SOLOITPRO
TL;DR: This week in 60 seconds
• Playbook: my 30-day roadmap for the only IT person, and the order I check things in.
• Free download: the Starter Checklist scorecard.
• Radar: a WatchGuard firewall flaw ransomware gangs are now using, and Windows 10 extended updates Year 2.
• Quick win: check your firewall's firmware and set up a Google Alert for your model.
So you're the solo IT provider
Day one as the solo IT provider in an environment you've never seen has a particular feeling. Nobody hands you a map. The last person left, or there never was one, and whatever documentation exists is an old password spreadsheet, a sticky note on a server, or nothing at all. Everyone assumes you already know how it all works. You don't, not yet, and there's nobody to ask.
That's nerve-wracking, and anyone who says otherwise hasn't done it. You're quietly wondering what's broken that nobody has noticed, which old account still works, and whether the thing you're about to touch is holding the whole place up. And the first time something goes down, every head in the office turns toward you.
I know that feeling well. My first job as the solo IT provider was at a small medical practice, about 15 users. On my first day, the owner's husband handed me a box with a Switchvox phone system in it and said, "Figure out how to make this work." That was the onboarding.
The first month was a crash course. Users who'd never been shown how anything worked. A malware attack that hit the server and a few workstations. No real backups. No real firewall. One user spilled coffee into her laptop and swore up and down she hadn't, right until I turned it on its side and coffee poured out. And the IT closet, where every system the practice depended on lived, sat directly under a bathroom with a leaky toilet. (Ewww.)
None of it had been planned. There had never been real IT there, just a hodgepodge of fixes bolted on one at a time as the practice grew.
It was only 15 people, but it taught me how to walk into a mess, figure out what matters first, and fix things in the right order. That came in handy years later, when I took over IT for a much bigger practice: about 100 users across multiple locations, run by an outside IT company that had gone rogue and turned the relationship adversarial. I brought every system back in house. Different scale, same playbook: find out what you have, lock down what's exposed, and get control of the keys.
The good news: the nerves go away once you have a plan, and the plan starts with knowing what to look at first.
I've spent 24 years in IT infrastructure, a lot of it as the only one in the room who knew where things were. SoloITPro is the playbook I wish someone had handed me: practical articles on the site, rounded up here every Sunday with a few links worth your time and one thing you can fix this week.
THIS WEEK’S PLAYBOOK
The One-Person IT Department Starter Checklist
If you're the only IT person, the whole environment lives in your head. The job is turning that into something a stranger could use, and keeping the place safe while you do it. Here's the 30-day plan I follow:
Week 1, the first three checks: the firewall, the backups, and who has the keys.
Week 2, know what you have: an inventory of everything, with owners and renewal dates.
Week 3, know what else can hurt you: security basics, anything end-of-life, and who to call in a crisis.
Week 4, write it down for a stranger: runbooks, a one-page "if I'm out" sheet, and a ranked risk list for your boss.
Read the full roadmap and grab the free Starter Checklist scorecard.
Takeaway: check the firewall first. It's facing the internet, and you can check its patch level in an hour without changing a thing.
Every environment has a box nobody understands. At one company I worked for, it was a DOS server with a note on it: never turn this off. Nobody knew what it did, so nobody touched it. Your job in the first month is to find yours and put it on the risk list.
RADAR
A WatchGuard firewall flaw is now used by ransomware gangs
CISA updated its Known Exploited Vulnerabilities catalog in September to say ransomware groups are now using CVE-2025-14733, a remote code execution bug in WatchGuard Firebox firewalls (mainly ones configured for IKEv2 VPN). WatchGuard's patch has been out since December. Source: BleepingComputer
Takeaway: if you run a Firebox, check your Fireware version today and look at WatchGuard's indicators of compromise too. Patrick's Take: this is exactly why patch level is the first thing I check. The fix has been out for months and attackers are still finding unpatched boxes.
RADAR
Windows 10 extended updates: Year 1 just ended
Year 1 of Microsoft's paid Extended Security Updates for businesses wrapped up with October's Patch Tuesday. Year 2 is a new purchase, Microsoft says the price doubles every year (from $61 per device for Year 1 to $122 for Year 2), and each year has its own activation ID that has to be applied on every device. A machine that isn't activated for Year 2 quietly stops getting security fixes. Source: Microsoft
Takeaway: if you're still paying for Windows 10 extended updates, put the Year 2 activation on your list this week. Patrick's Take: better yet, use this as the push to finally replace those machines.
QUICK WIN
Check your firewall firmware and set a Google Alert
Log in to your firewall, write down the exact model and firmware version, and look it up on your vendor's security advisory page. Sign up for the vendor's advisory emails while you're there. Then go to google.com/alerts and create an alert for your exact model plus a few warning words, for example: "Firebox M290" vulnerability OR CVE OR firmware OR exploit.
Takeaway: when your model shows up in the news, you hear about it before your users do. About ten minutes, and it's the first check on the roadmap.
GEAR & TOOLS
CISA Known Exploited Vulnerabilities catalog (free)
The list of flaws attackers are actively using right now, searchable by vendor, with email alerts. If your firewall, VPN or server shows up here, patch it today. Browse the catalog
Disclosure: no affiliation. It's a free government resource.
Coming up next week: the first deep dive in the series, First Thing I'd Check: The Firewall, with a free Firewall Review spreadsheet.
Know another one-person IT department? Forward this to them. They can subscribe free at soloitpro.com.
Hit reply and tell me the biggest IT headache on your plate right now. I read every reply, and the best ones become future articles.
Talk soon,
Patrick
