster recovery. The IRP answers, “What do we do when an incident occurs?” A mature BCDR program answers the next questions: “What must remain operational? What can be unavailable, and for how long? Where does our data come back from? Who restores it? In what order? And have we actually tested that recovery process?”

Reg S-P also pushes that responsibility beyond the RIA’s own network. Covered institutions must maintain written policies and procedures for due diligence and monitoring of service providers, and the SEC has emphasized that firms may outsource functions but cannot outsource their ultimate compliance responsibility. A vendor saying that it “has backups” is therefore not the same thing as the RIA knowing the vendor’s recovery capabilities, escalation process, access to customer information, and role in a reportable incident.

Finally, firms must maintain written records documenting compliance with the amended Safeguards and Disposal Rules. That shifts cybersecurity from a collection of technical controls toward something much more defensible: controls, documented procedures, evidence, testing, and recoverability.The SEC gave larger entities until December 3, 2025 and smaller entities until June 3, 2026 to comply. In other words, for RIAs today, this is no longer an approaching regulatory requirement. It is the operating environment.

This changes the economics of IT.

Security, compliance, identity management, device management, monitoring, and incident preparedness are not discretionary support tickets. They are infrastructure.

They need to exist whether an employee calls the help desk that month or not.

Everything layered above that should face a much harder question:

Are we paying for an outcome, or are we paying simply to have somebody available?

Keep the Controls. Lose the Management Tax.

There was another Kitces finding that resonated.

The typical lead advisor spends only about 16% of their time in client meetings, or roughly seven hours per week. Productivity increases as client-facing time approaches 30% to 35%, or approximately 13 to 14 hours per week, before eventually plateauing.

The constraint, therefore, is not simply how many hours an advisor works. It is what those hours are being used for.

Every hour spent troubleshooting access to SharePoint, coordinating a laptop replacement, reviewing security alerts, chasing a vendor, figuring out why an employee cannot authenticate, documenting a control for an examiner, or determining whether an unusual login constitutes an incident is an hour that has been moved away from the highest-value activities of the firm.

This is where outsourced IT should function much like the external support described in the Kitces productivity model.

Kitces Research found that highly leveraged teams can benefit from centralized or outsourced resources for important needs that arise periodically but do not justify building permanent internal capacity.

That is remarkably close to how we think about IT at Adams Technology Group.

Maintain the infrastructure that must always be there.

Maintain the security controls that cannot wait.

Maintain the compliance evidence that regulators expect.

Then bring human support capacity to bear when there is actually something requiring human support.

The alternative is effectively paying an insurance premium for labor: maintaining excess capacity every month because someday the firm might need it.

More Technology Is Not the Objective

This also explains why technology spending by itself is such a poor predictor of advisory-firm productivity.

According to Kitces Research, the typical service team spends approximately $3,500 per advisor each year on financial planning software. Yet across spending levels, the study found no clear relationship between how much firms spent and how much revenue they generated per advisor.

More software does not automatically create more leverage.

More vendors do not automatically create better processes.

More IT staff do not automatically create better IT.

In some circumstances, they simply create additional fixed costs and additional things to manage.

The better technology strategy is often surprisingly boring.

Standardize the environment.

Secure identity.

Secure devices.

Protect data.

Monitor the controls.

Document them.

Test incident response.

Remove unnecessary applications and complexity.

And make sure somebody competent answers when something actually breaks.

ATG’s approach is built around precisely that foundation. Our Microsoft 365-native Zero Trust architecture focuses on Identity, Data, and Device, reinforced by controls such as identity threat detection, endpoint detection and response, security monitoring, and tested incident-response procedures. ATG has also obtained SOC 2 Type I attestation for the Security trust services criterion.

The point is not to make IT more visible inside an advisory firm.

It is to make the risk visible while making the technology itself increasingly invisible.

The Fifth Driver

Kitces’ four productivity drivers ultimately describe where an advisory firm’s scarce resources should go.

Work with clients who value the firm’s expertise.

Charge appropriately for that expertise.

Give advisors enough support to spend meaningful time with those clients.

Keep the organization lean enough that the support structure does not become its own source of inefficiency.

