Why vendor conversations take more energy than they should

Why vendor conversations take more energy than they should

IT directors spend more time dealing with vendors than they might have expected to when they first moved into leadership.

It sounds straightforward.

You evaluate options, agree terms, renew contracts, and manage relationships.

But it’s rarely that clean.

Every supplier is trying to position themselves as critical. Every platform promises efficiency, resilience, visibility, automation, or cost reduction. Every renewal arrives with urgency attached to it.

Meanwhile, you’re trying to work out what is most important to the business and what adds more complexity to the environment.

That takes more effort than people outside IT realise.

You’re thinking about operational dependency, support quality, commercial risk, integration, long-term viability, licensing models, security exposure, and how difficult it would be to unwind the relationship later if things stopped working well.

A large part of the role becomes filtering noise.

Some suppliers are excellent.

Others create pressure. Through constant escalation, bundled services, and unclear pricing structures. Or through roadmaps that don’t line up with the direction your organisation is trying to move in.

And many conversations happen while you’re already carrying a full operational workload.

Negotiations can become reactive.

Renewals get handled close to deadlines because there hasn’t been time to review them properly.

Existing suppliers stay in place because changing platforms feels operationally risky.

Commercial discussions happen quickly because there are too many competing priorities to step back and assess the wider picture carefully.

That can leave the environment shaped as much by vendor momentum as by deliberate strategy.

You’re aware when that starts happening.

You know where costs have gradually increased. Where tooling overlaps. Which contracts haven’t been challenged for a while because there hasn’t been enough time to reopen the conversation properly.

Creating enough space to approach those discussions strategically is the hard part.

Good vendor management usually comes down to preparation.

Understanding how the platform is being used. Knowing where the operational pain points sit. Reviewing whether the service still matches the organisation’s current priorities rather than the priorities it had several years ago.

And that takes time.

And for many IT directors, time disappears into operational work long before supplier strategy reaches the top of the list.

That’s one reason co-managed support can make such a difference around vendor management.

When more of the day-to-day workload is shared, it becomes easier to properly assess suppliers, review contracts in detail, and negotiate from a position that feels measured rather than rushed.

It also creates more opportunity to challenge assumptions.

You can step back and ask whether the organisation is still getting value from the relationship, whether the tooling still fits the environment properly, and whether the current structure still makes sense for where the business is heading.

Those conversations are difficult to have when everything is happening at speed.

But with co-managed support, supplier conversations can become more deliberate and less driven by operational pressure or looming renewal dates.

If you’d like more time to properly review suppliers, contracts, and technology decisions, let’s talk about how co-managed support could help. Get in touch.

Have your employees become AI “middleware”?

Have your employees become AI “middleware”?

AI was supposed to remove repetitive work.

In some businesses, though, something different is happening.

People are spending large parts of their day moving information between systems so the AI can function properly.

Copying notes from one platform into another, checking whether data matches in different apps, rewriting prompts to give an AI tool more context, and manually correcting outputs that almost worked, but not quite.

Sound familiar?

There’s a name for this: Human middleware.

Employees end up acting like the glue holding disconnected systems together.

Once you notice it, you’ll start seeing it everywhere.

Someone downloads information from one system because another can’t access it directly.

A team member pastes customer details into an AI tool to generate a response, then copies the finished result somewhere else.

Data gets checked manually because nobody fully trusts what the systems are producing automatically.

It eats away at time.

The strange thing is that businesses can still feel more productive overall while this is happening.

AI genuinely does help people move faster in many situations. Emails get drafted quicker, reports take less time, and information becomes easier to summarise.

But new layers of admin appear around it.

AI tools often arrive faster than the systems underneath them evolve. A company adds one assistant here, another automation there, a separate AI-powered feature somewhere else… but the tools don’t naturally connect in a smooth way.

So, people bridge the gaps manually.

That creates an odd working environment where employees spend increasing amounts of energy translating between systems instead of doing the work those systems were meant to support.

And that can quickly become exhausting.

You end up with busy days that feel productive on the surface, but a lot of effort is going into coordination rather than progress.

