Case Study: How One Marketing Agency Turned a Cyber Crisis into a Recovery Success

Mike Pearlstein is CEO of Fusion Computing and holds the CISSP, the gold standard in cybersecurity certification. He has led Fusion’s managed IT and cybersecurity practice since 2012, serving Canadian businesses across Toronto, Hamilton, and Metro Vancouver.

Cyber crisis recovery is the process of restoring business operations after a ransomware attack or major security incident. With verified backups and a tested incident response plan, most businesses can recover critical systems within 24–48 hours. Without them, recovery can take weeks and may require paying ransom with no guarantee of data return.

Introduction

An Ontario-based marketing agency with long-standing client relationships faced a major operational disruption after a cybersecurity incident interrupted day-to-day work. The incident was serious, but the deeper issue was what it revealed: the agency’s existing IT environment was not as resilient, well-documented, or recovery-ready as leadership believed.

This isn’t primarily an incident-response story. It’s a transition story: what happens when a business discovers that its IT foundation is weaker than expected, and what it takes to rebuild with the right partner.

This case study is based on a real Fusion Computing engagement. Client details have been anonymized, and certain technical details have been generalized for privacy.

The Challenge: A Fragile Environment and Too Much Assumption

After the incident, the agency needed more than cleanup. It needed clarity. Leadership wanted to understand what had failed, what could be recovered, and whether the existing environment could be trusted going forward.

Fusion Computing was engaged to assess the situation. The review identified several issues that increased operational risk:

• Backup and recovery readiness was not where it needed to be. The agency didn’t have the level of verified, testable recovery capability leadership expected at the time of the incident.
• There was no practical disaster recovery roadmap. Recovery steps were not documented in a way that supported a fast, structured response.
• The virtual server environment had become unnecessarily fragile. Over time, the infrastructure had grown more complex and harder to support, making maintenance, troubleshooting, and recovery more difficult.
• Documentation and governance were limited. Leadership didn’t have clear visibility into how systems were configured, who had access to what, or how resilience would be maintained going forward.
• Technology planning had become reactive. Instead of a roadmap tied to business goals, the environment had evolved through incremental fixes and short-term decisions.

The agency was not just looking for a provider that could respond to tickets. It needed a partner that could restore confidence, reduce operational risk, and put structure around future decisions.

Warning Signs Your MSP May Be Underperforming

One reason this story matters is that the agency’s situation isn’t unusual. Fusion often sees similar patterns when reviewing environments that have been managed without enough rigor or strategic oversight.

• No recent verified restore test. A backup dashboard isn’t the same as proof that recovery works.
• Weak or outdated documentation. If there’s no current network diagram, asset inventory, permissions record, or vendor map, your provider is operating with limited visibility.
• No regular business reviews. Managed IT should include structured conversations about lifecycle planning, budget priorities, risk, and upcoming change.
• Recurring issues that never truly go away. Repeated email, performance, connectivity, or permissions problems often signal weak root-cause ownership.
• No clear answer on security basics. If your provider can’t explain MFA status, endpoint protection coverage, backup scope, and administrative access controls in plain language, that’s a problem.

Fusion Computing’s Approach

Rather than trying to preserve a design that leadership no longer trusted, Fusion proposed a structured rebuild focused on resilience, simplicity, security, and operational clarity.

Phase 1: Assessment and Stabilization

The first step was a full cybersecurity assessment and environment review. Fusion mapped systems, user access, dependencies, and operational gaps so leadership could see the current state clearly. Immediate stabilization work focused on reducing business risk and supporting continuity while the long-term plan was developed.

Phase 2: Modernization and Rebuild

Once the environment had been assessed, Fusion designed a cleaner, more supportable foundation. The modernization plan included:

• Retiring the legacy virtual server design in favor of a simpler and more resilient operating model.
• Migrating core collaboration workloads to Microsoft 365 to improve access, collaboration, and continuity while reducing dependency on aging infrastructure.
• Implementing stronger security controls including MFA, endpoint protection, email security, and a backup strategy built around validation and recoverability.
• Creating clearer documentation so leadership had better visibility into assets, access, dependencies, and operating standards.

