Whether you’re a Finance Director trying to predict IT costs, a COO who needs systems that keep pace with a growing team, or an Operations Manager tired of firefighting, what’s usually missing isn’t more support. It’s a plan.
This guide explains how Noble IT approaches IT consultancy services, in the words of our Director, Adam Nichols. It covers what consulting looks like inside a managed service, what happens during a 360 IT Review, where IT budgets really leak and what to check before you sign with anyone. We’re an Oxford-based IT partner working with businesses across Oxfordshire and well beyond it. We’ve built hundreds of IT roadmaps along the way, so most of what follows comes from doing it rather than reading about it.
At Noble IT, consulting isn’t something you buy on its own. “We don’t do consulting as a standalone service,” says Adam. It sits at the centre of our managed service, alongside the help desk, our network operations centre (NOC), which watches your infrastructure, and our security operations centre (SOC), which watches for threats.
What ties those together is a roadmap. Adam describes it as an accumulation of everything we learn about a business: conversations with the management team, its objectives, priorities, frustrations and concerns, and the results of our technical assessments. A consultant builds that roadmap, delivers it and manages it over “12, 24, 36 months, however long the company wants to take to get them from point A to point B.”
Most businesses that come to us have only ever had a reactive help desk. Adam is blunt about how that model works: “Nothing happens until you ring them, and then things start to happen because something is broken and needs fixing.”
|
Reactive help desk |
Proactive monitoring |
Named technical consultant |
|
|---|---|---|---|
|
The question it answers |
“Why isn’t this working?” |
“What’s about to go wrong?” |
“What does the business need next?” |
|
When it acts |
When you call |
Before you call |
Continuously, against your plans |
|
Who you speak to |
Whoever picks up |
The desk, alerted by our systems |
One named person who knows your business |
|
What you get |
A fix |
Problems caught early, from failing backups to breaches |
Root cause analysis and a live roadmap |
|
Does anyone look for patterns? |
No |
Sometimes |
Yes. That’s the job. |
Every Noble IT client gets the first two. We “wrap their entire environment in systems and monitors,” as Adam puts it, so a failing backup or a developing fault usually shows up on our screens before anyone picks up the phone.
Clients on our Managed IT Partnership also get a named technical consultant, who reads everything those systems report and acts as the business’s IT manager. If the same issue keeps coming back, it goes on the roadmap. If the business moves into a new sector, the technology plan changes with it. Without that role, Adam says, “we’re just wiping the nose of the cold rather than treating the cold.”
Plenty of IT websites promise to align technology with business objectives. Here’s what it means for us. During onboarding we ask what your previous IT company wasn’t doing, what’s worrying you, and where the business wants to be in 12 months, three years or five.
If the answer is growth, the questions get specific. If you’re hiring over the next 12 months, can your office network handle another 30 users? If not, what needs to change, and in what order?
If the answer is security, we assess your risk profile first, then talk about your risk appetite. “You can spend a million or you can spend a tenner,” Adam explains, “but the less you spend, the more risk you’re accepting.” Security services are then matched to what actually needs protecting, at a budget you’ve chosen.
Every recommendation comes with the reason behind it, and you can say no. “It’s never a sales game for us,” says Adam. If a client decides they’re comfortable with a risk, we mark that decision on the roadmap, so everyone knows later that it was a choice rather than an oversight.
Many businesses assume their IT is too specialised for an outside partner to understand. Adam’s view, from supporting firms across sectors, is that your processes and your people might be special, but the technology underneath usually isn’t. An accountancy firm running Sage is still running Windows laptops and Microsoft 365, the same as the 50 other accountancy firms down the road. Sage supports Sage under its own vendor contract. “We’ll get you up to the door,” Adam says. Everything beyond it is the same work we do in every other sector.
Every engagement starts with a 360 IT Review, our version of an IT health check. It runs in four stages.
Before anyone looks at a server, we talk to the management team about strategy, any major changes planned over the next 36 months and what’s been frustrating them. We also ask an awkward question. Why are we having this conversation at all, when you already have an IT partner?
Those answers often surface quick wins. “We go into a business and they say, we’ve been having this issue with SharePoint for the last four years and nobody’s ever solved it,” Adam says. “Week one, problem solved.”
