Today a buyer can ask Microsoft Copilot, ChatGPT, or Google’s AI Mode something like “Who’s a good IT partner for a 40-person manufacturer in the Chicago suburbs?” and get a tidy, confident paragraph back. No ten blue links. No scrolling. Just an answer, with a few sources tucked underneath.

The businesses named in that answer win the conversation. Everyone else is invisible, no matter how well they rank on any search engine. That shift is why answer engine optimization, or AEO, has essentially become the new SEO. Answer engine optimization is the practice of structuring your content so AI systems understand it, trust it, and cite it when they answer a question.

The good news? AEO isn’t a reinvention of everything you know. It’s SEO with better manners. It has clearer answers, cleaner structure, and proof that you know what you’re talking about. In this guide we’ll cover what AEO is, why it matters right now, what Microsoft itself says about how AI picks sources, a few real-world cases, and a practical playbook any small or midsize business can start by the end of this quarter.

What Is Answer Engine Optimization?

An answer engine is any tool that responds to a question with a synthesized answer instead of a list of links. Microsoft Copilot, Copilot Search in Bing, ChatGPT search, Perplexity, and Google’s AI Overviews all fit the bill. Answer engine optimization is how you earn a spot inside those answers.

You’ll also hear GEO (generative engine optimization) and “AI search optimization.” Marketers love a fresh acronym the way Chicagoans love arguing about deep dish, but they all point at the same goal: be the source the machine quotes.

AEO vs SEO: What Actually Changes

Traditional SEO ranks whole pages. AEO competes at the passage level. Microsoft put it plainly in its October 2025 guidance: AI search is “less about ordering entire pages and more about which pieces of content earn a place in the final answer” (Microsoft Advertising). Here’s how that plays out.

Notice the “what gets rewarded” row starts with “all of that.” AEO sits on top of SEO. If AI crawlers can’t reach your pages, or your site is a slow, tangled mess, no amount of clever FAQ writing will save you. Think of SEO as the foundation and AEO as the floor plan that makes the house easy to walk through.

Why AEO Matters Right Now

This isn’t a someday problem. The numbers have already moved, and Microsoft has rebuilt its own search experience around answers.

Search Engines Became Answer Engines

In April 2025 Microsoft launched Copilot Search in Bing, which blends traditional results with generative summaries. Microsoft says it “cites its sources prominently, so you know exactly where the information came from.” That’s the opportunity in one sentence. Those cited sources are the new page one.

The same pattern runs through Copilot in Windows, Edge, and Microsoft 365. For a lot of your buyers, especially the ones already living in Outlook and Teams all day, the first “search” of a research project now happens inside a Copilot prompt.

Fewer Clicks, Higher Stakes

When an AI summary shows up, people click less. A Pew Research Center study of 68,879 real Google searches found users clicked a traditional result in 8% of visits when an AI summary appeared, versus 15% without one. Only 1% clicked a link inside the summary itself. Users also ended their browsing session 26% of the time after seeing a summary, compared with 16% without.

Gartner saw this coming. Back in February 2024 it predicted traditional search engine volume would drop 25% by 2026 as AI chatbots and virtual agents took a bigger share of the questions.

The Visitors You Do Get Are Worth More

Here’s the twist that makes AEO worth your time. AI referrals are small in volume but big in intent. Microsoft Clarity analyzed more than 1,200 publisher and news sites and found AI referrals were under 1% of traffic, yet grew 155.6% over eight months. In the month measured, visitors from AI platforms signed up at 1.66%, compared with 0.15% from search and 0.46% from social.

That makes sense when you think about it. By the time someone clicks through from a Copilot answer, the AI has already done the comparison shopping. They show up pre-qualified, a little like a referral from a trusted friend at the bar after a Cubs game.

Real-World Cases: Who’s Winning and Who’s Feeling It

Theory is nice. Receipts are better. Here are two very different outcomes from the shift to AI answers.

Chegg: When the Answer Replaces the Visit

Chegg built a business on students searching for homework help and landing on its pages. In February 2025 the company sued Google over AI Overviews, reporting that its non-subscriber traffic fell 49% in January 2025, compared with an 8% decline in Q2 2024. Chegg said AI Overviews were “materially impacting our acquisitions, revenue, and employees.” Its Q4 2024 revenue dropped 24% year over year, and the company began exploring strategic options, including a sale.

Google disputes the cause, and the case is Chegg’s claim, not a court finding. But the lesson for any business is clear. If your value is answering simple questions, and an AI can answer them on the results page, the visit disappears. You need content that earns the citation, not just the click.

Ahrefs: Tiny Traffic, Outsized Revenue

On the other side of the ledger is Ahrefs, the SEO software company. In its own ChatGPT traffic analysis, Ahrefs reported that AI search sent about 0.5% of its visits but produced about 12.1% of its sign-ups. That works out to roughly 23 times the conversion rate of traditional organic visitors.

Ahrefs is quick to note that results vary by business model, and that some ecommerce referrals from ChatGPT convert worse. Still, it lines up with Microsoft Clarity’s publisher data. When AI recommends you, the people who show up are ready to talk.

What This Looks Like for an SMB

Picture a 60-person accounting firm in Naperville. (This one is illustrative, not a client story.) A CFO asks Copilot, “What should a midsize firm look for in a managed IT provider for SOC 2 readiness?” Copilot pulls a checklist from a page with a clear H2, a numbered list, and a short definition of SOC 2. That firm’s IT provider gets named and linked. The provider with a prettier homepage and a vague “We do it all!” services page doesn’t get a mention.

Same market, same buyer, completely different outcome. The difference is structure and clarity, not budget.

How Answer Engines Choose What to Cite

Most AI platforms keep their ranking recipes close to the vest. Microsoft has been unusually open, and since Copilot runs on Bing’s index, its guidance is the closest thing to a published rulebook for answer engine optimization.

They Read in Chunks, Not Pages

In “Optimizing Your Content for Inclusion in AI Search Answers”, Bing principal product manager Krishna Madhavan explains that “AI assistants don’t read a page top to bottom like a person would.” They break pages into smaller sections, evaluate each one, and stitch the best pieces into a single answer. His summary: “visibility is no longer defined by ranking position alone.”

That means every section of your page should be able to stand on its own. If a paragraph only makes sense after reading the three above it, an AI may skip it.

Microsoft’s Signals in Plain English

According to that same guidance, content that gets selected tends to be fresh, authoritative, structured, and semantically clear. Specifically, Microsoft recommends:

• Aligned titles, H1s, and meta descriptions that all reinforce the same purpose
• Descriptive H2 and H3 headings instead of vague labels like “Overview”
• Q&A blocks with a direct question and a concise answer
• Lists and tables for steps and comparisons, without bullet overload
• Schema markup (usually JSON-LD) to label FAQs, products, reviews, and events
• Concrete, measurable claims instead of fuzzy adjectives
• Simple punctuation, because heavy use of em dashes and decorative symbols “can confuse sentence structure for machines”

It also warns against hiding key answers in tabs, accordions, PDFs, or images, since “AI systems may not render hidden content, so key details can be skipped.” If your pricing lives in a downloadable PDF, Copilot may never see it.

Freshness Counts, and IndexNow Helps

In February 2026 Microsoft introduced AI Performance in Bing Webmaster Tools, and the announcement includes a section on keeping content fresh with IndexNow. IndexNow is a free protocol that pings participating search engines the moment a page is added, updated, or removed. Microsoft notes that “regular updates help ensure AI systems reference the most current version of your content.”

Translation: stale content is a liability. If your services page still mentions Windows 10 support plans, an AI has every reason to quote somebody else.

7 Answer Engine Optimization Moves for SMBs

You don’t need an enterprise marketing department to do this well. You need focus, a little discipline, and a willingness to write like a human who answers questions for a living. Here’s where we’d start.

1. Start With the Questions Your Buyers Actually Ask

Pull questions from sales calls, support tickets, proposal Q&As, and the stuff your team answers in email every week. Those are the exact prompts buyers type into Copilot. A list of 20 to 30 real questions beats any keyword tool, because it reflects how people in your market talk. [internal link: CSW post on AI for SMBs]

2. Lead Every Section With the Answer

Put a one or two sentence answer right under each heading, then add the detail. Journalists call this the inverted pyramid. AI systems call it “easy to quote.” If someone asks “How long does a Microsoft 365 migration take?”, your first line should give a real range, not a paragraph about how every business is unique.

3. Structure Pages So Each Chunk Stands Alone

Use descriptive H2s and H3s phrased the way people ask questions. Keep paragraphs short. Use numbered lists for steps and tables for comparisons. Remember Microsoft’s point about passages: every section should make sense if it were the only thing an AI read.

4. Add Schema Markup

Schema tells machines what your content is. For most SMB sites, start with Organization, LocalBusiness, Service, FAQPage, and Article schema. On WordPress, Rank Math handles most of this from the post editor, so you won’t need to hand-code JSON-LD. Then validate it before you publish.

5. Prove It With Specifics

AI engines favor verifiable, concrete claims. “We reduced ticket response time from 4 hours to 45 minutes for a 120-seat distributor” beats “We deliver fast, reliable support.” Add named authors with real credentials, publish dates, and outbound links to primary sources like Microsoft documentation. Expertise you can’t verify reads like marketing, and AI tends to skip marketing.

6. Make Your Site Easy to Crawl and Fast to Refresh

Check that your robots.txt doesn’t accidentally block Bingbot or other AI crawlers you want visiting. Move critical information out of PDFs, image text, and collapsed accordions. Turn on IndexNow (many WordPress SEO plugins, including Rank Math, support it) so Bing hears about updates right away. Then set a calendar reminder to refresh your top pages every quarter. [internal link: CSW Azure or WordPress post]

7. Build Your Reputation Off-Site, Too

Answer engines don’t only read your website. They also learn from reviews, directories, industry associations, local press, LinkedIn, and partner listings. Keep your business name, address, and service descriptions consistent everywhere. Earn mentions from Chicago business publications, chambers of commerce, and vendor partner pages. When multiple trusted sources say the same thing about you, AI gets more confident repeating it.

How to Measure AEO Without Losing Your Mind

AEO measurement is younger than SEO measurement, but you’re no longer flying blind. Three tools cover most of what an SMB needs.

Bing Webmaster Tools AI Performance. Microsoft’s AI Performance report shows how often your pages are cited in Copilot, Bing’s AI summaries, and select partner experiences. You get total citations, cited pages per day, page-level counts, and sample “grounding queries,” the phrases the AI used to pull your content. Microsoft is careful to say citation counts don’t indicate ranking or placement inside an answer, so treat them as a visibility trend, not a scoreboard.

GA4 and Microsoft Clarity. Set up a custom channel group in GA4 for AI referrers like copilot.microsoft.com, chatgpt.com, and perplexity.ai. Microsoft Clarity now breaks out AI platform traffic too, and its session recordings show what those high-intent visitors do once they land.

Prompt spot checks. Once a month, run your top ten buyer questions through Copilot and ChatGPT. Note who gets named, which pages get cited, and whether the description of your business is accurate. It’s low-tech, and it’s the fastest way to spot gaps.

One more tip: add “How did you hear about us?” to your contact form with “AI assistant (Copilot, ChatGPT, etc.)” as an option. A lot of AI influence never shows up as a referral click, so ask.

How CSW Solutions Can Help You Get Cited

Here’s the thing about answer engine optimization: it lives right where marketing meets technology. Half of it is writing clear, useful answers. The other half is schema, crawl access, site speed, analytics, and keeping a WordPress or Azure-hosted site healthy enough that AI crawlers actually enjoy visiting. Most SMBs have someone for one half. Very few have someone for both.

That’s our sweet spot. CSW Solutions has spent 21 years helping Chicago-area businesses make technology pull its weight, and AEO is a natural extension of what we already do every day:

• AI & automation know-how. We work with Microsoft Copilot and Azure AI every day, so we understand how these systems read, retrieve, and summarize content.
• Website and technical cleanup. We can audit your site for crawl blockers, hidden content, missing schema, and slow pages, then fix them.
• Measurement that makes sense. We’ll set up Bing Webmaster Tools, IndexNow, GA4 AI channel groups, and Microsoft Clarity so you can see what’s working.
• Content that answers real questions. We’ll help you turn the questions your team hears every week into pages AI engines want to quote.

No pressure and no jargon avalanche. If you’re curious how your business shows up when a buyer asks Copilot about what you do, we’d be happy to take a look with you. Think of it as a friendly second opinion, the kind you’d get from a neighbor who happens to know a lot about search. Reach out to the CSW team whenever you’re ready, and let’s make sure the answer engines know your name.

Because in 2026, being the best kept secret in Chicago isn’t a compliment. It’s a missed opportunity.

The bugs let an attacker take over a web server without a username or password. Governments told people to patch or unplug. Wikimedia, the Internet Archive and a parade of government portals went dark on purpose while they updated. And here is the twist that makes this more than another patch-Tuesday story, AI helped find the flaws, and attackers were poking at them days before the rest of us even knew they existed. That is why we think PHP2Shell is the clearest picture yet of cybersecurity in the age of AI.

