[{"data":1,"prerenderedAt":890},["ShallowReactive",2],{"blog:\u002Fblog\u002Fcase-study-cut-it-costs":3,"blog-listed":323},{"id":4,"title":5,"authors":6,"body":8,"cover":308,"date":309,"description":310,"draft":311,"excerpt":308,"extension":312,"featured":311,"meta":313,"navigation":314,"noindex":311,"path":315,"scheduled":308,"seo":316,"stem":317,"tags":318,"__hash__":322},"blog\u002Fblog\u002Fcase-study-cut-it-costs.md","How we cut a 60-person practice's IT costs by 41% — and what we changed",[7],"london-ict",{"type":9,"value":10,"toc":296},"minimark",[11,20,25,28,171,178,182,185,189,211,215,235,239,246,250,253,267,270,274,281],[12,13,14,15,19],"p",{},"A 60-person mid-tier accountancy moved to us in November 2025. Six months in, IT spend is down 41% on a like-for-like basis and helpdesk tickets are down 60%. Here's exactly what we changed — none of it is clever; almost all of it is ",[16,17,18],"em",{},"removing"," things their previous provider had quietly accumulated.",[21,22,24],"h2",{"id":23},"the-starting-position","The starting position",[12,26,27],{},"Their monthly bill from the previous IT provider was £14,200. That included:",[29,30,31,47],"table",{},[32,33,34],"thead",{},[35,36,37,41,44],"tr",{},[38,39,40],"th",{},"Line item",[38,42,43],{},"Was",[38,45,46],{},"Now",[48,49,50,65,79,93,105,118,132,142,153],"tbody",{},[35,51,52,56,59],{},[53,54,55],"td",{},"Microsoft 365 (Business Premium × 60)",[53,57,58],{},"£1,440",[53,60,61,62],{},"£1,260 ",[16,63,64],{},"(re-negotiated, same product)",[35,66,67,70,73],{},[53,68,69],{},"\"Managed antivirus\" (3rd-party)",[53,71,72],{},"£540",[53,74,75,76],{},"£0 ",[16,77,78],{},"(M365 Defender included)",[35,80,81,84,87],{},[53,82,83],{},"Backup product",[53,85,86],{},"£1,200",[53,88,89,90],{},"£180 ",[16,91,92],{},"(M365 Backup at the right SKU)",[35,94,95,98,100],{},[53,96,97],{},"Remote-management agent",[53,99,72],{},[53,101,75,102],{},[16,103,104],{},"(included in our managed services)",[35,106,107,110,113],{},[53,108,109],{},"Spam filter (3rd-party)",[53,111,112],{},"£660",[53,114,75,115],{},[16,116,117],{},"(M365 EOP is sufficient)",[35,119,120,123,126],{},[53,121,122],{},"Hosted phone system",[53,124,125],{},"£1,800",[53,127,128,129],{},"£960 ",[16,130,131],{},"(VoIP at our wholesale rates)",[35,133,134,137,140],{},[53,135,136],{},"Office firewall + maintenance",[53,138,139],{},"£480",[53,141,139],{},[35,143,144,147,150],{},[53,145,146],{},"Managed services + helpdesk",[53,148,149],{},"£7,540",[53,151,152],{},"£4,520",[35,154,155,161,166],{},[53,156,157],{},[158,159,160],"strong",{},"Total \u002F month",[53,162,163],{},[158,164,165],{},"£14,200",[53,167,168],{},[158,169,170],{},"£7,400",[12,172,173,174,177],{},"Savings: ",[158,175,176],{},"~£6,800\u002Fmonth",". They paid for the migration project (~£8k one-off) in six weeks.",[21,179,181],{"id":180},"what-we-removed","What we removed",[12,183,184],{},"The expensive bits were duplicated services. They had a third-party antivirus running alongside M365 Defender (slowing every laptop down) and three different backup products covering the same data. The previous provider charged for each \"managed\".",[21,186,188],{"id":187},"what-we-kept-and-improved","What we kept and improved",[190,191,192,199,205],"ul",{},[193,194,195,198],"li",{},[158,196,197],{},"Microsoft 365 Business Premium"," — same product, better commercial terms.",[193,200,201,204],{},[158,202,203],{},"Their existing firewall"," — perfectly fine, just needed a config tidy-up and proper monitoring.",[193,206,207,210],{},[158,208,209],{},"VoIP"," — moved off their hosted system to ours; same