Managed IT · San Diego · Since 1998
Done means
we checked.
Most IT providers count a repair as finished when the script exits. We count it when we go back to the machine afterwards and find it still fixed. Those are different numbers, and ours is the smaller one — it is on your monthly report next to everything we could not confirm.
Or call (XXX) XXX-XXXX and talk to the person who has run this since 1998.
What every change passes through
- Signed skill librarynothing else can execute
- Maintenance windowenforced in the dispatch path
- Circuit breakerhalts the fleet on repeated failure
- Kill switchper client, on request
- Run ledgerevery tool call, input and output
A diagram, not a live feed — the pulse traces the path, it does not report data. Real numbers live in your console, behind your sign-in, where they belong.
1998
Founded in San Diego, by the person who still answers the phone
7,500+
Mailboxes migrated to Microsoft 365 — during the Office 365 years
$0.00
What patching cost on our 2014 price list, and still costs
Every run
Logged with its full tool trace and its model cost
How it works
Connect. See. Decide. Account.
Four steps, and the fourth is the one nobody else offers. Most providers will tell you what they concluded. We can show you the tool call, the arguments it passed, and the raw output it got back.
Connect
Two approve-by-link grants from your own administrator: Microsoft 365 admin consent, and an Azure Lighthouse delegation. No password changes hands, nothing is installed in your directory to make it work, and you can revoke either one without asking us.
See
Discovery walks the estate — licensing, Intune devices, Arc servers, open incidents — and a cross-platform endpoint agent reports health, software inventory, known vulnerabilities and configuration posture from every machine it is installed on.
Decide
Claude Opus 5 agents read that signal and decide what should happen. Each has a scoped tool surface, each consults what it already knows about the device, and each ends with a summary naming specific machines rather than a severity count.
Check
Seven days later we look at the machine again. If the fix held, it counts. If it came back, that is a different and more interesting fact than a failure, and something is undoing our work rather than the work being wrong. If the machine has not reported since, we say so instead of counting it — which is why the number on your report is smaller than the number of repairs we ran.
Account
Every run is written to a ledger: which agent, what triggered it, every tool call with its exact input and output, whether it ran inside the maintenance window, and what the model spend was. You can read the trace, not just the conclusion.
While you sleep
The 2am your phone
sleeps through.
This is one disk-filling problem travelling the whole machine: noticed by trend before it is an outage, cleared by a procedure that has earned the right to run unattended, executed inside your window, and only counted a week later — when the machine itself agrees it stayed fixed.
It is labelled a dramatisation because the real ledger carries real device names, and those belong to clients. What makes it worth watching is the part nobody else prints: the file names. Every line is a code path that ships in this platform today.
the night shift — one fix, start to finish
dramatised · every line is a shipped code path
- 02:07custodianSRV-ACCOUNTS: disk C: filling at 2.9%/day — full in roughly 9 days.internal/monitor — a least-squares trend over a week of samples, not a "90% full" threshold
Dramatised because the real ledger carries real device names, and those belong to the client. The live version — with your machines on it — is in your console, behind your sign-in, down to each tool call and what it cost.
Change control
Every change is tested, scheduled, and logged.
Good IT operations have always run on change control: an approved set of procedures, a scheduled window, a staged rollout, and a record of exactly what happened. None of that is new, and none of it is negotiable. What is new is that every one of these is enforced in code on every single change — so the discipline holds on the four hundredth device at 2am as reliably as it does on the first.
Only tested, signed procedures run
Every remediation is a script that was written, reviewed and cryptographically signed before publication, then verified again on the device immediately before it executes. The complete set of actions capable of running on your estate is a published, versioned list you can read end to end. Nothing improvises on your machines.
Change happens in your window, not ours
Read-only checks run continuously, because looking never hurts. Anything that alters a machine waits for the maintenance window you set, and that boundary is enforced in the dispatch path itself — every change is checked against it before it is issued. Work that will not finish cleanly before the window closes waits for the next one rather than being left half-done.
Nothing reaches everyone at once
Changes roll out in stages, and windows are staggered across clients by design. When a vendor ships a bad update — and they do — repeated failures halt fleet-wide work automatically before the next group is touched. This is ordinary staged-rollout discipline. The difference is that it triggers in seconds, without depending on someone noticing in time.
Nothing runs on its own until it has worked here
A procedure does not arrive trusted. On your estate it starts by proposing, moves to running with approval, and only runs unattended after it has worked on several of your machines and been independently re-checked afterwards. One failure puts it back. The number of procedures running on their own is on your monthly report, and it should grow — that is the relationship getting cheaper to run rather than a claim we made at the start.
You can pause everything, in one click
A change freeze, an audit, month-end close, or simply a week you would rather nobody touched anything: one control in your console stops every change to your estate immediately. Monitoring and reporting carry on as normal. No ticket, no phone call, and no waiting on us to action it.
And you can revoke us without asking us.
Access comes from two grants your administrator makes: an enterprise application in your directory, and an Azure Lighthouse delegation on your subscriptions. Removing either takes a few clicks in your own portal, with no notice to us and no cooperation from us. That is the property that makes this defensible in a security review — not a clause in a contract, but the fact that the off switch is on your side of the table.