The tools that help defenders find bugs faster help attackers too, and the window between “vulnerability discovered” and “vulnerability exploited” is shrinking from weeks to hours. If you run a small or midsize business, you do not need to panic. You do need a plan that moves at machine speed. So, let’s walk through what happened, why AI changes the math, a few real-world cases worth knowing, and seven lessons you can act on this week. Grab a coffee. Chicago-strength, preferably.

What Happened With PHP2Shell | The 60-Second Version

PHP2Shell is the nickname for two memory-safety flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 under CVSS 4.0, and both allow unauthenticated remote code execution. In plain English, a stranger on the internet can send a crafted request to your website and run their own code on your server. Seriously. According to Wiz Research, and we hope you’re sitting down for this, every PHP release from the last decade is affected by at least one of the bugs, going all the way back to PHP 5.4. It gets worse before it gets better. One of the flaws can leak chunks of server memory back to the attacker. Wiz notes that memory can contain passwords, tokens and API keys from other visitors’ requests. So even a server that is not fully taken over can quietly spill secrets.

The disclosure did not go to plan, either. The PHP Foundation was running a confidential embargo, giving hosting companies a head start on patches. Then details leaked. A proof-of-concept video went out early, and one vendor published patched builds ahead of schedule, which let attackers compare old and new code and reverse-engineer the fix. The Foundation moved the release up a day, to October 21. The Hacker News reports that Amazon Threat Intelligence caught an exploit attempt against its honeypots on October 17, four days before public disclosure, and Amazon said it remains unclear how the attacker got the details.

Once the news broke, the reaction was swift:

• Patches: fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older branches such as 7.4, 8.0 and 8.1 are end-of-life and got source patches only, no official builds (Here’s the summary).
• Precautionary shutdowns: Wikimedia disabled supporting services, the Internet Archive briefly went offline, and government sites in the Netherlands, Denmark, Finland, France and Canada were pulled while teams patched. TechCrunch adds banks, retailers, hospitals and Belgium’s Smartschool education platform to the list.
• Government warnings: the UK’s National Cyber Security Centre issued an alert, and the NSA advised organizations to take sites offline if they could not update right away.
• Exploitation: Cloudflare’s CEO described an exponential rise in exploit attempts after disclosure, and by October 23 researchers at Trail of Bits reported working exploits.

Here is the part small businesses should underline, PHP is not only in websites. It also lives inside routers, storage devices, firewalls and VPN appliances. Big organizations patched in hours. Smaller teams and legacy systems, the ones nobody has logged into since the office moved, are expected to stay exposed for a long time.

Why PHP2Shell Is an Age-of-AI Story

Here is the wild part. At least one of these bugs was first spotted back in 2024 by a PHP core developer, but the fix stalled because nobody could show it was exploitable. Bugs like that are everywhere in older software. They are technically broken but practically ignored because turning them into a working attack takes rare expertise and a lot of patience. AI is changing that equation. Researchers at Calif found a way to exploit the flaws while auditing PHP’s source code with help from OpenAI’s models, and Wiz researchers independently found their own set using frontier models (Gemini 4 Argon and GPT-5.6 Sol) through their Wiz Atlas tool. Wiz says the models helped them build working exploits against several targets within hours, and called the moment an “AI inflection point.” In their words, AI lowered the expertise needed to chain these memory bugs together.

Before anyone pictures a robot typing “hack the internet” and hitting enter, Calif offered a healthy reality check, “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.” Most of the heavy lifting still came from humans who knew PHP’s internals cold. AI was the power tool, not the carpenter. But notice that phrase: at least for now. Three things are true at the same time:

1. Old code is about to get a lot of new scrutiny. If AI can help a good researcher find a decade-old bug in PHP, it can help find bugs in the aging line-of-business apps, plugins and appliances that small businesses run every day.
2. The patch window is collapsing. Security firm Sansec predicted mass attacks within 15 minutes of the PHP release. One monitoring firm saw its first exploit request less than an hour after patched builds appeared. “We’ll get to it in next maintenance window” is no longer a plan.
3. Defenders get the same superpowers. The good news is that the people who found PHP2Shell were on our side, and the same AI that speeds up bug hunting also speeds up detection, triage and response. The question seems to come down to which side uses it better.

That is the heart of cybersecurity in the age of AI. The fundamentals have not changed, the speed has.

Real-World Cases | AI Is Already in the Attack Chain

PHP2Shell is the headline, but it is not the first sign that AI has joined the attacker’s toolkit. We found a few cases worth knowing, so you get the whole picture.

The $25 million video call. In early 2024, a finance employee at Arup, the engineering firm behind the Sydney Opera House, joined a video call with what looked and sounded like the company’s CFO and several colleagues. Every one of them was an AI-generated deepfake. The employee made 15 transfers totaling about US$25.6 million before anyone caught on. Arup confirmed that “none of our internal systems were compromised.” No firewall would have stopped it. A callback policy would have.

The AI that ran most of a spy campaign. In November 2025, Anthropic reported that a group it assessed as Chinese state-sponsored had manipulated its Claude Code tool into attempting intrusions against about 30 organizations, including tech companies, financial institutions and government agencies. Anthropic estimated AI performed 80 to 90% of the campaign, with humans stepping in at only a handful of decision points. A small number of the intrusions succeeded.

AI brands as bait. In June 2026, Microsoft Threat Intelligence documented attackers impersonating ChatGPT, Copilot, DeepSeek and Claude. One fake “policy violation” campaign hit more than 2,000 organizations in three days, and IT was the most-targeted sector at 56%. A fake AI plugin reached over 66,000 devices in a single day. The lesson here is, the AI tool your team is excited to try is also the perfect lure.

Phishing that actually works now. Microsoft’s 2025 Digital Defense Report found AI-powered phishing pushed click-through rates from 12% to 54%, about 4.5 times higher than traditional phishing. The same report found 52% of attacks were financially motivated and 80% of investigated incidents involved data theft. Microsoft’s newer 2026 Digital Defense Report says threat actors now use AI across reconnaissance, social engineering, exploit development and post-compromise activity.

Notice the pattern. None of these attacks invented a brand-new category of crime. Phishing, impersonation, unpatched servers and stolen credentials are old news. AI just makes each one faster, cheaper and more convincing. Which means the defenses that work are also familiar. They just have to be turned on, tuned up and kept current.

7 Cybersecurity Lessons From PHP2Shell (With the Microsoft Tools That Help)

We are an Azure shop, so the examples below lean on Microsoft. The principles apply no matter whose logo is on your console.

1. Know what you are running, including the stuff you forgot

You cannot patch what you do not know exists. The businesses that scrambled hardest last week were not the ones with the most PHP. They were the ones who had to ask, “Wait, do we have PHP?” Think beyond the main website. The old microsite from a 2021 campaign, the client portal a contractor built, the NAS in the closet, and even the firewall’s admin page. A living asset inventory is the least glamorous and most valuable security tool you will ever own.

2. Patch at machine speed, then verify

If attackers can weaponize a fix within an hour of its release, monthly patching is a polite invitation. For anything internet-facing, critical patches need a same-day lane. And trust, but verify. On Azure App Service, Microsoft rolled patched PHP and WordPress images out on an expedited basis, but community answers on Microsoft Q&A show some apps on the Standard update channel lagged until owners switched them to Latest. The fix is to check the running version yourself (PHP 8.4 apps should report 8.4.27 or later) rather than assuming the platform handled it. Running PHP 8.1 or older? That branch gets no official fix, so this is your sign to upgrade.

3. Put a shield in front of every public app

A web application firewall will not fix a broken engine, but it will buy you time. Within a day of disclosure, Microsoft published upgrade guidance and Azure WAF mitigations for PHP2Shell covering Azure Front Door and Application Gateway. If your sites already sit behind Azure Web Application Firewall on Front Door, you got an extra layer of protection the day it mattered. Just remember the WAF is a seatbelt, not a substitute for brakes. Patch anyway.

4. Assume secrets leaked, and rotate them

Remember that PHP2Shell can leak server memory, including passwords, tokens and API keys. If a PHP app was exposed and unpatched for any stretch of time, treat its credentials as compromised. Rotate database passwords, API keys and service account secrets, and move them out of config files into a managed vault. It is a tedious afternoon. It is far less tedious than explaining a breach.

5. Lock down identity like it is the front door, because it is

Once attackers have a foothold, they go after accounts. Microsoft’s 2025 Digital Defense Report found that more than 97% of identity attacks are password attacks, and that phishing-resistant MFA can prevent up to 99% of them. Microsoft Entra lets you require phishing-resistant MFA through Conditional Access, starting with admins and expanding from there. Passkeys and security keys are the gold standard. Text-message codes are better than nothing, but AI-driven adversary-in-the-middle kits (AiTM) are built to steal them.

6. Train people for a world where seeing is not believing

The Arup case should be required reading for anyone who can approve a payment. Your team needs a simple, boring, non-negotiable rule if there isn’t already one set by your organization. Any request to move money, change payment details or share credentials gets verified through a second channel you already trust or call the person back on a known number. Walk down the hall or ask the question only the real CFO would know. And install AI tools only from the vendor’s own site, never from a search ad or a random GitHub repo, since that is exactly where Microsoft found attackers waiting.

7. Fight AI with AI, and give it guardrails

Attackers are automating, so defenders have to as well. Microsoft Defender for Business brings enterprise-grade endpoint detection and automated investigation to companies with up to 300 users, at a price built for SMBs. For teams that want an AI partner in the security seat, Microsoft Security Copilot helps analysts summarize incidents, investigate alerts and write queries in plain English. At the same time, set clear rules for how your own people use AI. Determine which tools are approved, what data can go into them and who signs off on new ones. Shadow AI is the new shadow IT.

Your PHP2Shell and AI-Era Checklist for This Week

If you only have an hour, start here. Print it, tape it to the monitor, cross things off with gusto.

• List every website, portal, plugin and appliance you own that faces the internet, and ask your vendors whether PHP is under the hood.
• Confirm each PHP system is on 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. Anything on 8.1 or older goes on the upgrade list today.
• On Azure App Service, check the running PHP version directly and move critical apps to the Latest update channel if they lag.
• Put public-facing apps behind a web application firewall, and confirm the PHP2Shell rules are actually applied.
• Rotate passwords, API keys and tokens for any PHP app that was exposed before patching.
• Require phishing-resistant MFA for every admin account, then roll it out to everyone else.
• Write down your “verify before you pay” callback rule and tell the finance team it applies even to the CEO.
• Publish a short list of approved AI tools and where to download them.
• Make sure someone, internal or external, is watching your alerts after hours. Attackers do not keep local business hours.

If you got through that list without breaking a sweat, congratulations, you are ahead of most of the internet. If you got stuck on line one, you are in very good company, and that is exactly where a partner helps.

How CSW Solutions Can Help You Stay Ahead in the Age of AI

The biggest thing about PHP2Shell is, the organizations that came through it calmly were not smarter or luckier than everyone else. They simply knew what they were running, had a patch process that could move in hours, and had someone watching. That is not magic. It is good housekeeping, done consistently, by people who care.

That is what we do. CSW Solutions has been helping businesses stay secure and productive for over 21 years, which means we have seen plenty of “the internet is on fire” weeks. We are a small team by design, we are in the same time zone, and while we live on coffee and code, you get real people who know you and your environment by name, not a ticket number and a hold queue. Here are some of the ways we can help:

• Managed IT and cloud security: asset inventory, same-day patching for critical flaws, Azure WAF configuration and around-the-clock monitoring with Microsoft Defender, so the next PHP2Shell is a line item, not a crisis.
• Identity done right: rolling out phishing-resistant MFA and Conditional Access in Microsoft Entra without turning Monday morning into a help-desk riot.
• AI and automation, safely: helping your team adopt AI tools that actually save time, with clear guardrails on data, approvals and access, so innovation does not open a side door.
• Custom software that ages well: if you have a legacy PHP app holding your business together with digital duct tape, we can modernize it, move it to Azure and keep it patched.
  

Cybersecurity in the age of AI does not require a 10-person security team. It requires the right fundamentals, the right tools and a partner who cares and actually answers the phone. If last week left you wondering where you stand, we would be glad to take a look with you. No pressure, no jargon, just a straight answer and a plan. Let’s talk about your security whenever you are ready. The coffee’s on us.

That gap between “sounds right” and “is right” is the whole reason RAG exists. If you’ve seen the acronym floating around vendor decks and LinkedIn posts and quietly nodded along, welcome to the judgment-free zone. This is RAG explained in plain English. We’ll go over what it is, why it matters, what happens when companies skip it, and how a small or midsize business can use Microsoft tools it may already pay for to make sure AI answers come from its own documentation, not from a best guess based on general training data. No buzzword bingo. Okay, maybe one or two. We’ll define them as we go.

What Is RAG? Retrieval-Augmented Generation in Plain English

RAG stands for retrieval-augmented generation. Take off the lab coat and it basically means AI will look things up in your stuff before it provides an answer. Large language models, like the ones behind ChatGPT and Microsoft Copilot, learn from enormous amounts of public text. That makes them great with language. They summarize, draft, and explain beautifully but it does not make them experts on your pricing sheet, your HR handbook, or the warranty terms you updated last March. They have never seen those documents, so when you ask about them anyway, the model does what it was built to do and it predicts a plausible-sounding answer.