If systems don’t integrate properly, if data quality is inconsistent, or if processes still rely heavily on manual handoffs, AI can sometimes layer extra complexity on top rather than removing it.

That’s why you may need to approach it differently.

Instead of adding isolated tools everywhere, focus on how information moves through the business.

Look at where data lives, how systems connect, and whether people are still spending too much time acting as the translator between technologies.

Ultimately, your team shouldn’t be spending their day helping software talk to other software.

They should be spending their time solving problems, helping customers, making decisions, and doing the work that creates value.

If your employees are constantly switching between apps, correcting AI outputs, or manually stitching workflows together, that’s a sign the technology strategy needs tightening up a little.

Is it time you reviewed your technology to make sure it’s reducing workload, rather than creating more of it behind the scenes? We can help. Get in touch.

The politics of IT leadership

The politics of IT leadership

You know that a large part of the IT director role has very little to do with technology.

It becomes obvious once you move beyond purely operational responsibility.

You’re no longer only managing systems, projects, security, and support.

You’re also navigating priorities, personalities, budgets, expectations, and the different ways people inside the business think about risk.

And those things don’t always line up neatly.

One department wants speed. Another wants tighter control. Leadership wants resilience and lower risk, but also wants projects delivered quickly and costs managed carefully.

Meanwhile, you’re trying to hold together an environment where every decision affects something else.

That creates pressure.

Many of the harder conversations inside IT leadership are about compromise.

You know a process could be tightened up, but making that change would frustrate another team.

You know a platform should probably be replaced, but there are operational reasons why the business keeps delaying it.

You know a security improvement matters, but there are commercial priorities competing for the same budget.

Many IT directors spend a lot of time balancing those competing pressures.

You’re building consensus, managing expectations, and deciding where to push firmly versus where to move gradually so the business stays aligned.

Judgement becomes a major part of your role.

Technical knowledge is still important, of course. But leadership inside IT increasingly comes down to communication, influence, timing, and understanding how the wider organisation operates.

And you have to juggle all of this alongside the operational demands too.

Incidents still happen. Projects still need attention. Vendors still need managing. Security responsibilities continue expanding. User expectations keep increasing.

So while you’re handling the political side of the role, you’re also carrying the day-to-day reality of running IT.

That can become exhausting.

Especially when there’s very little uninterrupted time to step back, think strategically, and properly work through bigger decisions before the next operational issue arrives.

That’s one reason many IT directors look for co-managed support around the operational side of IT.

When some of the day-to-day workload is shared, it creates more space to focus on leadership itself.

Conversations become less rushed, planning becomes more deliberate, and decisions can be worked through properly rather than squeezed into gaps.

It also changes how the wider business experiences IT.

Communication becomes more consistent, follow-through improves, projects move with fewer interruptions.

Stakeholders gain more confidence because things feel steadier and better coordinated.

You still lead the direction, set priorities, and manage the relationships around the business.

The difference is that you’ve got more capacity to operate at the level the role increasingly demands.

If you’d like to discuss how co-managed support could help create more space for operational responsibilities, get in touch.

Could this be the future of cyber security?

Could this be the future of cyber security?

Most cyber security tools work reactively.

Something suspicious happens, the system spots it, and then tries to stop the damage before it spreads.

That’s incredibly important.

But Microsoft is working on something that pushes much further: Using AI to find weaknesses before attackers discover them.

The new system is called MDASH, and the idea behind it is genuinely interesting.

Microsoft has built a platform that uses more than 100 specialised AI agents working together to search for hidden security flaws inside Windows.

These agents are designed to inspect different parts of the system, test for weaknesses, and flag potential vulnerabilities automatically.

Simply put, Microsoft is using AI to hunt for security holes at a scale humans simply couldn’t manage alone.

And it appears to be working.

During testing, the system reportedly uncovered multiple previously unknown vulnerabilities inside important parts of Windows.

This included flaws that attackers could potentially have exploited remotely over the internet.

Some of those vulnerabilities were considered critical.