handsets, same numbers.",[21,212,214],{"id":213},"what-we-added","What we added",[190,216,217,223,229],{},[193,218,219,222],{},[158,220,221],{},"Conditional Access"," lockdown (UK-only sign-in, MFA-required, impossible-travel alerts).",[193,224,225,228],{},[158,226,227],{},"M365 Backup"," at the right SKU — point-in-time restore, immutable.",[193,230,231,234],{},[158,232,233],{},"Quarterly cost review"," — looking specifically for SKU changes Microsoft has released that we should move them onto.",[21,236,238],{"id":237},"ticket-volume-the-surprise","Ticket volume — the surprise",[12,240,241,242,245],{},"Tickets dropped 60% in the first 90 days. The biggest single cause: ",[158,243,244],{},"conditional access"," killed the \"I'm locked out from holiday in Italy\" emails dead. The second-biggest: removing the third-party AV that was triggering false positives on Excel macros.",[21,247,249],{"id":248},"what-this-didnt-include","What this didn't include",[12,251,252],{},"We didn't:",[190,254,255,258,261,264],{},[193,256,257],{},"Replace any hardware",[193,259,260],{},"Re-image any laptops",[193,262,263],{},"Change any user passwords",[193,265,266],{},"Migrate any data between platforms",[12,268,269],{},"The whole thing was a configuration project. Cheap to do, easy to undo if they'd hated us.",[21,271,273],{"id":272},"what-it-should-mean-for-you","What it should mean for you",[12,275,276,277,280],{},"If your monthly bill has crept up by line item and you can't remember the last time someone ",[16,278,279],{},"removed"," something — book a 30-minute free review. We come, we look at every line, we say honestly which would matter if you stopped paying for them. No commitment, no sales pitch you can't walk out of.",[12,282,283,284,291,292,295],{},"Email ",[158,285,286],{},[287,288,290],"a",{"href":289},"mailto:hello@londonict.com","hello@londonict.com"," with ",[16,293,294],{},"\"cost review\""," in the subject.",{"title":297,"searchDepth":298,"depth":298,"links":299},"",3,[300,302,303,304,305,306,307],{"id":23,"depth":301,"text":24},2,{"id":180,"depth":301,"text":181},{"id":187,"depth":301,"text":188},{"id":213,"depth":301,"text":214},{"id":237,"depth":301,"text":238},{"id":248,"depth":301,"text":249},{"id":272,"depth":301,"text":273},null,"2026-04-12","A real before-and-after walkthrough of a London accountancy that moved to us in November 2025. No magic — just removing what they didn't need.",false,"md",{},true,"\u002Fblog\u002Fcase-study-cut-it-costs",{"title":5,"description":310},"blog\u002Fcase-study-cut-it-costs",[319,320,321],"case-study","cost","microsoft-365","5WJGRpZepr-iOhVEQxcnwwvPK91rWq0wfKOhQ_beLMc",[324,502,706],{"id":325,"title":326,"authors":327,"body":328,"cover":308,"date":490,"description":491,"draft":311,"excerpt":308,"extension":312,"featured":314,"meta":492,"navigation":314,"noindex":311,"path":493,"scheduled":308,"seo":494,"stem":495,"tags":496,"__hash__":501},"blog\u002Fblog\u002Fbt-copper-2027-stop-sell.md","BT is switching off copper lines in 2027 — what it actually means",[7],{"type":9,"value":329,"toc":483},[330,337,341,362,365,369,380,394,398,419,423,430,434,480],[12,331,332,333,336],{},"You'll have seen the headlines: BT \u002F Openreach are switching the ",[158,334,335],{},"PSTN copper network off by January 2027",". Here's the version without the marketing.",[21,338,340],{"id":339},"whats-actually-happening","What's actually happening",[190,342,343,350,355],{},[193,344,345,346,349],{},"Analogue phone lines (the ones your alarm panel, lift line and fax machine plug into) — ",[158,347,348],{},"gone",".",[193,351,352,353,349],{},"Old \"ISDN\" lines used for business voice — ",[158,354,348],{},[193,356,357,358,361],{},"Standard FTTC broadband (fibre-to-the-cabinet over copper) — ",[158,359,360],{},"mostly fine"," until the underlying line type retires; varies by exchange.",[12,363,364],{},"It's not \"the internet goes off.