RAG changes the order of operations. Instead of asking the AI to answer from memory, you:

1. Retrieve the passages from your own documents that relate to the question.
2. Augment the question by handing those passages to the AI along with it.
3. Generate an answer based on what was retrieved, ideally with a citation pointing back to the source.

Microsoft describes RAG as a way of extending what AI can do by “grounding responses in your proprietary content” (Microsoft Learn: RAG in Azure AI Search). Grounding is the one buzzword worth keeping. It simply means the answer is tied to something real you can point at.

RAG Explained as an Open-Book Exam

Think back to school. A closed-book exam tests what you memorized. If you didn’t study chapter 7, you guess, and some of us were very confident guessers. An open-book exam lets you flip to the right page first.

RAG turns every AI question into an open-book exam, and the book is your company’s documentation. The AI still writes the answer in its own words, but it reads from your textbook instead of winging it. One more distinction saves a lot of confusion, RAG is not training. You are not permanently teaching the model new facts or building your own AI from scratch. Your documents stay in a searchable index you control, and the AI reads the relevant pieces at the moment someone asks. Update the document, and tomorrow’s answers update with it. No retraining, no data scientists on retainer.

Why AI Makes Things Up (and What It Costs When It Does)

AI researchers call confident wrong answers “hallucinations.” That’s a generous name. The model isn’t seeing things nor does it even have an imagination. It’s filling a knowledge gap with the most statistically likely words. Most of the time that is harmless but sometimes it ends up in front of a judge and when it does, it could end up costing you time and resources.

Real-World Case: Air Canada’s Chatbot Invents a Refund Policy

In November 2022, Jake Moffatt asked Air Canada’s website chatbot about bereavement fares after a death in his family. The chatbot told him he could book a full-price ticket and request a partial bereavement refund within 90 days. That was not Air Canada’s actual policy, and when he applied, the airline said no.

He took it to British Columbia’s Civil Resolution Tribunal. Air Canada argued, and we promise this is real, that the chatbot was essentially responsible for its own actions. The tribunal didn’t buy it. In its February 2024 decision, it found the airline liable for negligent misrepresentation and ordered it to pay CAD $650.88 plus interest and fees (Manatt summary of Moffatt v. Air Canada).
Small dollars, big lesson. Your AI speaks for your company, whether or not anyone checked its homework.

Real-World Case: The Lawyers and the Cases That Didn’t Exist

In Mata v. Avianca, two New York attorneys filed a brief built on legal research from ChatGPT. Several of the court decisions it cited did not exist. In June 2023, U.S. District Judge P. Kevin Castel sanctioned the attorneys and their firm $5,000 (LawSites coverage). The fine was modest but the headlines were not.

What These Cases Have in Common

Neither problem came down to the AI being “dumb.” Both came down to the AI answering without a source of truth. The airline chatbot didn’t check the actual policy page. The legal research tool didn’t check an actual case database. That is exactly the gap retrieval-augmented generation fills. Answer from the documentation. Show where the answer came from. And when the documents don’t cover the question, say so instead of improvising.

RAG Explained Step by Step

Here is the whole process, minus the jargon soup.

Step 1: Gather Your Documents

Policies, manuals, contracts, SOPs, product sheets, FAQs, past proposals. For most businesses these live in SharePoint, OneDrive, a file share, or a line-of-business app. This step is where most projects quietly succeed or fail, and we’ll come back to why.

Step 2: Chop Them Into Bite-Size Pieces

A 90-page employee handbook is too big to hand the AI all at once, and most of it is irrelevant to any single question. So documents are split into smaller sections called chunks, often a paragraph or a few hundred words each. Microsoft publishes a whole guide on chunking large documents for search, because getting the size right has a real effect on answer quality.

Step 3: Index Them for Meaning, Not Just Keywords

Old-school search matches exact words. Ask about “time off” and it might miss the section titled “PTO Policy.” Modern RAG systems also create embeddings, which are numerical fingerprints of what a chunk means. Similar ideas land close together, so “time off,” “vacation,” and “PTO” find each other.

Azure AI Search runs keyword search and meaning-based (vector) search side by side, which Microsoft calls hybrid search, then applies a semantic ranker to push the most relevant results to the top.

Step 4: Retrieve the Best Matches

When someone asks a question, the system searches the index and pulls the handful of chunks most likely to hold the answer. A well-built system only retrieves the chunks the user is allowed to see. Microsoft calls this security trimming. If the intern can’t open the payroll folder, the AI shouldn’t quote from it either.

Step 5: Generate a Grounded Answer With Citations

The question and the retrieved chunks go to the language model with instructions along the lines of, answer using only this material, cite your sources, and if the answer isn’t here, say you don’t know. The person gets a plain-English answer plus a link to the actual document. Trust, but verify, and now verifying takes one click.

That is RAG explained in five steps. Everything else in the RAG world, from “agentic retrieval” to “vector databases,” is a refinement of one of those five above.

RAG Success in the Real World

The cautionary tales are fun, but plenty of organizations are getting real value from grounded AI.

Morgan Stanley: 100,000 Documents, One Assistant

Morgan Stanley Wealth Management built an internal assistant on GPT-4 that answers financial advisors’ questions from the firm’s own knowledge base. According to OpenAI’s case study, it grew from handling about 7,000 questions to answering across roughly 100,000 documents, and it reached over 98% adoption among advisor teams. The part worth noting is that before rollout, the firm built an evaluation framework. Advisors and experts graded the AI’s answers against known-good responses, and the team ran daily regression tests with sample questions. They didn’t trust it because it was impressive. They trusted it because they tested it.

Worten: From 3.5 Minutes to Seconds on the Store Floor

Worten, a Portuguese consumer electronics retailer with more than 240 stores, worked with EY to build an internal chatbot using Azure AI Search and Azure OpenAI. Store employees ask questions on a smartphone, and the bot answers from more than 1,000 operations manuals stored in SharePoint, including a link to the source manual. Microsoft reports that document lookups dropped from about 3.5 minutes to a matter of seconds. You are not Morgan Stanley. Neither are we, and our parking situation proves it. But Worten’s problem is everybody’s problem. The answers exist, they’re buried in documents, and people either waste time digging or guess. A 25-person firm with 300 SOPs in SharePoint has the same shape of problem at a friendlier scale.

Where RAG Fits for Small and Midsize Businesses

• Internal help desk: “How do I request a new laptop?” answered from your actual IT policies.
• HR and onboarding: Benefits, PTO, and handbook questions answered at 9 p.m. without pinging HR.
• Sales and proposals: Approved language and past proposal answers pulled up instead of rewritten from scratch.
• Customer service: Product specs and warranty terms with a citation, so reps stop improvising.
• Operations: SOPs, safety procedures, and equipment manuals on a phone at the warehouse or job site.

Three Ways to Make AI Answer From Your Documents

Good news for Microsoft 365 shops is you may already own pieces of a RAG setup. Here are the three common roads, from least to most custom.

Option 1: Microsoft 365 Copilot (RAG That’s Already Built In)

If you license Microsoft 365 Copilot, you’re already using RAG. Copilot sends your prompt through Microsoft Graph and a semantic index of your organization’s content to find relevant material, adds that context, and then passes it to the model. Microsoft states that the index only surfaces content a user already has permission to access, and that prompts, responses, and indexed data aren’t used to train the foundation models.

Best for: Everyday questions across email, Teams chats, and files.

The catch: Copilot respects your permissions exactly as they are. If a sensitive folder was shared with “Everyone” back in 2019, Copilot will happily find it. Admins can exclude sensitive SharePoint sites from search and the semantic index, but someone has to know to do it.

Option 2: Copilot Studio Agents (A Focused Assistant, Low-Code)

Copilot Studio lets you build an agent that answers from specific knowledge sources such as SharePoint sites, uploaded files, public websites, Dataverse, and enterprise connectors. For internal sources, the agent uses the signed-in user’s Microsoft Entra ID, so it only returns what that person can access. You can also switch off ungrounded responses. With that setting off, the agent only answers when it can cite a source, and otherwise behaves as if it found nothing. That one toggle would have saved Air Canada a tribunal date.

Best for: An HR bot, an IT help desk, or a sales enablement assistant, built in weeks instead of months.

Option 3: Azure AI Search Plus Azure OpenAI (Fully Custom)

When you need RAG inside your own app or client portal, across many data sources, with tight control over chunking, ranking, and security, this is the professional-grade toolkit. Azure AI Search handles indexing, hybrid search, semantic ranking, and security trimming. Its newer agentic retrieval can break a complicated question into smaller searches, run them in parallel, and return results with citations.

Best for: Customer-facing portals, line-of-business integrations, and anything where an off-the-shelf assistant is too generic.

Rule of thumb: Start with the simplest option that solves the actual problem. Plenty of businesses jump straight to a custom build when a well-scoped Copilot Studio agent would have done the job by Thursday.

The Mistakes That Sink RAG Projects

RAG is not magic. It’s a very fast, very literal research assistant. Give it a messy library and you’ll get messy answers, just faster.

Mistake 1: Garbage In, Confident Garbage Out

If your SharePoint holds three versions of the travel policy (Final, Final_v2, and FINAL_actual), the AI may cite any of them. Before you connect anything, archive the outdated versions and give each core document a clear owner.

Mistake 2: Ignoring Permissions

RAG respects access controls, which is wonderful when your access controls are right. Oversharing is one of the most common surprises in Copilot rollouts. Review who can see what before AI makes it searchable in plain English.

Mistake 3: No “I Don’t Know” Option

A grounded assistant should decline to answer when the documents don’t cover the question. Configure it that way, then test that it actually does respond that way.

Mistake 4: Skipping the Test Drive

Morgan Stanley tested with real advisor questions before rollout. You can run a scaled-down version and write 25 to 50 real questions your team asks, note the correct answers, and grade the AI before launch and after every major content change.

Mistake 5: Launching Without a How-To

People need to know what the assistant covers, what it doesn’t, and that the citation link is there for a reason. A one-page guide and a 15-minute demo go a long way.

Quick RAG Readiness Checklist

• We know the top three questions that eat our team’s time.
• The documents that answer them live in one place, ideally SharePoint.
• Outdated versions are archived or deleted.
• Permissions have been reviewed in the last 12 months.
• Someone owns keeping each key document current.
• We have a short list of test questions with known answers.

Checked four or more? You’re closer than you think. Fewer than that? Completely normal, and very fixable.

CSW Solutions Can Help

Here’s where we stop explaining and start being useful. CSW Solutions has been helping businesses make technology behave since 2005, back when “the cloud” was mostly something that delayed your flight out of O’Hare. Today our team works across AI and automation, custom software, and managed IT and cloud, which happens to be exactly the mix a good RAG project needs. We’re Microsoft and Azure people through and through, so we build on the platform you already trust instead of bolting on one more tool.

If you’re still at the “should we even try this” stage, our post on turning generative AI pilots into real business value is a good warm-up. When you’re ready to go further, here’s how we typically help:

• Get your house in order first. We review your SharePoint structure, permissions, and oversharing risks before AI makes everything searchable. Not glamorous, but it’s the step that keeps your payroll spreadsheet out of the break room conversation.
• Pick the right-sized tool. Microsoft 365 Copilot, a Copilot Studio agent, or a custom Azure AI Search build. We’ll tell you which one fits, including when the least expensive option wins.
• Build it and prove it. We build the agent or app, write test questions with your team, and measure accuracy before anyone outside the pilot group touches it.
• Keep it sharp. Through our managed IT and cloud services, we keep content, permissions, and Azure costs from drifting after launch day.

If you’ve got a pile of documents and a team that keeps asking the same questions, let’s grab a coffee or a pint. Virtual works, or we’ll meet you somewhere with a good view of the river. We’ll look at what you have, tell you plainly what RAG could and couldn’t do for you, and leave you with a clear next step, whether or not we’re part of it. No pitch deck the size of Sears Tower. Just a good conversation. Reach out to the CSW team whenever you’re ready.

AI-powered managed IT services flip that script. Instead of waiting for things to break, AI watches your environment around the clock, spots trouble early, and in a growing number of cases it fixes things before anyone on your team notices. The help desk gets faster, the security team gets superpowers, and your employees spend less time staring at spinning wheels and more time doing the work you hired them for.

This is not a far-off vision from a tech conference keynote. Microsoft has baked AI into the tools many SMBs already pay for, including Microsoft 365, Intune, Defender, Entra, and Azure. Real organizations are reporting real results, and the economics are starting to make sense for companies that are nowhere near Fortune 500 territory. It is making even more sense for those that are.

In this post, we will break down what AI-powered managed IT actually means, which Microsoft tools are driving the shift, what the real-world numbers look like, where the hype outruns reality, and how to get started without losing your mind (or your budget).

What Are AI-Powered Managed IT Services, Really?

Traditional managed IT services already moved businesses beyond pure break-fix. A managed service provider (MSP) monitors your systems, patches your devices, handles your help desk, and keeps your security tools running for a predictable monthly fee. That was a big upgrade from the “call us when it is on fire” approach.

