ABC Disposal · 2026-05-19 · SVS MSP

Reducing the risk in how your team connects.

A 30-minute look at where ABC Disposal's perimeter and remote access sit today — and the simplest path forward.

2 · Where this started

You told us the VPN keeps causing pain. And the firewalls are getting old.

Drivers and dispatchers losing connection at the worst times.
The SonicWalls have been there a while — past their replacement window.
Your insurance carrier is asking sharper questions on renewal.

3 · What's forcing the decision now

Three things are converging this year.

Forcing function	What it means for ABC
April 2026 — SonicWall hardware end-of-support	No more firmware patches or support on your current units. The unit becomes a known-vulnerable internet edge device.
SonicWall SSL-VPN under active attack (2024–2026)	The ransomware group Akira has been breaking into companies through this exact product line — including cases where MFA was bypassed.
Your cyber-insurance renewal	Insurers are now flagging SonicWall SSL-VPN by name in their questionnaires. Hard to attest cleanly.

What to say

"Three things are forcing this conversation now, not a year from now. First, your firewall hardware reaches end of support in April 2026 — that's not us, that's SonicWall's published lifecycle. Second, the remote-access piece of that same product has been actively exploited for the last 18 months by a ransomware group called Akira. Third, your insurance carrier is asking direct questions about it on renewal. None of these are theoretical."

Watch for

The owner may not have known about Akira specifically. Don't dwell — name it, link the dots to insurance, move on. If the ops manager nods on the insurance line, they've already seen the questionnaire.

If pushback here

"Has anyone actually been hit?" — Yes, hundreds of small/mid businesses. CISA put the underlying flaw on its known-exploited list. We can share that link.

4 · The cost of staying

The biggest cost isn't the hardware. It's the insurance answer.

Coalition reports that 82% of denied cyber-insurance claims involved gaps in how multi-factor authentication was actually implemented — most commonly on remote access.

That is the exact configuration ABC Disposal has today.

What to say

"This slide is the most important one in the deck. Coalition — one of the biggest cyber-insurance carriers — published that 82% of denied claims came down to multi-factor authentication being on paper but not actually enforced on the remote-access door. SonicWall SSL-VPN with a RADIUS bolt-on is the textbook version of that gap. If ABC has a claim someday and the investigation finds that pattern, the claim doesn't pay. That's the real cost of staying."

Watch for

Silence here is good — they're absorbing it. Do NOT fill the silence. Wait. The ops manager will likely glance at the owner. The owner will likely say something like "well, our MFA is on, right?" — that's your cue to clarify: yes, it's on, but on the SonicWall SSL-VPN service, which is the documented bypass pattern.

If pushback here

"That's just one carrier" — Coalition publishes the most-cited claims data in the industry; same pattern shows up in At-Bay, Travelers, Corvus reports. We can send links after.

5 · What we recommend

Replace the SonicWall fleet with Cytracom Control One.

One system, all three sites. No more SSL-VPN. Insurance answer becomes a clean "yes."

Cytracom is a Canada/US-only platform built specifically for managed-service providers and the businesses they support.

6 · Why this, for ABC specifically

Four things, tied to what you've actually said.

What you've told us	What Control One does about it
"The VPN keeps giving us trouble."	No more VPN. Replaced with an always-on connection per user, identity-bound.
"Insurance is asking harder questions."	Single console, single audit trail, MFA enforced structurally — clean attestation across all 3 sites.
"I don't want to keep buying firewalls every few years."	One monthly fee per user includes the hardware. No separate renewals to track.
"We can't keep up with patch alerts."	Cytracom patches the platform. SVS isn't on the hook for firmware advisories. Neither is your team.

7 · What it costs

The dollars, plainly.

Picture (3 years, ~100 users, 3 sites)	Stay on SonicWall	Move to Cytracom Control One
3-year total, all-in (CAD, estimated)	~$57,600 – $91,400	~$76,500 – $127,800
Year-1 cash outlay	~$26,000 – $40,000	~$26,500 – $43,500
Separate VPN + MFA bill	Yes (Duo or similar)	None — included
Firewall replacement again in 5 years	Yes	No — hardware refreshed by vendor

Estimates. Final pricing requires a Cytracom partner quote for ABC's exact user count. CAD converted from USD at ~1.37.

What to say

"Plain numbers. Over three years, Control One costs somewhere between $15,000 and $35,000 more than continuing on SonicWall. That's the honest dollar premium. But notice the year-1 column — they're almost the same. So this is not a big up-front spend; it's a slightly higher operating cost in exchange for one bill, no separate VPN and MFA invoices, no surprise renewals, and no need to do this exercise again in five years."

Watch for

The cost slide is the slide where the owner does silent math. WAIT. Do not fill the silence. They will either ask a clarifying question or move on. Filling the silence signals nervousness about the number.

If pushback here

"That's a lot more money." — Acknowledge it's a real premium. Frame: "The Akira ransomware events ran businesses hundreds of thousands of dollars when the insurance claim got denied. The $15K–$35K over three years is the price of removing that specific exposure from the table."

