Notes on keeping infrastructure boring.
It is usually framed as a cost comparison, which is why it produces the wrong answer. What a single hire really costs, where internal genuinely wins, where outsourcing does, and the co-managed option most businesses never think to ask for.
The email that costs you money will not have a virus in it. It will look like a normal message from somebody you already deal with. What the modern scams look like, what SPF, DKIM and DMARC really prove, and why hosting your mail with Microsoft or Google moves the server but not the risk.
Most of the decision is made once you know who will use it. Specifying for Windows app users and for developers, the security baseline that does not change with company size, keeping the machine from being stolen, and what regulated environments add.