AI-powered managed IT services take that foundation and add a layer of intelligence on top with no overhead. Think of it as the difference between a smoke detector and a building engineer who can smell a wiring problem two floors away. Here is what changes:

• Monitoring becomes predictive. Instead of alerting when a server is already down, AI models learn what “normal” looks like for your environment and flag anomalies early, like a disk filling faster than usual or a login pattern that does not match how your team actually works.
• Triage gets automated. AI can read an incoming ticket, categorize it, pull relevant device data, and suggest (or apply) a fix. Password resets, license assignments, and common software issues stop eating technician hours.
• Security response happens in minutes, not days. AI correlates signals across email, identity, devices, and cloud apps to spot an attack in progress and contain it automatically.
• Admins speak plain English. Instead of writing complex queries, IT pros can ask questions like “Which laptops are out of compliance and why?” and get an answer in seconds.
• Documentation and reporting write themselves. AI summarizes incidents, drafts post-mortems, and turns raw telemetry into reports a business owner can actually read.

The key point for business leaders is that AI does not replace your IT partner. It makes your IT partner dramatically faster, more consistent, and more proactive. The humans still make the judgment calls. They just spend less time on the grunt work and more time on the things that move your business forward. I feel like we are always repeating this when it comes to integration and innovation, but it is almost always the case. More brain power, less overhead.

Microsoft’s own research suggests leaders are already thinking this way. In its 2025 Work Trend Index, 82% of leaders said they expect to use digital labor, meaning AI agents, to expand workforce capacity within the next 12 to 18 months. IT support is one of the most natural places to start.

The Microsoft Tools Powering AI-Powered Managed IT Services

The good news for SMBs is, you probably do not need to buy a shiny new platform to get started. If you are on Microsoft 365 and Azure, much of the AI-powered IT toolkit is already in the building, waiting to be switched on and configured properly. Below, we have compiled for you the heavy hitters.

Microsoft Security Copilot

Microsoft Security Copilot is a generative AI assistant built for security and IT teams. It summarizes incidents, explains suspicious scripts in plain language, guides investigations, and runs specialized agents that handle repetitive work like triaging phishing reports. It plugs into Defender, Entra, Intune, and Purview, so it sees the whole picture rather than one silo at a time.

The big news this year was how Microsoft began including Security Copilot in Microsoft 365 E5 with a phased rollout between April and June 2026, allocating 400 Security Compute Units per month for every 1,000 user licenses. If your organization is on E5, you may already have access and not know it. Outside E5, Security Copilot is billed on a consumption basis, which makes it worth a conversation about where it actually pays off for your environment. We’re always happy to help!

Copilot in Microsoft Intune

Intune is how most Microsoft shops manage laptops, phones, and apps. Copilot in Intune lets admins query device, app, and compliance data in plain language, get explanations and recommended values for policy settings, spot conflicts between compliance policies, and troubleshoot individual devices. Microsoft has also introduced specialized agents for Intune, including a Vulnerability Remediation Agent, a Change Review Agent, and a Device Offboarding Agent. In translation, the tedious detective work that used to take an hour now takes a few minutes, and it respects your existing role-based permissions so nobody ever sees what they should not see, ever.

Microsoft Defender XDR Automatic Attack Disruption

This is the one that makes security folks a little giddy. Automatic attack disruption correlates signals across endpoints, identities, email, and cloud apps to identify active attacks such as ransomware, business email compromise, and adversary-in-the-middle phishing. When it reaches high confidence, it acts on its own by containing devices, disabling compromised user accounts, and revoking active sessions. Every action is reversible, and your IT team can exclude critical assets. For an SMB without a 24/7 security operations center, this is the closest thing to having a security guard who never takes a coffee break.

Azure Copilot

For businesses running workloads in the cloud, Azure Copilot is built right into the Azure portal and mobile app. It helps teams design, operate, optimize, and troubleshoot Azure resources using natural language, and it can take actions on your behalf after you confirm them. Most capabilities are included with an Azure subscription at no extra cost. For managed IT teams, that means faster root-cause analysis when something goes sideways and smarter recommendations for trimming cloud spend.

Windows Autopatch

Not every piece of the puzzle is flashy generative AI. Windows Autopatch automates updates for Windows, Microsoft 365 Apps, Edge, and Teams using phased rollout rings, so a bad patch hits a small test group before it hits the whole company. As of April 2025, it has been available to organizations on Microsoft 365 Business Premium, not just enterprise plans. Automated, intelligent patching quietly removes one of the most common causes of both downtime and breaches.

Microsoft 365 Copilot and Copilot Studio

On the employee side, Microsoft 365 Copilot and Copilot Studio let businesses build self-service IT agents that live right in Teams. Employees can ask “How do I connect to the conference room display?” or “Why can’t I access the shared drive?” and get an answer grounded within your own documentation, with a clean handoff to a human when needed. Microsoft even publishes an IT help desk agent scenario in its adoption library as a starting point.

Real-World Results | What AI-Powered IT Support Looks Like in Practice

Vendor promises are cheap. Numbers from live environments are more interesting so as we usually do, we found some real world use cases that are worth a note or two.

Avanade: Identity Investigations Cut From 27 Minutes to 2

Avanade, the Microsoft-focused consultancy, piloted Security Copilot inside its identity support workflows, the kind of tickets every IT team knows by heart; from guest account issues, passwordless sign-in problems, to passkey errors. According to Microsoft’s customer story, average investigation time dropped from 10 to 12 minutes down to 2 to 3 minutes. Guest account investigations went from 10 minutes to 1 minute, and passwordless phone sign-in issues went from 27 minutes to 2 minutes.

The human side is just as telling. Analysts reported 38% less exhaustion and 31% lower work intensity, and the team handled more than 180 tickets a day during a passkey rollout to 17,000 users. That is the real promise of AI in IT support. Not fewer people, but competent people who are not burned out by the same five problems on repeat.

Security Operations: 30% Faster Incident Resolution

Microsoft researchers studied live security operations across 89 organizations that adopted Security Copilot and 88 similar organizations that did not, covering more than 95,000 incidents. Their published study found that Security Copilot adoption was associated with a 30.13% reduction in mean time to resolution within three months. The authors are careful to note this is an association, not proof of cause, since adopting organizations may have changed other things too. Still, a nearly one-third drop in time to resolve incidents is the kind of number that gets a CFO’s attention, and hopefully, yours.

Breach Economics: $1.9 Million and 80 Days

Zoom out from Microsoft and the broader data tells the same story. IBM’s 2025 Cost of a Data Breach Report found that organizations using AI and automation extensively in security operations saved an average of $1.9 million in breach costs and cut the breach lifecycle by 80 days. With the average U.S. breach now costing $10.22 million, that is not a rounding error. For an SMB, a breach of any size can be an existential event, so shaving weeks off detection and containment matters even more.

SMB Productivity: Up to 353% ROI

On the productivity side, a Forrester Total Economic Impact study commissioned by Microsoft looked at more than 200 small and midsize businesses using Microsoft 365 Copilot. As Microsoft summarized, projected three-year ROI ranged from 132% to 353%, with 25% faster onboarding of new hires and up to 20% reductions in operating costs. Commissioned studies deserve a healthy grain of salt, but faster onboarding is a direct IT win because new employees get productive sooner when their devices, access, and answers are ready on day one.

Why This Matters for Small and Midsize Businesses

Large enterprises have security operations centers, dedicated identity teams, and a cloud architect for every floor. Most SMBs have a few smart generalists, an outside IT partner, and a long to-do list. That is exactly why AI-powered managed IT services matter more for smaller organizations, not less. Here is what it means in practice:

• Enterprise-grade protection without enterprise headcount. Automatic attack disruption and AI-assisted investigation give a 50-person firm a level of response speed that used to require a round-the-clock security team.
• Fewer interruptions for your people. Microsoft’s research found workers are interrupted every two minutes on average. Self-service IT agents and proactive fixes mean fewer of those interruptions come from tech problems.
• Predictable costs, fewer surprises. Catching a failing drive, a misconfigured policy, or a creeping cloud bill early is always cheaper than the emergency version.
• Faster onboarding and offboarding. AI-assisted device setup, access reviews, and offboarding agents make sure new hires are productive quickly and departing employees lose access cleanly.
• Better answers for leadership. AI-generated summaries turn security and infrastructure data into plain-English reports, so business owners can make decisions without a translator.

The Fine Print | What to Watch Out For

We love this stuff, but we are not going to pretend it is magic. There are a few honest cautions before you go all in:

AI is only as good as your foundation. If your devices are not enrolled in Intune, your identities are a mess, or your data permissions are wide open, AI will happily surface that mess faster. Copilot respects existing permissions, which is great, unless your existing permissions let everyone see the payroll folder.

Shadow AI is a real risk. IBM’s research found that organizations with high levels of unsanctioned AI use paid $670,000 more per breach, and 63% of breached organizations had no AI governance policy or were still writing one. Rolling out sanctioned, well-governed AI tools is part of the cure. Ignoring AI and hoping employees do the same is not.

Costs need planning. Some features are included in licenses you already own. Others, like Security Copilot outside of E5 or usage-based Azure agents, are billed by consumption. Without guardrails, consumption pricing can surprise you like a Wrigleyville bar tab after a Cubs win.

Humans still own the decisions. AI agents should handle the repetitive work and recommend actions on the rest. Approvals for sensitive changes, business-impacting decisions, and anything involving client data should stay with people who understand the context.

Automation can misfire. Microsoft builds automatic attack disruption to be reversible and lets you exclude critical systems for a reason. A good IT partner configures those exclusions thoughtfully and reviews what the automation is doing.

How to Get Started With AI-Powered IT Support

You do not need a moonshot. The smartest path is a series of practical steps that each deliver value on their own.

1. Take inventory of what you already own. Many businesses on Microsoft 365 Business Premium or E5 are sitting on AI and automation features they have never turned on. Start with a license and configuration review.
2. Fix the foundation. Enroll devices in Intune, enforce MFA and Conditional Access in Entra ID, turn on Windows Autopatch, and clean up file sharing permissions. This is the unglamorous work that makes everything else safe and effective.
3. Turn on the automatic protections. Configure Defender XDR, including automatic attack disruption, with sensible exclusions for critical systems.
4. Pilot AI where the pain is highest. Pick one or two high-volume problems, such as password and sign-in issues, device compliance, or phishing triage, and measure time spent before and after.
5. Launch a self-service IT agent. Use Copilot Studio to build a Teams-based help desk agent grounded in your own documentation, with a clear escalation path to a human.
6. Set an AI governance policy. Define which AI tools are approved, what data can go into them, and who reviews AI-driven actions. Keep it short enough that people will actually read it.
7. Measure and expand. Track ticket volume, time to resolution, and user satisfaction. Expand what works, and quietly retire what does not.

Finding the right partner | CSW Solutions

Here is the thing about the next evolution of IT support, the technology is ready but it does not configure itself. Somebody has to connect the dots between Intune, Defender, Entra, Azure, and Copilot, set the guardrails, and make sure the AI is working for your business instead of generating a fresh pile of alerts nobody reads.

That is where we come in. CSW Solutions is a Chicago-based all in-house team that lives at the intersection of managed IT, cloud, and AI and automation. We are the folks who get a little too excited about a well-tuned Conditional Access policy, and we will not judge you if you do not share that particular enthusiasm. That is what we are here for.

Here is how we help businesses make the jump to AI-powered managed IT services:

• Microsoft 365 and Azure assessments that show what you already own, what is switched off, and where AI can deliver quick wins.
• Foundation hardening across Intune, Entra ID, Defender, and Windows Autopatch, so AI has clean data and safe permissions to work with.
• Security Copilot and Defender configuration tuned to your environment, including automatic attack disruption with sensible exclusions.
• Custom Copilot Studio agents for self-service IT support, onboarding, and internal knowledge, built around your actual processes.
• AI governance and adoption support that gives your team clear rules of the road and training they will actually use.
• Ongoing managed IT that blends AI-driven monitoring with real humans who know your business, your people, and your quirks.

We work with growing businesses that want big-company capabilities without big-company bureaucracy. Like a good neighborhood spot, we are small enough to know your name and good enough that you will keep coming back. We strive for transparency and efficiency and it shows.

Curious what AI-powered IT support could look like for your team? We would love to grab a coffee or a friendly pint (virtual or Loop-adjacent) and talk it through. No hard sell, no jargon avalanche, just an easy conversation about where you are and where you could go. Reach out to CSW Solutions whenever you are ready.

The rest of this post covers the current lineup, how Anthropic says to choose, what developers and IT managers should do differently, and the migration dates you need on the calendar.

What “Claude Model” Means in October 2026

Anthropic sells one model family in four tiers. Each tier has a version number, and the API ID follows the name: Opus 5.5 is claude-opus-5-5. All four current models have a 1M-token context window and up to 128K tokens of output.

The tier names tell you the trade-off:

• Fable is the frontier tier. It is the most capable and the most expensive.
• Opus is the daily driver. Anthropic recommends it for most workloads.
• Sonnet is the balanced tier: faster and cheaper than Opus, and strong at routine coding.
• Haiku is the fast, low-cost tier for volume and latency-sensitive work.

