The Hidden IT Risks Facing Los Angeles Businesses

The biggest IT risks for Los Angeles businesses rarely look like attacks. They look like one person holding every admin password, backups nobody has restored, Windows 10 machines past support, and a single power or internet line that stops the office cold.

Ask a room of executives about IT risks Los Angeles businesses face and you'll hear ransomware, phishing, maybe a data breach. Fair enough. Those are real, and they make the news. But the risks that actually take a company offline for a week usually sit somewhere quieter, inside an arrangement that has worked fine for years. Nobody flags them because nothing has gone wrong yet. That's the whole problem. A risk that works until the day it doesn't never shows up on a budget, a board slide, or the agenda for your managed IT services in Los Angeles review. It shows up on a Tuesday morning when the one person who knows the firewall password is on a plane.

What makes an IT risk "hidden"?

A hidden IT risk is a weakness that causes no symptoms until it fails. It isn't a known problem waiting for budget. It's an arrangement everyone assumes is fine, like a backup job that reports success or an admin login only one person knows, that nobody has tested against a bad day.

IT risk and cybersecurity risk overlap, but they aren't the same list. Cybersecurity risk is about someone trying to get in. IT risk is broader. It covers anything that can stop your operations, including a dead circuit, a lost password, an expired license, or a regulator asking for paperwork you don't have.

Executives tend to fund the first list and ignore the second. Why? Attacks are easy to picture. A single point of failure isn't.

Does one person hold all the keys?

In a lot of companies, the honest answer is yes. One employee, or one outside technician, holds the Microsoft 365 global admin login, the domain registrar account (the company your web address and email domain are registered through), the firewall password, and the only copy of the network diagram. Usually it's whoever set things up 8 years ago.

Nothing about that is malicious. It's just how small IT environments grow. Someone capable takes care of things, and over time the business stops asking where the keys are kept.

Then that person quits, retires, gets sick, or stops returning calls over a billing dispute. Picture the domain for your company email registered to a former employee's personal Gmail. Renewal notices go to an inbox nobody can open. When the domain lapses, your email stops. Not hacked. Just gone.

Boring fix. Cheap, too. Make a written inventory of every admin account, every registrar, every vendor portal, and who can get into each one. Put at least 2 named people on every critical login, store the credentials in a password manager the company owns, and turn on multi-factor authentication (MFA, the code or app prompt that confirms a login) for all of them. You can do the first draft in an afternoon.

When did anyone last restore a backup?

A backup that has never been restored is an assumption, not a recovery plan. The dashboard can say "success" every night while the job quietly skips a database, backs up a folder nobody uses anymore, or writes to a drive sitting 3 feet from the server it's protecting.

Attackers know where backups live, too. In Sophos's State of Ransomware 2025, which surveyed 3,400 IT and security leaders in 17 countries, the average recovery cost after an attack was $1.53M, and victims named an average of 2.7 operational gaps that contributed to getting hit. Weak or untested backup is the kind of gap that turns a bad day into a bad month.

Here's what a real test looks like:

• Pick one system that matters, like your accounting database or file server, and restore it somewhere safe.
• Time it, start to finish. That number is your real recovery time, whatever the contract says.
• Have the person who uses that system confirm the data is complete and current.
• Write down what broke, then do it again next quarter with a different system.

Our guide to disaster recovery testing goes deeper on test schedules. If you're comparing providers, here's what to expect from backup and disaster recovery services in Los Angeles.

Are you still running Windows 10?

Microsoft ended support for Windows 10 on October 14, 2025. Those PCs still turn on and still run your software, which is exactly why they slip through. They just stopped getting security fixes unless you pay for them.

Microsoft's paid Extended Security Updates (ESU) program keeps patches coming for business PCs, but the price climbs. Year One was $61 per device. The price doubles each year for up to 3 years, and the years are cumulative, so a business that skipped Year One and buys in now pays for both. Year One coverage runs out this October. If you've got 40 Windows 10 machines left, the Year Two bill is $4,880 before you've bought a single new laptop, and it'll be $9,760 a year after that.

Worse are the PCs nobody enrolled. Sophos found exploited vulnerabilities, meaning unpatched software flaws, were the top root cause of ransomware attacks at 32%, ahead of stolen credentials at 23%. An unpatched machine on your network is an open door that's been documented publicly.

Count them. Your IT lead should be able to tell you within a day how many Windows 10 devices are still active, which ones are enrolled in ESU, and when each one gets replaced. If that answer takes a week, that tells you something about your patch management too.

What happens when the power or internet goes out?

On January 8, 2025, Southern California Edison had 176,857 customers under public safety power shutoffs, the planned outages it uses to keep power lines from sparking fires in high winds. 40,573 of them were in Los Angeles County.

Shutoffs usually come with some warning. Plenty of offices have no plan for using it.

Walk your own office and ask a few questions. Does the server closet have a battery backup (a UPS), and how many minutes does it actually last? Does the phone system run over the same internet line as everything else? Is there exactly one internet circuit coming into the building, from one carrier, through one conduit? If a backhoe two blocks over cuts that line, can your team work from home, and do they know that's the plan?