What we replace
Two vendors, two invoices, two people to chase.
Small firms end up buying an MSP, then a security service, and each points at the other when something goes wrong. Here is the same capability from one provider, with the things neither of them offers marked out.
| Capability | Traditional MSP | MSSP / AI-SOC | DataGuys |
|---|---|---|---|
| Runs your day-to-day IT | Yes | No | Yes |
| Patches OS, third-party apps and firmware | Sometimes | No | Sometimes |
| Watches Defender XDR incidents | No | Yes | Yes |
| Onboards in minutes, by approve-by-link | No | Sometimes | Yes |
| Every action recorded with its full tool trace | No | No | Yes |
| Only signed remediations can ever execute | No | No | Yes |
| Change bounded by a maintenance window in code | Sometimes | No | Yes |
| Circuit breaker and a per-client kill switch | No | Sometimes | Yes |
| Per-run cost shown to you, not just to us | No | No | Yes |
| You can revoke our access without asking us | No | No | Yes |
| One provider, one invoice | No | No | Yes |
The fleet
Five agents. Every tool they hold, listed.
Five, not eight — these are the ones that run. Each is a Claude Opus 5 loop with a named tool surface, and the surface is published below because “what can this thing actually do to my estate” deserves an exact answer rather than a reassuring one.
Onboarder
read-onlyFirst surveyWalks a newly connected estate and writes down what matters, so every later run starts informed rather than blind. It has no dispatch tool at all — deliberately. This is a survey, and a survey that changes things is not a survey.
- Establishes what is here: devices, servers, operating systems
- Finds what is actually behind — unpatched builds, EOL operating systems
- Records only durable facts, not "disk at 72%" that expires next week
- Produces a briefing an engineer can read in two minutes
Everything it is allowed to reach for
- list_devices
- get_device
- list_posture_findings
- list_vulnerabilities
- list_incidents
- list_skills
- check_window
- remember
- record_finding
The surfaces are scoped per agent so every call in the ledger is attributable to a role with a stated purpose — a malfunction has a signature, and “why did something touch this server” has an answer. The gate that actually bounds behaviour is the maintenance window, enforced in the dispatch path rather than in prompt text.
Designed, not running
not built yetThese are specified and not shipped. They are listed here rather than alongside the roster because the distinction is the point: the five agents above run today and produce entries in a ledger you can read, and these three do not exist yet.
Concierge
The helpdesk that does not sleep
The work a first-line technician does all day: installing software from vendor sources rather than whatever a search returns, setting up and repairing Outlook profiles, chasing the causes of the same five recurring complaints. One instance per client, so it accumulates that client’s particular quirks instead of starting cold every time.
Watchman
Service and circuit monitoring
What a Nagios or PRTG install does, without the install: reachability, service checks, disk and memory thresholds, and ISP circuit health — because "the internet is down" is the single most common ticket an MSP takes and the one it currently has least evidence about.
Advisor
Refresh and roadmap
Turns accumulated inventory into a recommendation: which hardware is past useful life, which licences are being paid for and not used, and where a small custom piece of work would remove a recurring manual task. Priced per project rather than per seat.
The part most providers charge extra for
Patching, in the base rate. Same as 2014.
Patch Management was $0.00 on the DataGuys price list in 2014, and it is still bundled now. A managed service that leaves the single most important maintenance task as an optional extra is not really managing anything.
Nothing goes out unstaged. Routine updates soak across consecutive weekends — canary, then a fifth of the fleet, then the rest — which is a better soak than compressing three rings into six hours, not a worse one. An actively exploited CVE gets the compressed track instead, and which track applied is recorded.
Nothing is started that cannot finish before the window drains. A half-patched server at midnight is the specific failure this is designed against.
Windows operating systems
Through the Windows Update Agent API, honouring WSUS approvals where you have them
Linux
Signed shell skills, same ledger, same window
Reboots
Reported, never taken. The scheduler decides when a machine goes down
Drivers
Deliberately excluded from automatic installs — the most common way a patch run bricks a machine
Sequencing
Canary, then a fifth of the fleet, then the rest — soaking across consecutive weekends
Actively exploited CVEs
Compressed rings inside a single window, because three weeks is too long
What we are not claiming
The parts that are still early.
Every provider in this category has a gap between the deck and the product. Here is ours, before you find it yourself.
A 24/7 room full of people
There is not one, and we are not going to imply there is. What runs overnight is software. What you get at 7am is a person who has already read what it did.
Third-party and firmware patching
Designed and specified, not shipping. Today the automated patch path is operating-system updates; browsers, Adobe, Java and vendor BIOS are handled the old-fashioned way until the package catalogue is built.
An agent that can fix anything you ask it
It can fix what is in the signed library, which today is sixteen procedures — printing, mail sign-in, disk space, network name resolution, and the configuration work. Ask it for something outside that and it will tell you plainly that a person is needed, rather than improvising. The library grows from the work: when the same problem is solved by hand several times, a procedure for it gets written and signed.