You will also see Claude Mythos 5.1. Anthropic describes it as the same model as Fable 5.1 with different safeguards, and only organizations approved through Anthropic’s verification programs (currently for cybersecurity and life sciences work) can use it. Most teams can ignore it.

The Current Claude Model Lineup at a Glance

These are list prices on the Claude API, in US dollars per million tokens (MTok).

Haiku 5.5 launched today, October 7, 2026. It is the only current model with tiered pricing: once a prompt goes over 100,000 tokens, every token in that request costs five times as much.

Anthropic also cut the Sonnet 5.5 cache-read price today, from $0.20 to $0.10 per million tokens. At the time of writing, the main pricing table still shows $0.20, but the release notes confirm $0.10.

How Anthropic Says to Choose a Claude Model

Anthropic’s model guidance comes down to five rules:

1. Start with Opus 5.5 for most workloads.
2. Move up to Fable 5.1 for demanding reasoning or long-running agents, but only after Opus at higher effort has fallen short.
3. Use Sonnet 5.5 for everyday coding and agent tasks with a clear scope.
4. Use Haiku 5.5 when latency and price matter most: subagents, classification, extraction, and high-volume jobs.
5. Adjust effort before you switch models. Raising effort on Opus often closes the gap without paying Fable prices. Lowering it on simple turns cuts cost and latency.

Rule 5 is the one teams skip most. A Claude model switch changes behavior, tool handling, and cost all at once. An effort change only changes how hard the model thinks.

Developer Playbook

Claude Code

Opus 5.5 is the default. Type /model sonnet to switch a session to Sonnet when the work is routine: writing tests, small refactors, boilerplate, or explaining code. Switch back for architecture changes, tricky debugging, or multi-file changes that cross module boundaries.

Cursor and Other IDE Copilots

Sonnet 5.5 is a strong coder. Cursor’s docs put it at 55.5% on CursorBench at max effort, second only to Opus 5.5. Two caveats: max effort costs roughly six times more per task than the default, and the score drops to 35.8% at low effort. Sonnet at its default effort is a sensible pick for completion and chat inside the editor. Keep Opus for the hardest tasks.

Computer Use and Browser Agents

Start with Opus. On the Claude API and Google Cloud, Opus 5.5 and Sonnet 5.5 need the generally available computer_toolset_20260801 toolset. The older computer_20251124 tool returns a 400 error on those platforms.

Subagents

If an orchestrator fans work out to helpers that search, summarize, or check things, run the helpers on Haiku 5.5 and keep the orchestrator on Opus. You get most of the quality for a fraction of the token spend.

API Changes to Watch For

Each new Claude model is stricter than the 4.x line:

• Opus 5.5 always thinks. Sending thinking: {"type": "disabled"} or "enabled" returns a 400. Leave out the thinking field and use effort instead.
• Sonnet 5.5 changed how you turn thinking down. To skip up-front thinking, send thinking: {"type": "between_tools"} instead of "disabled".
• No forced tool use. Opus 5.5, Sonnet 5.5, and Fable 5.1 reject tool_choice values of any or tool. Use auto with strict tool use.
• Haiku 5.5 rejects manual budget_tokens and turns adaptive thinking on by default, so responses can start with thinking blocks.

Test these changes in a branch before you change a Claude model string in production.

What a Claude Model Really Costs

List price is only part of what a Claude model costs you. Four things matter more:

• Prompt caching. Cache reads on Sonnet 5.5 cost $0.10 per million tokens, against $2 for fresh input. Coding agents send the same system prompt, tool definitions, and repo context over and over, so caching is usually the biggest single saving available.
• Batch API. Anything that can wait, such as nightly code review, documentation generation, or test triage, costs 50% less through the Batch API. That discount stacks with caching.
• Opus fast mode. Fast mode on Opus 5.5 is a research preview on the Claude API only. It costs $8 / $40 per million tokens, double the standard rate, and does not work with the Batch API. Turn it on only where people are waiting on output and the speed is worth paying for.
• Token counts. Claude 4.7 and later models use a tokenizer that produces about 30% more tokens for the same text. If you budgeted on Sonnet 4.5 or Haiku 4.5 numbers, measure again with the token-counting API.

See Anthropic’s pricing page for the full rate card.

IT Manager Playbook

Set One Org Default and Route Around It

Standardize on Opus 5.5 as the default Claude model. Route high-volume IDE and chat use to Sonnet 5.5, pipelines and subagents to Haiku 5.5, and keep Fable 5.1 as an escalation path that someone has to approve.

Pick the Access Path That Fits How You Buy and Govern

• Claude Team or Enterprise. Best when your users are people working in claude.ai, Claude Code, and the Office add-ins. Enterprise adds the Compliance API, admin user management, and inference hooks (in beta) for policy enforcement.
• Direct Claude API. Best for software you build. New features land here first, including fast mode, which is first-party only.
• Microsoft Foundry, Amazon Bedrock, or Google Cloud. Best when you need your existing cloud contract, identity and access controls, billing, or regional processing. All four current models are available on each. Microsoft Foundry and Claude Platform on AWS bill through their cloud marketplace in Claude Consumption Units at standard rates; on Azure, usage shows up as a single line item in Azure Cost Management.

Privacy, Residency, and ZDR

Data residency. The first-party API supports inference_geo values of global (the default) and us. On Claude 4.6 and later models, us costs 1.1x on every token category. There is no EU option for inference_geo. If you need inference processed in the EU, use regional endpoints on Bedrock or Google Cloud, which carry a 10% premium over their global endpoints.

Fable and Mythos retention. Fable 5.1 and Mythos 5.1 are Covered Models. Prompts and outputs are retained for at least 30 days, and zero data retention (ZDR) is not available by default, including through third-party platforms such as Azure subscriptions. Anthropic is offering a time-limited ZDR option for Fable to eligible customers while it rolls out Enterprise Frontier Safeguards this fall. If your contracts or regulators require ZDR, treat Fable as off the table until you have that approval in writing. Opus 5.5 becomes your ceiling, so plan your escalation path around it.

Standardize vs. Route

Use one Claude model when you have a small team, low volume, or a compliance review that has to approve each model separately. Opus 5.5 everywhere is simple, and it costs less than the previous Opus ($4 / $20, against $5 / $25 for Opus 5).

Route by task once spend is high enough to notice, or once you run agents that make many small calls. Routing adds work: more models to test, monitor, and migrate. Stick to the four-tier routing above rather than tuning model choice per feature.

Claude Model Migration Landmines

• Claude Sonnet 4.5 retires on the Claude API on November 30, 2026. After that, requests will return errors. Move to Sonnet 5.5 now, and test first, because Sonnet 5.5 rejects forced tool use and handles thinking differently.
• Haiku 4.5: migrate as soon as you can. For prompts up to 100K tokens, Haiku 5.5 costs $0.10 / $0.50 per million tokens, against $1 / $5 for Haiku 4.5. It also breaks code that sends budget_tokens, so update your thinking settings and response parsing first.
• Hardcoded model IDs. Search your repos, CI config, and infrastructure-as-code for claude-sonnet-4-5, claude-haiku-4-5, and older IDs. Put the Claude model name in config, not code.
• Thinking blocks. Thinking blocks are tied to where they came from. Sonnet 5.5 silently drops blocks produced in a different, unlinked account, and Fable 5.1 accepts only blocks from the same model or a newer one. Don’t replay conversation history across models or accounts and expect the reasoning to carry over.

Recommended Claude Model Defaults for MSP and Software Teams

This is the setup CSW Solutions recommends to clients today:

For MSPs running Claude across several client tenants, use a separate workspace or cloud account per client so spend limits, keys, and retention settings stay separate. Write the routing rules into each client’s AI use policy so every Claude model choice holds up in an audit.

Frequently Asked Questions

Which Claude model should most teams use by default?

Claude Opus 5.5. Anthropic recommends it for most workloads, and at $4 / $20 per million tokens it costs less than Opus 5 did.

Is Claude Haiku 5.5 cheaper than Haiku 4.5?

Yes, by about 90% at list price for prompts up to 100K tokens ($0.10 / $0.50 against $1 / $5). Above 100K tokens the rate rises fivefold, and the newer tokenizer uses more tokens for the same text, so measure real workloads before you budget.

When does Claude Sonnet 4.5 retire?

November 30, 2026, on the Claude API. Anthropic recommends migrating to Sonnet 5.5.

Can I use Claude Fable 5.1 with zero data retention?

Not by default. Fable 5.1 is a Covered Model with at least 30 days of retention. Anthropic is offering a time-limited ZDR option to eligible customers, so ask your Anthropic or cloud account team.

Need a Hand Picking Your Claude Model?

If you want help setting up model routing, cost controls, or a Sonnet 4.5 migration, we’re happy to talk it through. Reach out to the CSW Solutions team and we’ll help you find the right fit, no deep-dish-sized commitment required.

The moment it was not, for us, arrived with AI. No one kicked a door down or anything, it kind of crept up on us in the same way it might have done so to a lot of people in the tech world. We just looked up one quarter and realized AI was doing real, load-bearing work at several stages of our lifecycle while our unwritten process still quietly assumed a human was doing all of it. That gap is where bad things grow.

So we standardized our software development process, not the fun kind either, where someone makes a slide deck with eight boxes and an arrow and a flash dance. The tedious kind, where you write down what you actually do, discover that maybe half of it is wrong, and argue your way to something the whole team will sign. This post is about that kind of work and the process of standardizing the process. It is less glamorous than a fancy flowchart and about ten times more useful if you are thinking about doing this yourself.

The Tell: Everybody knew the process, nobody agreed on it

The first honest thing we did was stop describing our process out loud and start writing it down. Talking about a process is easy because conversation smooths over the seams but without putting it in writing, it was all just talking and no action. Writing forces you to define each part with words. Is the requirements doc reviewed, or has it been approved? By whom? Before or after the estimate?

We sat down with a whiteboard and listed every stage from the first client conversation to code in production. Eight stages came out of it: discovery, scope, define, plan, build, verify, release, monitor. Nothing exotic. The exotic part was what happened when we first asked each person to describe, in one sentence, what actually happens inside each stage. The sentences did not match. They were not contradictory exactly, they were just different enough that two developers could both follow “the process” and produce different work. That is the tell. If your team cannot independently write the same sentence about a stage, you do not have a standard there, you have a tradition loaded with assumptions. These kinds of traditions are fine enough when you’re starting out but they do not survive growth, turnover, or a new tool that revolutionizes who does the work.

Microsoft’s Well-Architected Framework has a whole section on formalizing development practices, and the part that stuck with us is the framing: standardization is not about control, it is about making the work predictable enough that you can improve it. You cannot tune a process you cannot describe.

Why: AI changed who was doing the work

Plenty of teams talk about standardizing for years and never do it, because there was never really an immediate need or a deadline to the process as long as everything was done on time and within budget. For us, the sideways and yours probably did too, if you’ve made it this far. AI had crept into our day to day with a draft here, a test case there, and a second opinion on a pull request. Eventually, it just became too useful to ignore, too fast to be invconvenient, and eventually completely unaccounted for in any document we had. Our process assumed a person wrote the requirements doc. A person did, sort of, with a lot of help. Our process assumed a person reviewed every line of a pull request and a person did, after something else had already flagged the obvious stuff. None of that was reckless, it was just not written down, which meant nobody could tell you where the human checkpoints were supposed to be. And when you cannot name your checkpoints, you cannot tell whether you still have them. There is no consistency and that can really derail time management in a a team.

So we picked a single organizing question and held it over every stage. When and where does AI come into the equation and who should be reviewing the additional work required to meet expectations? That line of questioning turned out to be the whole project. It is specific enough to argue about and broad enough to apply to discovery, planning, testing, and deploys alike. Microsoft’s own AI-assisted development guidance treats these tools as accelerators inside an existing engineering discipline rather than replacements for it, and that matched what we were seeing in practice. AI is spectacular at drafting, structuring, and speed. It is not the thing you want holding the virtual pen on scope.

Step One: Write the Real Process

The temptation when you standardize is to document the process you would have if everyone behaved perfectly. Resist it, as an aspirational process document is a work of fiction, and your team will read it exactly once. We wrote the current state first, warts included, and some of the warts were embarrassing. There was a stage where “the client signs off” meant an email reply that said “looks good.” There was a period where tickets moved into development without an estimate anybody had actually agreed to, much less kept track of. So, writing it all down in plain language did more to fix it than any amount of process design, because once it is on the page in front of a handful of people, somebody says out loud what everyone was thinking.

Only after the current state was out there did we start making changes, and the changes were smaller than we expected. Most of what we needed was already happening somewhere on the team, just not everywhere, or consistently, or in an order anyone could predict. Standardizing is usually less about inventing practices and more about picking which existing version of a practice wins.

One early decision shaped everything afterward and it was that discovery stays a real, billed, scoped phase. Not a courtesy call, not a free hour before the proposal. We learned the hard way on a past project that speed only helps after you actually know what you are building. Point AI at a fuzzy problem and it will cheerfully help you build the wrong thing much faster than before. Microsoft’s guidance on requirements management for agile teams makes a similar point in a gentler language. The requirement is the unit everything downstream depends on, so it is worth slowing down for.