These are the kinds of weaknesses that, in the wrong hands, could potentially allow attackers to take control of systems or run malicious code.

What makes this more impressive is the accuracy.

One of the biggest problems with AI-driven security tools has always been false alarms.

Systems that flag hundreds of “possible issues” which turn out to be nothing. That creates noise, wastes time, and makes security teams less effective.

Microsoft claims MDASH has been unusually good at avoiding that problem while still finding genuine risks.

Now, before anyone assumes AI is about to solve cyber security completely, it’s important to keep this in perspective.

This technology is mainly being used internally by Microsoft engineers now.

It’s still early days, and even if these systems become more widely available, they won’t suddenly replace the fundamentals that keep businesses safe.

Because most cyber attacks still succeed through ordinary gaps:

  • Weak passwords

  • Unpatched systems

  • People clicking the wrong link

  • Poor access controls

  • Missing backups

Those remain the biggest risks for most businesses today.

AI-driven security tools may eventually become a powerful extra layer of protection, especially for large organisations managing huge and complex systems.

The idea of intelligent agents constantly scanning for hidden weaknesses before criminals find them is a very promising direction for the future.

But the basics are more important right now.

A fully patched system with strong passwords, multi-factor authentication, good backups, and sensible user awareness training will protect most businesses far better than chasing the latest AI security trend without solid foundations underneath it.

The future of cyber security probably will involve more AI working behind the scenes, both defending systems and, unfortunately, helping attackers too.

But while the technology evolves, the core principles of staying safe haven’t changed.

Good security still comes down to reducing risk, limiting opportunities for attackers, and making sure the simple things are consistently done well.

If you want to make sure your business security is up to scratch, we’d be happy to help. Get in touch.

Justifying security investment when nothing has happened

Justifying security investment when nothing has happened

One of the more difficult parts of the IT director role is explaining the value of something that’s designed to prevent problems rather than produce visible outcomes.

When security investment works, the business usually doesn’t notice.

There’s no obvious moment where people stop and say, “That was the firewall upgrade working,” or “That additional monitoring really paid off today.”

The environment carries on as normal.

That can make security investment harder to justify than projects with a clear operational outcome attached to them.

A new platform improves efficiency. A new system supports growth. A migration removes an obvious limitation.

Security sits in a different category.

You’re investing in resilience, reduction of exposure, response capability, and the ability to recover more effectively if something does happen.

Those things are harder to demonstrate in a spreadsheet or a board discussion.

That’s usually where the pressure starts.

You already understand why the investment is important. The challenge is presenting it in a way that connects with the wider business.

Most leadership teams are weighing security investment against everything else competing for budget at the same time.

Growth initiatives, staffing, operational costs, commercial priorities…

Cyber security enters that conversation alongside all of them.

That means the discussion can become less about the technology and more about consequence.

What would disruption look like for the organisation?


How exposed are key systems or suppliers?


How quickly could operations recover?


What areas create the greatest operational or financial impact if something goes wrong?

Those are usually the conversations that are more effective. They connect security decisions to business continuity and operational stability rather than technical capability alone.

But preparing those conversations properly takes work.

You’re pulling together information from different systems, reviewing exposure across the environment, assessing priorities.

And deciding how to explain all of it in a way that supports decision-making rather than creating confusion.

That’s a substantial amount of preparation around a discussion people only see for a few minutes in a meeting room.

At the same time, the operational side of IT doesn’t slow down.

Projects still need attention. Support issues still arrive. Vendors still need managing. Security reviews, audits, user requests, and incidents continue.

That’s where additional support around the operational workload becomes valuable.

When more of the day-to-day pressure is shared, it creates more room to properly assess exposure, prepare recommendations, and build a stronger case around where investment will have the biggest impact.

It also gives you more opportunity to approach security strategically rather than reactively.

That changes the quality of the discussion quite quickly.

As expectations around cyber security continue to grow, the ability to justify investment clearly is becoming just as important as selecting the right technology in the first place.

If you’re looking for a way to create more time for security planning and investment decisions, we’d be happy to show you how co-managed support could fit alongside your team. Get in touch.