A long client list
The company is twenty-seven years old; this platform is not. The testimonials below are from clients of the years before the rebuild, and they are labelled that way.
Partner brand
ClarityXDR
Designed by humans, operated by AI.
Know your attack surface. Then have AI actually attack it.
Running and defending an estate tells you it is healthy. It does not tell you it is defensible. ClarityXDR is a sister brand — a separate service, bought separately — that finds what you are actually exposing, inside and out, then continuously tests whether it can be broken.
A penetration test is a photograph of one afternoon. Your attack surface changes every time someone spins up a VM, publishes a subdomain, or grants a permission. ClarityXDR runs the discovery and the testing continuously — safely, authorised, and against your estate only.
What comes out is a ranked list of what is genuinely exploitable, with the fix attached — and because the same provider runs your estate, the fix actually gets deployed instead of filed.
Talk about ClarityXDRExternal attack surface
Everything you expose to the internet, found continuously — domains, certificates, open services, forgotten subdomains, the marketing site nobody told IT about.
Internal attack surface
The same view from inside: identity paths, lateral movement routes, privilege escalation, misconfiguration. What an attacker reaches once they have one foothold.
AI-driven penetration testing
Agents safely attempt the attack paths they find, against your estate, on a schedule you set. Continuous authorised testing rather than a report that is stale the week after it lands.
Risk that means something
Findings ranked by whether they are actually exploitable in your environment, with the fix and its blast radius attached. A prioritised list, not 400 raw CVEs.
Built on Microsoft
One extra agent, and the rest is yours already.
We run on the Microsoft security stack you are already licensed for, plus one lightweight endpoint agent for the health, inventory and remediation work Graph cannot reach. If you leave, the tooling and the data stay in your tenant.
Clients, 2007–2017
Twenty-seven years of this.
The automation is new. The company is not. These are clients from the years before the rebuild — same founder, same phone number — and they are shown as history, not as today's book of business.
eBoost hired DataGuys 7 years ago to run the IT side of our business. They supported us as we grew from 3 team members to over 30 and has delivered a tremendous value in the service they have provided.
Micha Mikailian
Founder & Chairman, eBoost Ventures
I have worked with DataGuys for over 10 years and they perhaps the most competent IT professionals I know. Their knowledge of a wide array of IT issues is hard to find. Whether it be software, hardware, security, applications or networking, DataGuys has the experience to get the job done.
Anthony Vallone
Owner, The Administration Group
DataGuys is a pleasure to work with and always provided a wealth of information. DataGuys played a vital role in implementing new technology, training employees, and managing projects established through strategic planning and implementation.
Ryan Doherty
COO, Lear Media Solutions
DataGuys team are highly motivated and skilled Systems Administrators. I would highly recommend them for any and all IT related issues in need of resolution.
David Whitehead
Network Administrator, Vantage Associates Inc.
DataGuys is amazing! It's particularly nice working with someone that solves problems rapidly and efficiently. I can't recommend them enough.
Garret Akerson
President, Motionstrand
DataGuys is extremely knowledgeable, always willing to help out (especially in emergencies!)
Jen Hibbits
Partner, Sunset Social Media Relations
Packages
Four ways to work with us.
Priced per server and per workstation, from live inventory rather than from a spreadsheet somebody updated last year. Add or remove a machine and the invoice follows.
Managed IT
We run it.
- Continuous monitoring and health checks
- Operating-system patching, always included
- Inventory that is counted, not estimated
- Onboarding and offboarding
- Backup with tested restores
Most chosen
Managed IT + Security
We run it and defend it.
- Everything in Managed IT
- Defender XDR incidents read as they land
- Vulnerabilities ranked by real exploitation, not CVSS
- Configuration posture checked against a baseline
- A full tool-call trace for every action taken
Cloud & Infrastructure
For firms moving off tin.
- Server virtualisation and migration
- Microsoft 365 and Azure migration
- Infrastructure design and buildout
- Ongoing cloud administration
- Disaster recovery
Partner brand
ClarityXDRASM + AI pentest
We attack it, so nobody else does.
- Continuous internal & external attack surface
- AI-driven penetration testing
- Risk ranked by real exploitability
- Every fix re-tested and proven
- Enterprise SOC over Defender & Sentinel
Industries
We already know your software.
Vertical applications are where generic IT support falls over. These are the ones we have supported longest.
Dental
Imaging and practice management, HIPAA evidence on request.
Medical
EHR uptime, HIPAA controls, audit-ready reporting.
Legal
Practice management, document security, ethical walls.
Accounting
Lacerte, Drake, QuickBooks — and surviving tax season.
Commercial print
RIP servers and prepress. We have run Ryobi and Harlequin.
Professional services
Small firms that need everything and have no IT staff.
Find out what it would cost.
Count your servers and workstations and the calculator gives you a real number in about two minutes — the same per-unit pricing we have used since the beginning, no “contact us for a quote.” Anything we cannot price firmly yet is marked as indicative rather than dressed up as a rate.
Talk to us
- Phone
- (XXX) XXX-XXXX
- support@dataguys.net
- Service area
- San Diego & Southern California