Step Two: Consistency is Key

We went stage by stage with the same question, and we did not let ourselves skip a box because the answer seemed obvious and well, the obvious ones were where we found the surprises. Take the requirements spec. The answer looked simple enough, AI drafts it and a person reviews it. But asking properly forced two follow-ups. First, what does AI get to work from? We decided, everything. The signed statement of work, the discovery notes, every call recording and transcript, every scrap of prior documentation from the client. More context in, better output. There is no such thing as over-briefing here, and half the bad AI output we had seen was really just under-briefed AI output. Second, what does the human review actually mean? We landed on something slightly heretical. The client signs the spec, and we treat that signature as a strong starting point rather than a frozen contract. Requirements change as you learn. Pretending otherwise just moves the argument to change orders later, which is a worse place to have it. That is what asking the question properly does, and by properly, we mean every single time. It takes a box you thought was settled and turns it into two decisions you now have in writing.

Step Three: Open Dialogue

The most productive hours of this whole effort were the ones that felt least productive at the time. Specifically, the shortcuts we talked ourselves into and then back out of. The biggest one was to let AI turn the requirements spec straight into a finished implementation plan, with developers simply picking up tickets at the end. It is so fast and genuinely tempting but it is the biggest mistake anyone can make with AI. It quietly pushes every misunderstanding downstream to the exact point where fixing it is most expensive. A developer executing someone else’s plan, or something else’s plan, is a developer who does not fully understand what they are building and you find out on the day it matters. So we rejected it, and we wrote down that we rejected it, along with why and that last part matters more than it sounds. Six months from now someone new is going to look at our planning step and think “why is a human doing this, we could automate it.” The document answers them. A standard without its reasoning attached gets quietly eroded by every clever person who joins after you wrote it.

What we kept instead was that spec use cases would become epics, and breaking an epic into tickets is done together by AI, the assigned developer, and the technical lead. AI drafts the first pass. The people who will actually build the thing shape the rest. It is slower on paper but faster in reality, and the developer walks in understanding the work.

Step Four: Make Every Rule Checkable

Here is where a lot of standardization efforts quietly die. You write “tickets should be well defined before development starts,” everyone nods, and nothing changes, because “well defined” is a vibe and vibes do not gate check anything. We forced every rule into something checkable. Our Definition of Ready became four concrete items, and a ticket clears all four or it does not enter the queue:

• acceptance criteria written so they can become tests
• an estimate the assigned developer personally agrees to
• dependencies identified
• a design or mockup attached whenever a UI is involved.

No exceptions, even for the person who wrote the rule.
The acceptance-criteria-as-tests piece turned out to be the quiet MVP of the entire project. When each requirement becomes its own test, three good things happen without anyone doing extra work. Developers know when they are done. Reviewers know what to look for. And AI has an actual target to aim at, which is the difference between AI that helps and AI that produces plausible-looking work nobody can evaluate. Microsoft’s architecture strategies for testing make the same argument from the reliability side, tests defined against explicit criteria are what make a change reviewable at all. The checkability test is a good filter to run over your own draft standard. Read each rule and ask what you would look at to know it was followed. If the answer is “you would just kind of know,” rewrite it or delete it.

Step Five: Label Everything

Not everything we discussed deserved to become a rule, and pretending otherwise is how process documents get ignored. Some things we were sure about and some things we are still figuring out. We labeled everything differently on purpose. One rule we decided on was that we do not run sprints. Work moves through one continuous lane on a single board, pulled rather than assigned, with a strict limit of one ticket in flight per developer. That was a real decision with real tradeoffs, and Microsoft’s documentation on work in progress limits and Kanban generally covers the mechanics better than we could. Our reason for it was specific though, sprint commitments assume you can predict a two-week window, and the pace of AI-assisted work has been changing faster than any two-week estimate anyone would make. A pull system and a WIP limit gave us flow control without asking anyone to forecast something they cannot forecast. In part, it is an openly labeled experiment, whether AI code review should ever skip the human step entirely. We are intentionally undecided. It is an open question across the industry, and we would rather run it as an experiment with a review date than write a policy we do not believe yet.

Another one we admitted in writing was with backlogs running past a hundred items, we do not yet have a clean way to see which tickets are genuinely ready to build. We are piloting checklist tooling and automation rules and that is it, that is the whole entry. Writing “we have not solved this” in your own standard feels bad for about a day and then pays you back forever, because it tells the team where to push and it keeps the document credible.

Step Six: Note Obstacles Disguised As Essential

Every standard needs a small number of things that do not bend. Ours came down to one, a human confirms every release before it ships. Almost everything upstream of that gate now runs itself. Automated tests, a quality and security scan, an AI review pass that checks the change against our standards and leaves comments. Verification is where AI does the most independent work we give it anywhere, the Playwright suite runs first, AI classifies each failure, then AI runs its own exploratory pass against the deployed feature hunting for the cases nobody thought to script. A developer other than the author still confirms every finding and operates the feature by hand before signing off. Microsoft’s Azure App Testing and Playwright Workspaces docs cover running that kind of suite at scale, and the pipeline approvals documentation covers the gate itself.

The reason we drew the line there rather than somewhere else is because the release decision is the only step in the lifecycle where the cost of being wrong lands entirely on the client. Everything else is recoverable inside our own walls. Microsoft’s safe deployment practices guidance treats progressive, verifiable rollout as a discipline rather than a tool choice, which is roughly how we think about the final gate. It is not that we distrust the automation. It is that somebody’s name belongs on the decision. For projects at the right scale, once the pipeline is solid and a rollback plan genuinely exists, we ship qualifying deploy is with a blue-green pattern, which in Azure terms usually means deployment slots and a swap. It is worth being precise about what that is and is not since blue-green only ever fires after the human approval. It is how an already-approved release ships without downtime. It is not a second, quieter way of deciding whether to ship.

Step Seven: Note Obstacles Disguised As Essential

A process you have only tested on a whiteboard is a hypothesis. We ran ours on live client work, which is uncomfortable and also the only way to find out what is actually wrong with it since real projects surface the friction immediately. A stage that reads beautifully takes four days in practice. A checklist item that seemed essential could turn out to be a formality nobody uses. We changed several things after the first pass, including tightening what Design Review covers, because it turned out two different stages were both quietly claiming to approve architecture. We also kept notes on the moments people worked around the process instead of with it because workarounds are diagnostic. When a good developer routes around a step, the step is usually wrong, not the developer. Treat those as bug reports against the standard, not compliance problems, and people will keep telling you about them.

Step Eight: Build the Feedback Loop

The last piece of standardizing is making sure the standard does not rot the moment you publish it. Two things do that for us. The first is technical, after release, nightly regression runs keep going, AI reviews the results, and it opens tickets directly for anything that fails. By the time anyone starts the next working day, issues are already queued and triaged, straight back into planning. Azure Monitor supports the same shape of loop with work item integration from Application Insights, so production reality flows back into the backlog without waiting for somebody to notice. A lifecycle that only runs one direction is a waterfall wearing a hoodie. Yes, we did consider creating an image like that to prove this point. The second is cultural, the document has a version number and an owner, the open questions have review dates, and we expect to be wrong about at least some things. Security is a good example of something we deliberately left room to revise, since the shape of a secure development lifecycle keeps moving as the tooling does. We also published it to the team rather than filing it, because a standard in a shared drive nobody opens is just a very long opinion. Kind of like a blog. ;)

What we learned standardizing our software development process

If you are staring down the same project, here is the short version of what we learned, minus the parts that were specific to us. The best way is to write the current state before the future state, and be embarrassing about it. Pick one question and ask it at every single stage, including the boxes you think are settled. Record the shortcuts you rejected along with every reason why, because that reasoning is the only thing protecting the decision later. Make every rule checkable or cut it. Label your experiments as experiments and your unsolved problems as unsolved. Choose a very small number of gates that never move, and be able to explain why those are there and not others. Pilot it on real work. Build a loop that feeds production back into planning and then expect to revise the whole thing. Review new rollouts because something could have been released that changes everything you just settled on.

And this is all just a note on scale, since we are a small local firm and not a platform org with a process department. Small teams sometimes assume standardization is something you do when you have outgrown something but we found it to be the opposite. A small team that can actually agree on something in a room with a written standard, while everyone still fits in that room, is a standard everyone believes in. Doing it later means doing it to people instead of with them.

None of this is about trusting AI less in the process. It is about being precise regarding what it is good at, which is drafting, structuring, and accelerating, while keeping people working where it actually matters, which is scope, requirements, and the call to ship. We will keep refining it, and we will write about what changes. If you are working through the same questions at your own shop, whether that is your first AI-assisted project or a process document that has not been opened since 2023, we are always up for comparing notes. So, come argue with us. That is rather the point of writing it down.

Here is the good news, and it is genuinely good news. Most of the incidents that generate that pile start with something small and preventable. A password nobody rotated. A firewall nobody patched. A backup nobody tested. The controls that stop them are already sitting inside the Microsoft and Azure licensing you are probably paying for right now. You just have to turn them on and keep them on.

Let us walk through the true cost of a cyber incident, what it looked like for real companies, and which Azure basics do the most work for the least money. If you would rather skip to the part where somebody else handles it, our managed IT and cloud services cover that too.

The Real Cost of a Cyber Incident Starts After the Ransom

IBM’s 2026 Cost of a Data Breach report puts the global average breach at $4.99 million, a twelve percent jump over the prior year, with healthcare leading at $6.6 million. Before you close the tab, fair warning, those averages lean heavily on enterprises with legal departments and eight-figure incident budgets. They are not your number. Your number looks more like the cyber insurance data, which tracks actual claims from actual mid-market companies. Coalition’s 2026 Cyber Claims Report found the average ransomware claim severity landed at $269,000, with initial ransom demands up forty seven percent year over year and eighty six percent of businesses refusing to pay anyway. Business email compromise and funds transfer fraud together made up fifty eight percent of all claims, with funds transfer fraud averaging $141,000 per incident. That last one deserves a moment. More than half of all cyber claims are not dramatic hacker-in-a-hoodie events. They are somebody in accounting wiring money to a bank account that looked exactly right.

So, when you honestly price out the real cost of a cyber incident, you are adding up five separate meters, all running at once:

Add all of these together and the cost of a cyber incident for a healthy SMB regularly lands somewhere between a very bad quarter and the end of the company. Which brings us to the part where that stops being hypothetical.

What the Cost of a Cyber Incident Looked Like for Four Real Companies

KNP Logistics: 158 years, one password

KNP was a UK haulage company running roughly 500 trucks with 700 employees. In 2025, the Akira ransomware group got in by guessing a single employee’s password. They encrypted the servers, the backups, and the disaster recovery environment, then demanded around five million pounds. KNP had cyber insurance and a crisis team on site the next morning. It did not matter. The company collapsed and 700 people lost their jobs. The lesson is not “buy better insurance.” We all know there is no such thing as good insurance! The lesson here is that the backups lived where the attacker could reach them, which is what turned a bad week into the full cost of a cyber incident.

Lincoln College: an Illinois closure

Closer to home, Lincoln College in downstate Illinois survived a fire, the 1918 flu, and the Great Depression across 157 years. It did not survive a December 2021 ransomware attack that knocked out recruitment and enrollment systems during an already fragile stretch, and the school closed permanently in May 2022. The attack was not the only cause. It was the shove.

Change Healthcare: the vendor you did not know you depended on

When Change Healthcare went down in 2024, the ripple effect of the damage flowed out into small independent practices that had nothing to do with the breach. An American Medical Association survey of more than 1,400 physicians, seventy eight percent of them in practices of ten doctors or fewer, found eighty percent lost revenue from unpaid claims, fifty five percent dipped into personal funds to keep the lights on, and thirty one percent could not make payroll. Nobody attacked those practices. They just plugged into something that got attacked, and they absorbed the cost of a cyber incident anyway.

CDK Global: a billion dollars of somebody else’s outage

Same pattern, different industry. The June 2024 CDK Global attack froze dealer management software for thousands of car dealerships, most of them family-owned SMBs. Anderson Economic Group pegged the direct dealer losses at $1.02 billion over roughly three weeks.

Two of these four cases are supply chain incidents, which is not a coincidence. A growing share of the costs of cyber incidents now arrive through somebody else’s network. The cost of just how connected we all are now, without even realizing it.

What Drives the Cost of a Cyber Incident: How Attackers Actually Get In

Verizon’s 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches. Ransomware showed up in 48% of them, third parties were involved in 48% of breaches (a 60% jump year over year), and the human element was present in 62%. Vulnerability exploitation overtook stolen credentials as the leading way in, largely through unpatched internet-facing edge devices. The size skew is brutal. Small organizations accounted for roughly 96% of ransomware victims in the DBIR dataset. You are not too small to be a target. You are the target.

Microsoft’s own telemetry says the same thing from a different angle. The Microsoft Digital Defense Report 2025 found that more than half of attacks with a known motive were extortion or ransomware, that 97% of identity attacks are plain password attacks, and that multifactor authentication blocks more than 99% of identity-based attacks even when the attacker already has valid credentials. Ninety nine percent from a control you already own. Most of the cost of a cyber incident traces back to a login that should have been challenged and was not.