\" It's \"the copper-based phone service goes off.\"",[21,366,368],{"id":367},"who-needs-to-act-now","Who needs to act now",[12,370,371,372,375,376,379],{},"If you have ",[158,373,374],{},"any"," of these you should be on a migration plan ",[158,377,378],{},"before October 2026",":",[190,381,382,385,388,391],{},[193,383,384],{},"A traditional ISDN or analogue phone line for inbound calls",[193,386,387],{},"A monitored alarm or lift line on a PSTN connection (these often slip the net — alarm companies are not always proactive)",[193,389,390],{},"A \"GSM gateway\" or \"PSTN failover\" device anywhere on site",[193,392,393],{},"Door entry or intercom systems that dial out",[21,395,397],{"id":396},"who-can-probably-ignore-the-panic","Who can probably ignore the panic",[190,399,400,406,412],{},[193,401,402,403,405],{},"Already on ",[158,404,209],{}," with us → you're done; nothing to do.",[193,407,402,408,411],{},[158,409,410],{},"FTTP"," broadband with cloud phones → nothing to do.",[193,413,414,415,418],{},"Single-site office with FTTC broadband and ",[158,416,417],{},"no analogue phones"," → check your alarm, otherwise you're fine.",[21,420,422],{"id":421},"what-were-doing-for-customers","What we're doing for customers",[12,424,425,426,429],{},"For everyone on our books we've done a copper-dependency audit; you should have an email from us with the verdict in the last 30 days. If you didn't get one, ",[158,427,428],{},"email your account manager today",". We'd rather find a missed alarm line in May 2026 than December.",[21,431,433],{"id":432},"the-realistic-timeline","The realistic timeline",[29,435,436,446],{},[32,437,438],{},[35,439,440,443],{},[38,441,442],{},"Month",[38,444,445],{},"What to expect",[48,447,448,456,464,472],{},[35,449,450,453],{},[53,451,452],{},"Now → Oct 2026",[53,454,455],{},"Order migrations; engineers' diaries fill up",[35,457,458,461],{},[53,459,460],{},"Oct → Dec 2026",[53,462,463],{},"Industry rushes; expect delays + price rises",[35,465,466,469],{},[53,467,468],{},"Jan 2027",[53,470,471],{},"Switch-off starts in earnest, regionally phased",[35,473,474,477],{},[53,475,476],{},"Through 2027",[53,478,479],{},"Anyone still on copper gets force-migrated or disconnected",[12,481,482],{},"If you're on London ICT's voice service this is mostly background reading. If you're not — let's have a 15-minute call before the rush.",{"title":297,"searchDepth":298,"depth":298,"links":484},[485,486,487,488,489],{"id":339,"depth":301,"text":340},{"id":367,"depth":301,"text":368},{"id":396,"depth":301,"text":397},{"id":421,"depth":301,"text":422},{"id":432,"depth":301,"text":433},"2026-05-18","The plain-English version. Most businesses don't need to panic — but the few that do need to start now.",{},"\u002Fblog\u002Fbt-copper-2027-stop-sell",{"title":326,"description":491},"blog\u002Fbt-copper-2027-stop-sell",[497,498,499,500],"broadband","ftth","news","openreach","rCmtus9MiINIyr-_rQSUwX9o9Ej2NH1EYfRlEOG0YGM",{"id":4,"title":5,"authors":503,"body":504,"cover":308,"date":309,"description":310,"draft":311,"excerpt":308,"extension":312,"featured":311,"meta":703,"navigation":314,"noindex":311,"path":315,"scheduled":308,"seo":704,"stem":317,"tags":705,"__hash__":322},[7],{"type":9,"value":505,"toc":694},[506,510,512,514,618,622,624,626,628,642,644,658,660,664