Adding a second internet connection from a different carrier, a cellular backup connection that kicks in when the main line drops, and cloud-hosted phones costs far less than a day of 30 people sitting idle. The tradeoffs between connection types are in our comparison of dedicated internet vs. broadband for LA businesses.

Could your business run if the building couldn't?

Los Angeles stacks 2 continuity risks on top of each other, earthquakes and wildfire.

January 2025's wildfire numbers are still settling. A study for the LA County Department of Economic Opportunity and LAEDC estimated more than 6,800 businesses and 47,000 workers were affected, with $5.2B to $10.1B in lost economic output. "Affected" covers a lot more than burned buildings. Businesses in and around the burn areas lost access, power, customers, and staff who suddenly had nowhere to live.

Earthquakes are the slower bet. The Southern California Earthquake Center's UCERF3 forecast puts the expected frequency of a Northridge-size quake, magnitude 6.7 or larger, somewhere in California at about one every 6.3 years. You won't get a warning for that one.

For both, the question isn't "are we insured." It's which systems you need running by Monday if the office is closed for a month, and whether they can run from somewhere else. If your ERP (the main system for orders, inventory, and accounting), file shares, and phone system all live in one closet in one building, the honest answer is probably no. A business impact analysis is the structured way to rank those systems before you need the list.

Is email fraud a bigger threat than ransomware?

By reported dollars, yes. Business email compromise (BEC), where a criminal impersonates a vendor or executive to redirect a payment, cost victims $3.05B in reported losses in 2025, according to the FBI's 2025 Internet Crime Report. Reported ransomware losses were about $17M. The FBI notes that the ransomware number is artificially low because it leaves out lost business and recovery costs, so treat the comparison as rough. Still. A 175x gap is hard to argue away.

California led every state in that report, with 116,414 complaints and $3.67B in total reported losses. The FBI also tracked more than $30M in BEC losses in 2025 where the scam used AI, mostly in the form of fake emails that read like the real thing.

Of the cybersecurity risks LA businesses face, BEC is the one that slips past security tools, because nothing technically breaks. An email from your real vendor's real account, hijacked last month, asks your accounts payable clerk to update the bank details. The clerk does. Your firewall saw nothing wrong.

Your defense here is a process, and it only works if it's written down. Any change to payment instructions gets verified by phone, using a number you already had on file and not one from the email. Larger wires need a second approver. Then there's the technical side, MFA on every mailbox and alerts on new inbox forwarding rules, which is where a managed cybersecurity services team earns its fee.

How many apps does your company actually pay for?

Ask finance for every recurring software charge on the company cards for the last 12 months. Then ask IT how many of those apps it manages. The two numbers rarely match.

That gap is shadow IT, meaning software employees signed up for on their own. A project tool here, a file-sharing account there, an AI note-taker someone connected to the whole company calendar. Each one holds company data and sits outside your security settings.

The quieter risk is offboarding. When someone leaves, IT turns off their Microsoft 365 account. But what about the Dropbox they set up with their work email, the Canva team they own, or the admin seat on your payroll portal? Those often stay live for months. Sometimes years.

One page closes most of this, an offboarding checklist that lists every SaaS (cloud subscription) app and not just email. More on spotting the apps you don't know about in our post on handling shadow IT.

Is California privacy law raising the bar for you?

If your business is large enough, yes, and on a fixed schedule. The California Consumer Privacy Act (CCPA) applies to for-profit businesses that meet one of several tests, the most common being annual revenue above $26,625,000 through 2026.

New regulations from the California Privacy Protection Agency add real deadlines. According to Hunton Andrews Kurth, risk assessments for certain data processing began January 1, 2026. Covered businesses that need a cybersecurity audit must certify it by April 1, 2028 if revenue is above $100M, April 1, 2029 at $50M to $100M, and April 1, 2030 below $50M.

April 2030 sounds far away. It isn't, if your environment can't produce an asset inventory or an access review today. Those are IT records, and an audit will ask for them.

One note on how this work gets done. Compliance readiness is its own engagement, separate from day-to-day IT support. A managed IT provider keeps systems patched and backed up, and that helps, but it doesn't produce the assessments and policies a privacy regulator asks for. Our overview of California privacy laws for LA businesses covers who's in scope.

Which of these would stop you for a week?

Not all 8 risks carry the same weight for every business. A 15-person design studio with everything in the cloud worries less about the server closet and more about who owns the Google Workspace admin account. A distributor with a warehouse management system on a server in Commerce has the opposite problem.

Take this table into a 20-minute meeting with whoever runs your IT, inside or outside. The middle column is what to ask. The right column is what a good answer sounds like. If any answer is "I'd have to check," that's the one to fix first.

Two or more fuzzy answers usually mean the gaps aren't technical. They're structural. Nobody owns the list. A formal IT assessment is one way to get the full picture in writing.

Consilien is a security-first managed IT and IT advisory firm, headquartered in Torrance, that works with businesses nationwide. Any new environment we take on starts roughly the same way. Write it down, give every item an owner, and rank it by what would hurt most. If you'd rather not run the 20 minutes alone, speak to an IT expert and bring your answers.