The Azure Basics That Prevent Most of Them

None of what follows is exotic. It is the security equivalent of locking the back door and testing the smoke alarms, and it is where a competent Azure managed services partner spends their first ninety days. Each control below removes a specific line from the cost of a cyber incident.

1. MFA on everything, then make it phishing resistant

Microsoft is not asking anymore. Mandatory MFA for the Azure portal and admin centers finished rolling out in March 2025, and Phase 2 extended enforcement to resource management through Azure CLI, PowerShell, REST APIs, and infrastructure as code starting October 2025. The full policy and timeline live in Microsoft’s mandatory MFA documentation. We also covered this, not too long ago. If you have no policies today, flip on security defaults like, yesterday. It is free, it takes about ninety seconds, and it requires MFA registration for everyone. Then, plan the upgrade to phishing-resistant passwordless authentication with passkeys, because text message codes stopped being a serious control a while ago.

2. Let Conditional Access do the thinking

Microsoft Entra Conditional Access is the policy engine that decides, per sign-in, whether a login gets through, gets challenged, or gets blocked. It reads all the signals like user, device compliance, location, application, and real-time risk. Three policies cover most SMBs; require MFA for all users, block legacy authentication protocols, and require a compliant or hybrid-joined device for anything sensitive. Layer in risk-based policies from Entra ID Protection so a sign-in from an impossible location forces a password reset instead of a shrug.

3. Stop handing out permanent admin

Standing global admin rights are how a phishing click becomes a company-wide cyber incident. Privileged Identity Management makes admin access something a person requests, justifies, and holds for only a few hours instead of forever, which is usually the case for most organizations. Pair PIM with two cloud-only emergency access accounts with long random credentials stored somewhere physical and you have something solid. When Conditional Access misfires at 4:45 on a Friday, and someday it will, those accounts are the difference between a hiccup and a weekend.

4. Patch the edge before somebody else finds it

Vulnerability exploitation is now the leading initial access vector, and favorite targets are the internet-facing boxes nobody owns, VPN appliances, firewalls, and that one server that is still running because a report depends on it. Azure Update Manager gives you scheduled, unified patching for Azure VMs and Arc-enabled servers on premises, with compliance reporting that tells you what actually got patched instead of what you hoped got patched. On the endpoint side, attack surface reduction rules block the specific behaviors ransomware relies on, like Office spawning child processes and scripts launching downloaded content.

5. Backups the attacker cannot touch

This is the one that decided KNP’s fate, and it is the single highest-leverage control on this list. Modern ransomware crews hunt backups first. Microsoft’s Azure backup and restore plan to protect against ransomware lays out their answer. It is the 3-2-1 rule, immutable storage using write once read many, and multi-user authorization so destructive operations require a second approver out of band. Azure Backup ships soft delete on by default, retaining deleted backup data for an extra fourteen days at no cost, and the security features overview covers immutable vaults and the rest. Turn all of it on and then, and this is the part everyone skips, restore something on purpose once a quarter. An untested backup is a rumor.

6. Give your endpoints and workloads a brain

Microsoft Defender for Business is included in Microsoft 365 Business Premium and is purpose-built for companies under 300 seats. Endpoint detection and response, automated investigation and remediation, vulnerability management, and all in a console a human can actually operate. For your Azure and hybrid workloads, Microsoft Defender for Cloud handles posture management and workload protection. If you are already paying for Business Premium and running the free antivirus that shipped with the laptop, you are leaving the good stuff in the box. Microsoft’s security best practices for business is the checklist.

7. Watch, measure, and know when something is off

Prevention fails eventually. Detection is what shortens the incident. Microsoft Sentinel is the cloud-native SIEM that correlates signals across identity, endpoint, email, and Azure, and for an SMB it is usually consumption-priced into something reasonable. For a running scorecard, Microsoft Secure Score measures your posture across identity, apps, and devices and hands you a ranked list of improvement actions. It is the closest thing to a credit score for your tenant, and it makes board conversations dramatically shorter.

The Napkin Math on the Cost of a Cyber Incident

Here is the comparison that truly matters. A thirty seat SMB moving to Microsoft 365 Business Premium, turning on Conditional Access and PIM, hardening Azure Backup with immutability, deploying Defender for Business, and paying a managed IT partner to run all of it, is spending somewhere in the low tens of thousands per year, all in. Try saying all of that in one breath!

The average ransomware claim is $269,000. The average funds transfer fraud loss is $141,000. Neither figure includes the three weeks you did not invoice anybody. You are not buying certainty. You are buying the difference between a Tuesday you complain about and a Tuesday that ends the company. Framed that way, the cost of a cyber incident makes the security budget look less like overhead and more like the cheapest insurance on the balance sheet.

A Thirty Day Plan That Lowers the Cost of a Cyber Incident

Week one. Turn on security defaults or a baseline Conditional Access policy. Block legacy authentication. Inventory every account with admin rights and write the number down, because it will be higher than you think.

Week two. Enable soft delete and immutability on backup vaults. Identify your three most critical systems and confirm you have a restore path for each.

Week three. Deploy Defender for Business to every endpoint. Enable attack surface reduction rules in audit mode first, then enforce.

Week four. Pull your Microsoft Secure Score, knock out the top five improvement actions, and run one live restore test. Document what broke, because something will.

That is a month. It is not glamorous, and it removes most of what actually drives the cost of a cyber incident at a company your size. We even visualized it for you.

Where CSW Solutions Fits In

Let’s be transparent here. Every control above is documented publicly, included in licensing you probably own, and technically available to anyone with an admin login and a free afternoon. The problem was never availability. It is that you already have a job, and it is not this one. Security posture decays quietly, and the cost of a cyber incident is what that decay eventually invoices you for.

What we do at CSW Solutions is own the boring, relentless middle. We are probably one of the few locally managed IT services and Microsoft partners around, and our managed security work is exactly the list above, executed on a schedule and reported on in language a business owner can act on. We design and enforce Conditional Access instead of leaving it half-configured. We keep patching current across Azure and your on-premises servers. We build backups that survive an attacker who is specifically looking for them, and we actually test the restores. We are in your time zone but we watch the alerts at hours when nobody in your office is awake, and we track your Secure Score quarter over quarter so improvement is a number, not a feeling. We work with companies across manufacturing, professional services, healthcare, and distribution. We know what a thirty person firm can realistically absorb, and we know which controls earn their keep first. Nobody here is going to sell you a security operations center you do not need.

If you are not sure where you stand, it is perfectly normal and you’ll be happy to know it is a solvable problem. A short conversation and a look at your tenant will tell you more than another article will. Whenever you are ready, we would be glad to talk. Your business survived a pandemic, a supply chain, and at least one Chicago winter that felt personal. A guessed password should not be the thing that gets it.

FAQ or TLDR

What is the average cost of a cyber incident for a small business? Enterprise averages run near $4.99 million globally, but they are not representative of SMBs. Cyber insurance claim data is the better yardstick: ransomware claims average around $269,000 and funds transfer fraud averages around $141,000, before downtime and lost revenue.

Does cyber insurance cover the cost of a cyber incident? Partially, and increasingly with conditions. Most carriers now require MFA, endpoint detection and response, and tested backups before they will write or renew a policy. KNP Logistics had coverage and still closed, because insurance pays claims, it does not restore encrypted backups.

What is the single highest-value security control for an SMB? Multifactor authentication, especially phishing-resistant MFA. Microsoft’s data shows it blocks more than ninety nine percent of identity-based attacks. Immutable, tested backups are a close second.

Do we need Azure to get these protections? Not entirely. Much of this lives in Microsoft 365 Business Premium, including Defender for Business, Conditional Access, and Intune. Azure adds Update Manager, Defender for Cloud, Sentinel, and immutable Azure Backup for hybrid and cloud workloads.

How do we lower the cost of a cyber incident without a big budget? Start with what you already own. Security defaults or Conditional Access, immutable backups with soft delete, Defender for Business on every endpoint, and one tested restore. Those four steps cost licensing you likely already pay for plus a few days of focused work.

How long does a ransomware recovery take? Two to four weeks is common for an SMB without immutable, tested backups. With them, it is often days. The gap between those two outcomes is the entire argument for doing this work before you need it.

That is the whole thesis of this post in one bug. Sustainable AI engineering is not a sustainability initiative that happens to involve software. It is software engineering, of the ordinary kind, applied to a resource that used to be too cheap to think about. The teams winning on cost, latency, and increasingly on procurement in 2026 are not the ones with the best carbon narrative. They are the ones who treated energy per unit of work as a real engineering constraint, gave it a number, put that number in CI, and refused to ship regressions against it.

You cannot optimize your way out of this at the infrastructure layer, because someone already did

Worth getting this out of the way, because it is the most common misconception in the room. The datacenter is not where your remaining efficiency lives. Microsoft reports a fleet average power usage effectiveness of 1.17 for FY25, meaning overhead costs about seventeen cents of energy for every dollar spent on actual computation. There is not a lot of room left in that number, and none of it is yours to capture. You inherit it the moment you deploy, along with the closed-loop cooling, the renewable matching, and the hardware refresh cadence.

What that means practically: two companies running the same model in the same Azure region have identical infrastructure efficiency and can still differ by an order of magnitude in energy per transaction. The entire delta is architecture and code. And the pressure to close that delta is now external, not aspirational. Microsoft’s own 2026 report disclosed FY25 emissions of 20.29 million metric tons of CO2 equivalent, up 25 percent year over year, driven primarily by AI infrastructure growth. If a company with a carbon negative commitment and effectively unlimited procurement leverage still watched demand outrun efficiency, the lesson for the rest of us is that the fix has to happen where the demand is generated. Which is in the application.

Give it a number or it is a vibe

Software engineering became a discipline when we started measuring things, and sustainable AI engineering crossed that threshold in 2024 when the Software Carbon Intensity specification was accredited as ISO/IEC 21031:2024. The formula is small enough to memorize:

SCI = ((E * I) + M) per R

Energy consumed, times the carbon intensity of the grid supplying it, plus embodied emissions from the hardware amortized over its life, all divided by a functional unit of your choosing.

That last term is the one that matters to engineers, and it is why SCI is useful where a total emissions number is not. SCI is a rate, not a total. Pick your R as one API call, one document processed, one support ticket resolved, one agent run, and suddenly you have a metric that behaves like every other engineering metric you already trust. It goes down when you improve the system and up when you regress it, independent of whether traffic grew. A total emissions number cannot tell the difference between a team that doubled its efficiency and a team that doubled its users. SCI can.

Microsoft publishes a reference architecture for actually computing this on Azure, and it is refreshingly buildable: pull energy and emissions data from the Azure carbon optimization APIs, pull utilization and scaling factors from Application Insights, pull real-time grid carbon intensity from a provider like WattTime or Electricity Maps, land it all in Data Lake Storage because the portal only retains twelve months, compute the score in Azure Functions, and report in Power BI. The baseline itself comes free: Azure Carbon Optimization is included for all subscriptions and reports emissions down to individual resources, with recommendations for SKU changes and idle resource cleanup plus an estimate of the savings before you commit.

A real example of the measurement discipline, because the rigor is instructive: AVEVA published an SCI case study for its System Platform product measured on a single ThinkCentre workstation, using a precision power supply accurate to 0.01 watts. Baseline draw was 11.3 watts, loaded draw was 16.0 watts, giving a software-attributable delta of 4.67 watts. Multiplied across 8,322 annual operating hours at a global average grid intensity of 474.8 gCO2e per kilowatt-hour, plus 70 kilograms of amortized embodied hardware carbon, that produced a score of 0.474 gCO2e per licensed instance per year. Notice what they did not do: they did not estimate, and they did not measure the whole machine. They isolated the delta attributable to their own code. That is the standard.

The model layer is where the joules are

For AI workloads, the single highest-leverage engineering decision is which model handles which request, and the answer is almost never “the biggest one, always.”

Microsoft’s own guidance on optimizing AI workload cost puts real numbers on this. Routing 60 to 80 percent of traffic to smaller models such as GPT-4o mini or Phi-4, escalating to a frontier model only when the small model signals low confidence, typically cuts cost by that same 60 to 80 percent on routine queries with no measurable quality drop. The Azure OpenAI Batch API carries a 50 percent discount for work that tolerates a 24 hour window, which covers nightly index refreshes, evaluation runs, embedding jobs, and most summarization. Scale-to-zero on GPU container workloads saves up to 90 percent of idle capacity for a cold start measured in tens of seconds. Matching the GPU SKU to the model size, T4 or L4 class hardware under thirteen billion parameters instead of reflexively provisioning H100s, saves 40 to 70 percent. Spot capacity for checkpointable batch work saves 60 to 80 percent, and 4-bit quantization via AWQ or GPTQ fits a thirty billion parameter model onto a sixteen gigabyte card.

Microsoft productized the routing insight, which tells you how load-bearing it is. Model router in Microsoft Foundry is a single endpoint backed by a trained classifier that reads each prompt for complexity, reasoning demand, and task type, then dispatches to an underlying model. It ships three modes: balanced considers only models within one to two percent of best available quality, cost widens that band to five or six percent and optimizes hard for high-volume savings, and quality ignores cost entirely. You are billed for whichever model served the request, with no router surcharge.