,666,668,678,680,682,686],[12,507,14,508,19],{},[16,509,18],{},[21,511,24],{"id":23},[12,513,27],{},[29,515,516,526],{},[32,517,518],{},[35,519,520,522,524],{},[38,521,40],{},[38,523,43],{},[38,525,46],{},[48,527,528,538,548,558,568,578,588,596,604],{},[35,529,530,532,534],{},[53,531,55],{},[53,533,58],{},[53,535,61,536],{},[16,537,64],{},[35,539,540,542,544],{},[53,541,69],{},[53,543,72],{},[53,545,75,546],{},[16,547,78],{},[35,549,550,552,554],{},[53,551,83],{},[53,553,86],{},[53,555,89,556],{},[16,557,92],{},[35,559,560,562,564],{},[53,561,97],{},[53,563,72],{},[53,565,75,566],{},[16,567,104],{},[35,569,570,572,574],{},[53,571,109],{},[53,573,112],{},[53,575,75,576],{},[16,577,117],{},[35,579,580,582,584],{},[53,581,122],{},[53,583,125],{},[53,585,128,586],{},[16,587,131],{},[35,589,590,592,594],{},[53,591,136],{},[53,593,139],{},[53,595,139],{},[35,597,598,600,602],{},[53,599,146],{},[53,601,149],{},[53,603,152],{},[35,605,606,610,614],{},[53,607,608],{},[158,609,160],{},[53,611,612],{},[158,613,165],{},[53,615,616],{},[158,617,170],{},[12,619,173,620,177],{},[158,621,176],{},[21,623,181],{"id":180},[12,625,184],{},[21,627,188],{"id":187},[190,629,630,634,638],{},[193,631,632,198],{},[158,633,197],{},[193,635,636,204],{},[158,637,203],{},[193,639,640,210],{},[158,641,209],{},[21,643,214],{"id":213},[190,645,646,650,654],{},[193,647,648,222],{},[158,649,221],{},[193,651,652,228],{},[158,653,227],{},[193,655,656,234],{},[158,657,233],{},[21,659,238],{"id":237},[12,661,241,662,245],{},[158,663,244],{},[21,665,249],{"id":248},[12,667,252],{},[190,669,670,672,674,676],{},[193,671,257],{},[193,673,260],{},[193,675,263],{},[193,677,266],{},[12,679,269],{},[21,681,273],{"id":272},[12,683,276,684,280],{},[16,685,279],{},[12,687,283,688,291,692,295],{},[158,689,690],{},[287,691,290],{"href":289},[16,693,294],{},{"title":297,"searchDepth":298,"depth":298,"links":695},[696,697,698,699,700,701,702],{"id":23,"depth":301,"text":24},{"id":180,"depth":301,"text":181},{"id":187,"depth":301,"text":188},{"id":213,"depth":301,"text":214},{"id":237,"depth":301,"text":238},{"id":248,"depth":301,"text":249},{"id":272,"depth":301,"text":273},{},{"title":5,"description":310},[319,320,321],{"id":707,"title":708,"authors":709,"body":710,"cover":308,"date":879,"description":880,"draft":311,"excerpt":308,"extension":312,"featured":311,"meta":881,"navigation":314,"noindex":311,"path":882,"scheduled":308,"seo":883,"stem":884,"tags":885,"__hash__":889},"blog\u002Fblog\u002Fransomware-2026-what-were-seeing.md","Ransomware in 2026 — what we're seeing in the wild",[7],{"type":9,"value":711,"toc":873},[712,715,719,725,730,749,753,758,761,765,785,789,799,803,817,821,824,867],[12,713,714],{},"Quick advisory based on three incidents we've helped on in Q1. Names changed; details kept.",[21,716,718],{"id":717},"incident-1-accounting-firm-32-staff","Incident 1 — accounting firm, 32 staff",[12,720,721,724],{},[158,722,723],{},"What happened:"," Someone in accounts received an invoice \"from a known supplier\", opened the PDF, clicked the embedded link to \"approve\". The link installed a credential-stealer. 