Technology should reinforce all four.

It should never become a fifth competing priority.

For an RIA, the ideal IT environment is therefore not necessarily the biggest technology budget, the largest internal team, or the longest list of applications.

It is the environment that is secure enough to protect the firm, disciplined enough to satisfy its regulatory obligations, simple enough not to create unnecessary overhead, and responsive enough to be there when something actually happens.

That is lean IT.

Not less protection.

Less waste.

Hardware costs are spiraling. Windows Server 2016 is dying. And the cloud just got a lot more attractive… whether you planned for it or not.  

Over the past six months, there has been a change in the market that is dealing a crippling blow to the pockets of everyday organizations. AI is on the rise, and their Data Centers are eating up as much of the market as they can. Processors, DRAM, and SSDs are all affected.  

A single 16GB RDIMM DRAM module cost $300 to $400 in November 2025. That same module costs over $2,000 today. That is not a rounding error. That is a 400% surge in one of the most foundational components in modern computing, and it is moving through every server, every workstation and every laptop budget your organization has right now. 

Every technology budget your finance team had previously approved needs to be re-evaluated and re-priced. Immediately. What you modeled on six months ago is not what you are buying today. 

This is not a supply chain blip. This is a structural hardware cost crisis, and it is arriving at the worst possible moment; just as Windows Server 2016 is closely reaching end of life in January 2027 and firms are forced into a decision they never fully priced into their capital plans.  

This Is a Public Service Announcement.

Running unsupported server infrastructure through 2026 and into 2027 is not a neutral choice. It shows up in your cyber insurance questionnaire. It shows up in your compliance audit. It shows up in your exposure surface when something goes wrong, and at that point, the cost of deferral makes the hardware bill look small. The instinct to squeeze another year out of aging servers is understandable. It is also a liability hiding in plain sight. 

Every organization sitting at this crossroads needs to hear it plainly: the clock is real, the costs are real, and the budget you planned around no longer reflects the world you are buying in. 

For organizations who are dependent on this infrastructure, they are subject to a very costly and critical scenario no CFO ever wants to plan for, failing hardware. We all know the saying “wear and tear”. The older a server gets, the more likely it is to fail. The recommended replacement cycle for a Server is 5 years. At most 7 years. After this, you increase the risk of component failure. After 10 years, that risk becomes expected.  By then, organizations are stuck with purchasing new hardware anyways and recovering from backups instead of a smooth and planned migration.  

With current lead times on new server orders over 3 months for delivery, and the potential of the order being cancelled, the longer your server is offline, the longer your organization suffers. Cost is only projected to rise, and relief is not expected for at least 2-3 years.  

We Have Seen This Before. 

The pandemic did something nobody predicted… it collapsed years of cloud adoption hesitation into about eighteen months. When offices closed and infrastructure had to follow people home, the cloud stopped being a future-state strategy and became an operational necessity. Firms that had delayed migration for years moved in months. 

This moment rhymes. Hardware cost inflation, end-of-life pressure, and the pull of AI capabilities available natively in platforms like Microsoft 365 and Azure are combining into the same kind of forcing function. At ATG, we are already seeing it; firms that were on the fence about cloud migration are no longer on the fence. The economics made the decision for them. 

Microsoft could not have written a better script. Azure absorbs the workloads that no longer make sense to host on-premises. Entra ID and Intune replace the on-premises identity and device management infrastructure. The dependency on owned servers dissolves, and with it, the exposure to hardware pricing cycles that nobody can predict or control. In the short term, Microsoft is going to be a significant winner in all of this. That is not a criticism… it is simply where the market pressure is pointing. 

The Decision in Front of You 

Firms that treat this as a procurement problem will spend money and still have the same infrastructure risk. Firms that treat it as a strategy decision will come out the other side with a leaner, more defensible, AI-capable operating model. 

The hardware crisis is the forcing function. The cloud was already the answer. The math just got a lot harder to argue with. If your organization can work in the cloud, it is time to get started. 

Cloud migration isn’t feasible for every organization. Certain software simply isn’t compatible with cloud environments. However, alternatives do exist. It ultimately comes down to how much risk you’re willing to accept.