Then we work through your technology layer by layer: servers, Microsoft 365 or Google Workspace, network infrastructure, backups, phone systems and internet. Each layer is assessed against best-practice security and configuration baselines, so the findings rest on a standard rather than one engineer’s opinion.
Anything critical or at risk becomes an item on your roadmap, explained by what it means for the business. A backup finding might read like this. If the server failed today, you’d lose the last 24 hours of data and it would take three days to restore the rest. That’s realistically four days of downtime. What does that cost you? Does it need to be quicker?
What you get back is a plan you can read, ranked by risk.
Cyber security assessments include user awareness training, because the strongest technical controls can’t stop someone handing over their password. ASOS confirmed in October 2026 that its recent breach began with a social engineering attack that stole an employee’s login credentials (BleepingComputer). “If somebody clicks on a link and enters a password, they’ve handed you the keys,” says Adam.
Rather than a blanket video everyone half-watches in the background, each employee takes a 30-question gap analysis covering things like suspicious emails and password strength. The platform builds a matrix of where they’re strong and where they’re not, then targets their training at the weakest area and moves on once it improves. Someone confident with email security but weak on physical security gets training on physical security.
Ask Adam what turns up most often in a 360 IT Review and the answer is immediate: incorrect or absent configuration of Microsoft 365.
Most businesses buy their licences, add users, open Outlook and assume the rest is handled because it’s Microsoft. Adam uses an analogy to explain why it isn’t.
“Microsoft cloud is a big block of flats and Microsoft is the landlord. When you buy your subscription, they’re leasing you an apartment, but the security of that apartment is your problem. It doesn’t matter that the block is secure if you go around leaving your front door open.”
In Microsoft 365, leaving the door open looks like permissive sharing settings, unmanaged OneDrive syncing and devices that were never enrolled in Intune, Microsoft’s device management tool. Adam estimates many small businesses use around 5% of what the platform can do. The result is lost data, recurring device problems and employees who can’t work as effectively as they should. Most of it is straightforward to fix once someone sets the platform up properly.
When IT budgets come up, the conversation usually turns to equipment and licences. For IT cost optimisation, Adam thinks that’s the wrong place to look.
Too many licences, the wrong tier, accounts for people who left months ago. These are easy to find, and because we manage software as assets, they get picked up. They’re rarely where most of the money goes.
Businesses used to replace laptops every three to five years, partly for accounting reasons and partly because software kept demanding more. With so much now running in the cloud, that habit has faded. Machines run until they die.
The cost shows up in salaries rather than invoices. “Something might have taken somebody 15 minutes, and it’s now taking them 45 minutes,” Adam says, because the device has slowed down or needs rebooting every couple of hours. You’re still paying for a full day’s work and getting less of it.
Ageing hardware also runs into fixed deadlines. Microsoft ended Windows 10 support on 14 October 2025. Businesses that weren’t ready can buy Extended Security Updates, but the pricing is designed to move you on. For commercial organisations in the UK it’s around £58 per device for year one, and the price doubles in each of the following two years, with cover ending in October 2028. The updates are cumulative, so joining in year two means paying for year one as well (Microsoft Learn). For 20 machines still on Windows 10, that’s more than £8,000 over three years on security patches alone, for devices that will still need replacing at the end of it.
The biggest potential loss, in Adam’s view, is a security gap left open. If personal data is breached and has to be reported to the Information Commissioner’s Office, the penalties alone can be far bigger than the cost of fixing the problem. The reputational damage, and the business lost because of it, is worse again.
The UK government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses experienced a cyber security breach or attack in the previous 12 months, rising to 65% of medium-sized businesses. Only 31% of businesses have a board member responsible for cyber security. Our Cyber Essentials guide covers the baseline most UK businesses should be working towards.
An IT roadmap is the most useful thing a consultant produces. It isn’t a strategy document that lives in a shared drive, but a working plan that says what’s happening, when, why and roughly what it’ll cost.
Ours run over 12, 24 or 36 months, depending on how far ahead the business wants to plan and how quickly it wants to get there.
A good IT roadmap covers six areas:
The last item is the one that changes the conversation with your Finance Director.
Every line carries an estimated cost, and anything the client has decided against is marked as declined.
A roadmap nobody reviews is just a nicer-looking wish list. Our monitoring feeds it constantly, so repeat issues, ageing kit and upcoming renewals land on it before they turn into problems, and your named consultant reviews it with you as the business changes. If you win a large contract or take on 15 new starters, the plan moves with you.