48 hours later, the attacker logged into the M365 tenant from an EU IP, downloaded the SharePoint document library, and emailed every contact in the address book with a fake invoice. By the time anyone noticed, ~£40k had been wired.",[12,726,727],{},[158,728,729],{},"What would have stopped it:",[190,731,732,737,743],{},[193,733,734,736],{},[158,735,221],{}," rule blocking sign-in from countries outside the UK (5-minute config in Entra)",[193,738,739,742],{},[158,740,741],{},"Impossible-travel"," alert (login from London then Berlin 20 minutes later) — built-in to Microsoft Defender for Identity",[193,744,745,748],{},[158,746,747],{},"Mark external email"," with a banner in Outlook (free, takes 2 minutes)",[21,750,752],{"id":751},"incident-2-design-studio-8-staff-on-prem-nas","Incident 2 — design studio, 8 staff, on-prem NAS",[12,754,755,757],{},[158,756,723],{}," A staff laptop got encrypted by a drive-by download. The laptop's mapped network drive to the NAS got encrypted too. Two terabytes of client work, gone in 40 minutes.",[12,759,760],{},"The NAS had backups — to a USB drive that was plugged into the NAS. Both encrypted.",[12,762,763],{},[158,764,729],{},[190,766,767,773,779],{},[193,768,769,772],{},[158,770,771],{},"Off-site, immutable backups",". £30\u002Fmo for a small business with our backup product.",[193,774,775,778],{},[158,776,777],{},"Removing the mapped drive"," for users that don't need it (most don't — they use OneDrive).",[193,780,781,784],{},[158,782,783],{},"No domain admin on day-to-day laptops"," (this is the most-skipped one, the most-impactful).",[21,786,788],{"id":787},"incident-3-solicitor-16-staff-full-m365","Incident 3 — solicitor, 16 staff, full M365",[12,790,791,793,794,798],{},[158,792,723],{}," MFA bypass via an OAuth consent attack. The attacker sent a phishing email asking the recipient to \"review a shared document\" via a real Microsoft URL. The user clicked through and consented to an OAuth app that gave the attacker ",[795,796,797],"code",{},"Mail.ReadWrite"," on their mailbox. No MFA prompt — OAuth grants are out-of-band.",[12,800,801],{},[158,802,729],{},[190,804,805,811],{},[193,806,807,810],{},[158,808,809],{},"Admin-only consent"," for third-party OAuth apps (Entra → Enterprise apps → User settings → \"Users can consent\" → No). Default to off; review requests manually.",[193,812,813,816],{},[158,814,815],{},"Phish-resistant MFA"," (Windows Hello, FIDO2 keys) for partners and finance.",[21,818,820],{"id":819},"the-boring-fundamentals-checklist","The boring fundamentals checklist",[12,822,823],{},"If you do nothing else this year, do these — none of them are new, all of them stop most of what we see:",[825,826,827,838,843,849,855,861],"ol",{},[193,828,829,830,833,834,837],{},"MFA on ",[158,831,832],{},"every"," account, with ",[158,835,836],{},"at least two methods"," registered",[193,839,840,842],{},[158,841,221],{}," locking sign-in to the UK (or your real countries)",[193,844,845,848],{},[158,846,847],{},"Backups that aren't reachable from a compromised laptop"," (immutable, off-site)",[193,850,851,854],{},[158,852,853],{},"No admin rights"," for day-to-day work — separate admin accounts only",[193,856,857,860],{},[158,858,859],{},"Consent restrictions"," on OAuth third-party apps",[193,862,863,866],{},[158,864,865],{},"Marked-external banner"," on inbound email",[12,868,869,870],{},"We can audit your tenant against this list in an hour. Email your account manager: ",[16,871,872],{},"\"Run the security baseline check on us.\"",{"title":297,"searchDepth":298,"depth":298,"links":874},[875,876,877,878],{"id":717,"depth":301,"text":718},{"id":751,"depth":301,"text":752},{"id":787,"depth":301,"text":788},{"id":819,"depth":301,"text":820},"2026-04-30","Three real incidents from the last quarter, and the boring fundamentals that would have stopped each one.",{},"\u002Fblog\u002Fransomware-2026-what-were-seeing",{"title":708,"description":880},"blog\u002Fransomware-2026-what-were-seeing",[886,887,888],"security","ransomware","advisory","Tn6dftkc0X8_HulAQhGdDs1GstQK_KE6cyo2zvPtWpk",1779467483448]