Phase 3: Governance and Strategic Oversight

Fusion didn’t position the rebuild as the end of the engagement. Ongoing vCIO strategy sessions were established to help leadership make more deliberate technology decisions around risk, lifecycle planning, vendor accountability, and future growth. The goal was not just a more stable environment. It was a better operating model.

Business Outcomes

The result was a more stable and more manageable environment, with stronger recovery readiness and clearer executive visibility into IT. Key outcomes included:

• A more resilient operating environment built to better support day-to-day work, remote access, and collaboration.
• A clearer backup and recovery posture with greater emphasis on validation, documentation, and recoverability.
• A modernized Microsoft 365-based foundation that reduced reliance on fragile legacy infrastructure.
• Improved security baseline controls around identity, endpoints, and access management.
• Stronger planning cadence through ongoing strategic reviews instead of purely reactive support.

Just as importantly, leadership gained a better understanding of what good managed IT should look like: not just issue resolution, but accountability, documentation, planning, and risk reduction.

Why does This Case Study matter?

Many businesses don’t switch MSPs because of a single catastrophic event. They switch because confidence erodes over time. Documentation is thin. Strategy never happens. The same issues keep resurfacing. Backup confidence is assumed instead of proven. Security feels vague instead of concrete.

This engagement shows what a good transition can look like when a business decides it needs more than maintenance. It needs structure, leadership, and a better foundation for growth.

If you rely on an outside IT provider and you aren’t confident in your documentation, backup recoverability, security controls, or roadmap, it’s worth getting an independent view of where things stand.

Q. How can I tell whether my current MSP is really managing my environment?
A. Ask for evidence, not assurances. A strong provider should be able to show you current documentation, explain your security baseline, identify who has privileged access, and provide proof that backup recovery has been tested. If those answers are vague, that’s a warning sign.

Q. What should I ask before switching MSPs?
A. Ask how the new provider handles discovery, documentation, access transfer, backup validation, security baselining, vendor coordination, and executive communication. You want a structured onboarding process, not just a promise to “take over support.”

Q. How disruptive is an MSP transition?
A. A well-run transition should be planned to minimize disruption. The first priority is usually documentation, access control, and risk reduction. Remediation and modernization should follow a clear sequence rather than being rushed all at once.

Q. What happens to our data during an MSP transition?
A. Data protection should be addressed at the beginning of the transition, not later. That includes confirming backup scope, reviewing administrative access, validating recovery assumptions, and ensuring there’s a controlled change plan before major migrations begin.

Q. Can Fusion help modernize a legacy server environment?
A. Yes. Fusion works with businesses that need to move away from aging, fragile, or overly complex infrastructure and into a more supportable model, including Microsoft 365-based collaboration, identity hardening, and modern endpoint management. Learn more about Fusion’s managed IT support.

Q. Do you support marketing agencies and other creative firms?
A. Yes. Fusion supports professional services and knowledge-work organizations that depend on collaboration, remote access, application performance, and reliable day-to-day operations. The exact design depends on the firm’s workflow, risk profile, and growth plans. Fusion also provides cybersecurity services tailored to organizations handling sensitive client data.

Q. What role does vCIO or vCISO guidance play after onboarding?
A. Strategic oversight helps prevent the environment from drifting back into a reactive state. Regular review cycles improve prioritization, budgeting, vendor accountability, risk visibility, and decision-making for leadership.

Q. Should I get an assessment before changing providers?
A. In most cases, yes. An independent IT business assessment gives you a baseline before major changes are made. It also helps separate immediate operational risks from longer-term modernization priorities.

Q. What are the biggest red flags when inheriting IT from another provider?
A. Common red flags include incomplete documentation, unclear administrative access, untested backups, legacy systems without clear ownership, and recurring problems that were never resolved at the root cause level.

Q. How do I verify whether my backups are actually recoverable?
A. Ask for evidence of a recent restore test, not just backup job success reports. A recoverable backup should be documented, tested, and tied to clear recovery priorities for critical systems and data.

Q. Can Fusion work alongside an internal IT manager or team during a transition?
A. Yes. Some organizations want a full transition to a new managed provider, while others want outside expertise to support internal staff, reduce risk, and help modernize the environment in phases.

Q. How often should leadership review IT strategy after a transition?
A. Most organizations benefit from regular strategic reviews throughout the year. The right cadence depends on growth, compliance requirements, operational complexity, and how quickly the environment is changing.