"Can you go cheaper?" — We can pilot one site first to validate before committing the full fleet. That's the next-step option on slide 11.

8 · How we'd do it

About four weeks. Calmly. Satellites first, head office last.

Week	What happens
1	Discovery + identity setup. No disruption to your team.
2	Pilot at the smallest site + a handful of volunteer users. Run alongside SonicWall.
3	Roll out to your two satellite sites, one at a time. Old VPN stays available as backup.
4	Head office cutover on a Saturday. SonicWalls stay on standby for one week, then decommissioned.

What to say

"Four weeks. We start the smallest, lowest-risk parts first and finish with the head office on a weekend. Nothing happens to your operations during week 1. The pilot in week 2 runs alongside the existing setup, so even if something goes sideways, nobody loses their connection. By the time we cut head office, we've already done the playbook twice at the satellites. Old SonicWalls stay powered on as a rollback safety net for one week after."

Watch for

The ops manager is likely the person worrying about this slide — direct eye contact with them here. If they cross their arms, ask: "What part of this concerns you most?" Listen for 30 seconds before responding.

If pushback here

"We can't have downtime." — There's no scheduled downtime in this plan. The only at-risk window is the Saturday HQ cutover, and the old system is the rollback. We use parallel-run patterns, not big-bang cutovers.

9 · What could go wrong

The three real risks. And what we do about each.

Risk	What we do about it
A remote driver or dispatcher loses access mid-cutover.	Agent installed 5+ business days before old VPN goes away. One break-glass VPN account kept for 7 days as backup.
A specific business app reacts badly to the new inspection model.	Discovery week identifies cert-pinned apps. Bypass list pre-staged before cutover.
Project slips past 30 days because hardware ships late.	Order hardware day 1. ISP coordination scheduled in week 1. Contingency built into the plan.

What to say

"I want to be honest about what could go wrong. Three things. One — somebody on the road loses access at the wrong moment; we mitigate that by installing the new client well before turning the old VPN off and by keeping a backup account live for a week. Two — some specific business app doesn't like the new way traffic is inspected; we identify that in week 1 and pre-stage a bypass. Three — hardware shipping or the ISP slows us down past 30 days; we order day one and we've built contingency in."

Watch for

This slide buys more trust than the recommendation slide. Naming the real risks specifically — not generic "every project has risk" hedging — makes the rest of the deck credible. Owner may visibly relax here.

If pushback here

"What if the new system itself just doesn't work?" — Pilot week. We validate at the smallest site with volunteers before touching the fleet. If the pilot tells us this is the wrong fit, we stop and reassess. The pilot is the controlled bet.

10 · Why now

The renewal window and the EOL window are the same window.

If we move in the next 30 days, ABC walks into the next insurance renewal with the strongest possible answer on the question carriers actually deny claims over.

If we wait, the SonicWall hardware drops out of support in April 2026, and the renewal happens with the current architecture.

What to say

"Why now and not next quarter. Two windows are closing at the same time. The hardware is going end-of-support in April 2026 — that's not negotiable, it's SonicWall's calendar. And the insurance renewal happens whether we're ready or not. If we move in 30 days, the renewal application looks great. If we wait, we're filling out the same questionnaire with the same exposure we've been talking about."

Watch for

This is where the owner decides emotionally. Watch for the moment they look at the ops manager. That's the silent decision moment. Don't talk over it.

If pushback here

"Can we wait until after fiscal year end?" — Ask when the insurance renewal lands. If it's before then, this is the leverage. If it's after, a phased plan is possible — but the hardware EOL still pushes us into Q1 2026.

11 · Next step

One small step, not a big commitment.

A 1-week discovery and pilot-design engagement at a fixed fee. We map your environment, design the policy, and give you a firm fixed-fee quote for the rest. No commitment beyond that week.

If after week 1 the numbers or the plan don't sit right, we stop. You keep the discovery document either way.

What to say

"We're not asking you to commit to the whole project today. The next step is a one-week discovery and pilot-design engagement at a fixed fee. We come in, we map what's actually deployed, we design the new policy and the migration sequence, and at the end of that week you have a firm fixed-fee quote and a clear plan. If at that point you want to stop, you stop — and you keep the discovery document."

"We'll act as your advisor and implementation lead. Day-to-day operations remain yours, with our ongoing support. As a first step, the pilot-design week is the lowest-risk way to validate this is the right move for ABC."

Watch for

If the owner looks at the ops manager and nods, you have a yes — close the loop with: "Great — I'll send the discovery SOW tomorrow morning. Can we book the kickoff for the following Monday?"

If the owner says "let me think about it" — agree, and book the follow-up before leaving the room. "Of course. Can we put 30 minutes on the calendar for next Wednesday to decide?"

If pushback here

"Send me a proposal." — Confirm specifically what they want in the proposal and when they need it. "Happy to. Just so I get it right — do you want the discovery SOW only, or the full-project fixed-fee scope as well? And when do you need it?"