Through our Live Roadmap & Procurement service we also handle the buying, so the plan and the purchase orders actually match.
Planning cuts down the surprises. It doesn’t remove them. One of our larger clients recently had a floor of their office refurbished, and the builders unplugged the servers because they were in the way. The whole business stopped.
Our monitoring flagged it straight away, and a server outage is an automatic Priority 1. We give it a couple of minutes in case it’s a false alarm or someone plugs the cable back in. By five minutes, we’re finding a consultant to get in the car. While they drive, someone on the desk checks the servers remotely and calls the internet provider, so if the problem turns out to be the line, we know before anyone arrives. “I’d rather we were already on our way,” says Adam. For most clients, we’re never more than an hour away.
The visit costs nothing extra. “Unlimited support should mean unlimited support,” Adam says. “It shouldn’t be, well, it’s unlimited when you call us, but if you actually need us to come to site, we’re going to need to negotiate the rate first.”
Prevention matters as much as response. Every client has endpoint detection and response (EDR), an advanced form of antivirus, included by default whatever their contract, because Adam considers it irresponsible to leave it out. To date, no Noble IT client has been breached.
Adam’s description of what clients want is simple. Whether it’s the Finance Director, the Operations Manager or, in a smaller business, the MD, they want to get on with their own job and trust that their IT will work. That means a team that can do its work, data that’s secure, and a bill that isn’t more than it should be.
It’s why our clients stay. We have 100% client retention, and when we ask what makes the difference, the answers sound like this one:
“Being able to talk to a person who cares and understands our business.” Jo Robinson
Adam’s advice for anyone comparing IT proposals is to get a little more savvy before signing, whether you choose us or someone else. “There are plenty of reputable IT companies out there who will do a great job for you,” he says. The point is knowing enough to tell them apart from the ones that won’t.
Two proposals can look almost identical on paper. If one is £30 per user and the other is £25, the cheaper one might be the right choice, or it might cover far less. Ask what’s included in the service levels, whether on-site visits cost extra and who is actually doing the work. Look the company up on Companies House too. A business that launched six months ago and runs from one person’s shed may struggle to deliver what it’s promised.
At the other end of the market, Adam has seen large providers whose salespeople will promise anything to win a contract. “Yeah, we’ll fly you to the moon,” as he puts it. Once the contract is signed and the commission paid, the salesperson moves on and an account manager takes over, often with a brief to sell you more. Promises that never made it into writing tend to disappear at that point. If something matters to you, make sure it’s in the contract.
Every high-profile incident is followed by a wave of IT companies offering products to stop it happening to you. In October 2026 alone, ASOS confirmed a breach, TFG London reported a cyber incident affecting Phase Eight, Hobbs and Whistles (Help Net Security), and H&M began investigating claims of a hack (Cybernews).
Many of the products sold off the back of headlines like these have nothing to do with how your business works. If the breach involved a till system and you don’t use tills, it isn’t your risk. “You don’t need to spend a million pounds,” says Adam. “You just need to protect the right things.”
We’re based in Oxford and work with businesses across Oxfordshire, so we can be on site when it matters. We also support clients across the UK and as far afield as Scotland and Africa, because understanding how a business works counts for more than being round the corner from it.
An IT consultant reviews how your technology supports your business, identifies risks and wasted spend, and builds a plan for what needs to change. At Noble IT that starts with a 360 IT Review and becomes a 12, 24 or 36 month roadmap, which a named consultant then delivers and manages.
No. Consulting is built into our managed service, alongside the help desk, network operations centre and security operations centre. Clients on the Managed IT Partnership have a named technical consultant who owns their roadmap.
Managed IT support keeps your systems running and secure day to day. IT consulting decides what those systems should look like next year and what it’ll cost to get there. They work best when the same team handles both, because the people planning your roadmap can see what your systems are reporting.
You can say no. We’ll explain why we’ve raised it, and if you decide to accept the risk, we’ll mark that decision on your roadmap so it’s clear later that it was a choice.
Start with a 360 IT Review. We’ll talk to your management team, assess your setup layer by layer and show you what the next 12 to 36 months should look like. No obligations, just a straightforward conversation with someone who knows IT.
Book your 360 IT Review or talk to our team about IT management and consulting.