What Technology Debt Looks Like

A real incident at a client of ours. Identifying details have been removed.

Technology debt is what builds up when nobody owns IT: settings nobody revisits, hardware nobody replaces, passwords nobody writes down. None of it stops anyone from working, which is why nobody goes looking. The bill comes due for whoever walks in next.

Here's what it looked like at a client we took over in October 2025. Remote Desktop on their server was open to the entire internet, and our monitoring found 50,000 attempted logins against it. Nothing about the network was documented. Nobody had the login to their switches. One of their firewalls was out of support, and it was the one letting Remote Desktop through.

Not one of those 50,000 attempts signed in. That's a small miracle.

The door nobody closed

Remote Desktop is the Windows feature that lets you use a computer from somewhere else. You see its screen and control its mouse and keyboard as if you were sitting in front of it. That's useful for working from home. Left reachable from the internet, it gives anyone, anywhere, a login screen to guess against, and the guessing tools never get tired.

One of the first things I did was install our monitoring agent on their server. It found the 50,000 attempted logins. Those weren't employees. They were automated tools on the internet guessing passwords.

At this client, Remote Desktop was open on both the server and the firewall. The firewall, the device that's supposed to decide what gets in from the internet, allowed anyone in the world the opportunity to get in.

I closed Remote Desktop on the server and at the firewall as emergency maintenance, then emailed the owner to tell them what I'd done and why. I offered to set up a VPN, an encrypted connection for reaching the office network from outside, but they didn't need remote access at the time. We have remote access set up for them now.

Nothing was written down

Closing one door is easy once you know it's open. The harder question was what else was open, and nobody could tell me, because nothing about the network was documented. There was no diagram, no list of equipment, and no record of who set anything up.

So I went and looked. The network was a mix of unmanaged switches, the plug-and-play kind with no settings to log into, and switches that may have been managed, except nobody had the login. Later, while I was replacing the switches, I logged into one of the managed ones to check. It was still on the factory default password.

One of the firewalls was out of support. The manufacturer no longer sent it updates, and its threat detection was out of date. It was also the firewall passing Remote Desktop through to the internet. The one device that wasn't keeping up with new attacks was the one holding the door open.

Paying it off

When I took over, every fix started with detective work. I had to find the devices, recover the passwords, and figure out what was exposed before I could improve anything. That's the interest on technology debt, and the new person pays it before any real work starts.

What to check at your own business

• Can anyone reach Remote Desktop on your server from outside the building? If someone works remotely, ask exactly how they connect.
• Is there a current list of your network equipment: firewall, switches, wireless?
• Does someone at the business have the admin password for each of those devices, written down where the business controls it?
• Is your firewall still supported by its manufacturer, and is its security subscription current?
• When your last IT person left, did anyone write down what they knew?

If nobody at your business can answer these, it's because nobody has been assigned to know, and that's the first gap to close.

Want a second set of eyes on yours? Book 15 minutes with us: https://www.tech360solutions.com/review

Tech 360 Solutions provides managed IT and cybersecurity for small businesses in the Kansas City metro. Built for HIPAA, FTC Safeguards, and other regulated environments.