The engineering work here is not calling the router. It is building the evaluation harness that tells you whether the cheaper path is actually good enough for your traffic, because Microsoft’s percentages are ranges from other people’s workloads. No eval set, no routing. That is the order of operations, and teams that invert it ship a cost win and a quality regression on the same day.

Caching is the other big lever, and it rewards deliberate prompt architecture. Because Azure OpenAI matches on the first 1,024 tokens and then in 128 token increments, the correct design is stable content first and variable content last:

[ system instructions      ]  <- identical on every call, cacheable
[ tool and function schemas]  <- identical on every call, cacheable
[ few-shot examples        ]  <- identical on every call, cacheable
------------- 1024 token boundary crossed -------------
[ retrieved context        ]  <- varies
[ user message             ]  <- varies

Provisioned deployments can see up to a 100 percent discount on cached input tokens, so the difference between a template assembled thoughtfully and one assembled by string concatenation in whatever order the fields appeared in the DTO is enormous. One layer up, semantic caching stores embeddings of past queries alongside their responses in Azure Cache for Redis or Cosmos DB and returns the cached answer above a similarity threshold. For an internal support assistant where four hundred employees ask the same eight questions about expense policy, this converts an inference bill into a rounding error.

Retrieval discipline belongs in the same conversation. Every unnecessary chunk you stuff into context is tokens burned on prefill for no gain in answer quality, and past a point it actively hurts as the relevant passage drowns in filler. Keeping median retrieval count low, tuning chunk size to your actual document structure, and reranking a small set instead of dumping a large one are efficiency decisions dressed up as quality decisions. They happen to be both. Same with structured outputs: constraining the model to a schema instead of asking it to write prose you then parse cuts output tokens, removes a retry loop, and deletes the regex you were going to regret.

Agent architectures deserve a specific warning. An agent loop that re-sends its entire conversation history plus twenty tool schemas on every turn has quadratic token growth baked into its design, and it will look fine in a demo with four turns and ruinous in production with forty. Pruning history, summarizing older turns, and loading tool definitions on demand rather than all upfront are not micro-optimizations at that scale. They are the difference between a feature that ships and one that gets pulled.

The boring application layer, where half the waste actually lives

None of this is AI-specific, which is exactly why it gets skipped. Microsoft’s performance efficiency recommendations for sustainable workloads read like a code review checklist, and the overlap with sustainability is total: reduce chatty API interactions, minimize payload sizes, use efficient message encoding, implement throttling and response caching through API Management, and continuously optimize your highest-volume endpoints. Apply storage compression and fix your database queries. Align data with the right access tier and set lifecycle policies so cold data stops sitting in hot storage. Review your backup, recovery point, and log retention policies so data stops accumulating by default. Choose server-side or client-side rendering based on actual device and network conditions rather than framework fashion. Ship appropriately sized images, skip unnecessary asset downloads, and prefer system fonts. Deploy close to users and keep dependent resources in the same region.

The Well-Architected sustainability guidance is blunter still about the largest sources of waste: idle virtual machines, clusters sized for a peak that occurs twice a year, multi-region active-active topologies that roughly double emissions to defend against a failure mode nobody actually priced, and telemetry pipelines logging the same event at four layers of the stack. Nobody has ever given a conference talk called “We Deleted Eleven Terabytes Of Redundant Debug Logs.” It remains one of the highest-return afternoons available to most engineering teams.

If you want a catalog rather than principles, the Green Software Foundation maintains 62 reviewed patterns organized by lifecycle phase, with 26 in development, 16 in architecture, and 15 in operations, tagged by persona so an AI/ML engineer sees the twelve that apply to them. It is a decent source of pull request comments.

Carbon-aware code, which is now a thing you can actually write

Here is where it gets fun for engineers, because Azure API Management shipped a limited preview that turns grid carbon intensity into a runtime variable your policies can read.

Traffic shifting lets you tag backends with a preferredCarbonEmission level and have API Management prefer greener regions, falling back to higher-carbon ones only to preserve continuity. Traffic shaping exposes context.Deployment.SustainabilityInfo.CurrentCarbonIntensity directly inside policy expressions, so you can extend cache durations, tighten rate limits, or reduce logging verbosity when the local grid gets dirty:

xml

<when condition="@(context.Deployment.SustainabilityInfo.CurrentCarbonIntensity == CarbonIntensityCategory.High)">
    <cache-store duration="3600" />
    <rate-limit-by-key calls="100" renewal-period="60"
                       counter-key="@(context.Request.IpAddress)" />
</when>

That is a conditional. You already know how to write it. The interesting design question it raises is what your application should do when energy is expensive, and the honest answer for most products is: cache harder, defer the deferrable, and degrade gracefully in ways users will not notice. Which is good engineering regardless of the grid.

Put it in the pipeline or it will regress by Thursday

This is the part that separates a one-time cleanup from a durable capability, and Microsoft’s testing guidance for sustainable workloads is the most concretely useful page in the whole set.

Establish CPU and memory baselines by monitoring allocations during unit and integration tests, then configure alerts or outright test failures when the application exceeds them, so unsustainable code changes get caught in review instead of in the next quarterly bill. Cache build artifacts between runs when inputs have not changed, and use local caching on self-hosted agents to avoid network transfers. Split large repositories so CI only compiles what actually changed. Autoscale your build agents so they scale in when testing finishes rather than idling. Profile for parallelization opportunities rather than assuming. Use chaos engineering to verify the system fails gracefully instead of burning resources thrashing, and consider building what Microsoft calls an eco version of the application, a deliberately degraded mode that sacrifices non-essential features to cut emissions, and then test it like any other configuration. Where you have grid data, schedule your heavy integration and load test runs during low-carbon hours.

An allocation budget that fails the build is a strange thing to be excited about, and yet it is the single most reliable mechanism in this entire post. Everything else is a project. A quality gate is a ratchet.

Why this is an advantage rather than a chore

Three commercial reasons, all downstream of the engineering. It is margin. AI features priced per seat and delivered per token mean every avoidable token is gross margin handed to your infrastructure provider. Teams that engineered routing, caching, and batching early can price aggressively against competitors who cannot, and absorb a bad month without an emergency meeting.

It is speed, which is the same variable in different clothing. A tuned small model classifying a ticket in 200 milliseconds is a better product than a frontier model reaching the same conclusion in three seconds with more eloquence nobody requested. Users never notice your joules. They notice your latency constantly.

It is the sales cycle. Enterprise and public sector buyers increasingly put energy and emissions questions in security questionnaires and RFPs, partly from conviction and largely because their own disclosure obligations flow downstream into their vendor list. A supplier that answers with a real SCI figure, a defined functional unit, and a trend line closes faster than one that answers with a paragraph about caring deeply. The number is the differentiator, and the number is a product of your architecture.

CSW Solutions Can Help

Funny thing is, this work sits precisely where our expertise and multitude of practices overlap. On the AI and automation side, we build the routing, caching, retrieval, and evaluation layers that determine what your AI features cost to run, and we build the eval harness first so nobody ships a cost optimization that quietly degrades answer quality. On the custom software side, we can go into the application and fix the architecture generating the waste, because a cache in front of a chatty design is a bandage on a leak, and because most of the savings we find are in ordinary code rather than in model choice. On the managed IT and cloud side, we set up the Azure governance that keeps savings from evaporating in two quarters, a Carbon Optimization baseline, an SCI score with a functional unit that matches how you actually sell, allocation budgets wired into your pipelines, right-sizing reviews, and reporting you can hand to a customer who asks. Try saying all of that in one breath!

We are small enough that whoever scopes your work is whoever does it, and experienced enough to tell you when the answer is “your model selection is fine, your retrieval layer is the problem.” Most engagements start with a two-week assessment. We baseline current consumption, profile where energy and money actually go across the model layer and the application layer, model the savings against your real traffic rather than a vendor’s averages, and hand you a prioritized plan with numbers attached. Then you decide whether we implement it or we help your team to do it.

Efficient architecture used to be something engineers argued for and finance eventually approved. In 2026, it decides whether your AI product has a business model. If you would like a second set of eyes on where your compute is going, we would be glad to look. And if nothing else, go check whether there is a timestamp at the top of your system prompt.

So you have a decision to make, and most legacy application modernization advice sorts itself into two camps that are both wrong. There is the “burn it down and go cloud native” camp, and the “if it ain’t broke” camp. The first is expensive. The second is expensive later, and with less warning. The right camp? It is usually more boring and more specific.

Stop Asking Whether the Code is Bad

That is the wrong question, and it is the one everybody starts with. Code quality is real, but it is a terrible input for a modernization decision, because “this code is ugly” and “this code should be replaced” are not the same statement. Plenty of ugly code is doing exactly what it needs to do at a cost of zero dollars a month. Here are some better questions, in rough order of importance:

Is it a source of competitive advantage, or is it plumbing? If your app encodes something your competitors cannot easily copy, it deserves investment. If it is a glorified form over a database, it deserves a vendor.

How often does it need to change? An app that changes twice a year and an app that changes twice a week have entirely different economics. Technical debt only costs you interest when you keep borrowing.

Who is on the hook when it breaks at 2 a.m.? If the answer is “one person,” you have a bus factor problem, and modernization is one of several possible fixes.

What is it blocking? This is the one that usually unlocks the budget. Not “the code is old,” but “we cannot offer customers a self-service portal, we cannot integrate with the new ERP, and we cannot pass the security questionnaire that our biggest prospect just sent us.”

What does the runway look like? Support dates, license renewals, hardware warranties, and the retirement plans of the two people who understand it.

Microsoft frames the strategic menu as the six Rs of application modernization: rehost, replatform, refactor, rebuild, retire, and retain. Two of those get almost no airtime and really deserve more. Retire is free money if you find an app that three people log into and none of them can explain why. Retain is a legitimate, defensible choice that people treat as cowardice. It is not. It is capital allocation.

For the rest of this post, we are going to collapse the middle of that menu into the three doors most SMB decisions actually come down to.

Door One: Wrap It In An API

This is the option people skip, and it is usually the best one. The idea is pretty straightforward. You leave the legacy application alone, more or less, and you put a modern, well-documented, secured interface in front of it. New systems talk to the interface. The interface talks to the old app, in whatever ancient dialect the old app requires. Nobody else has to learn that dialect ever again. Microsoft calls the design principle here the anti-corruption layer, which is a wonderfully judgmental name for a translation shim. The point here is containment, the legacy system’s weird data model, its odd assumptions, and its 1990s naming conventions stop leaking into everything new you build. On Azure, API Management is the usual front door, giving you authentication, rate limiting, versioning, and a developer portal without having to write any of that yourself.

This is so often the right first move because it is cheap, it is fast, and it is reversible. You can put up a meaningful API facade over a legacy system in weeks, not quarters. It does not require you to understand every line of Kevin’s pricing module. You got that, Kevin? It immediately unblocks the thing that was actually blocked, which is usually integration, not the app itself. It also buys you something subtle. When traffic flows through a facade, you can see it. You get logs, metrics, and a real map of who calls what and how often. Most organizations discover that 80 percent of the calls hit 20 percent of the functionality, which can really inform the entire rebuild conversation later.

There is a bigger payoff hiding here too. That same facade is the setup for the strangler fig pattern, which is the single most useful idea in modernization and is named after a plant that grows around a host tree until the tree is gone and the fig is standing on its own. You route requests through the facade. Then you rebuild one capability, point the facade at the new implementation for that capability only, and leave everything else alone. Repeat. Clients never know. The legacy system shrinks a slice at a time until one day there is nothing left inside it and you turn it off on a Tuesday afternoon with no drama. No harm, no foul.

Microsoft is candid about when the pattern does not fit. If you cannot intercept requests to the backend, or you do not have source access to disable migrated features and redirect internal calls, the fig has nothing to grow on. And if the system is genuinely small, running two systems in parallel is more overhead than just replacing it. That last point is the real cost of door one. A facade means you are running two things instead of one. Temporarily. “Temporarily” has a way of becoming “since 2019.” A wrap without a stated end state is not a strategy, it is a coping mechanism.

Door Two: Re-platform

Replatform, or re-platform, is the move where you keep the application substantially intact and change what it runs on. Microsoft’s shorthand is “lift, tinker, and shift,” which is honest about the fact that there is always some tinkering. In practice, for the SMB stack we see most often, is like when an ASP.NET web app that has been running on a Windows Server VM moves to Azure App Service, and the SQL Server database behind it moves to Azure SQL Managed Instance. It is specifically built to preserve the surface area of on-premises SQL Server so you do not have to rewrite everything that touches it. This is not rearchitecting. You are basically getting out of the patching business, the hardware business, and the “we cannot scale on Black Friday” business.

The results here can be unglamorous and enormous at the same time. In a Microsoft roundup of continuous modernization work, Australian retailer Coles moved from six-week release cycles to weekly, with build times dropping from a couple of hours to 10 to 15 minutes. Credit Europe Bank NV cut customer onboarding from three days to nine minutes. Sapiens reported cutting deployment efforts in half. Notice that none of those are “we rewrote the app.” They are “we changed where and how the app lives, and the business is faster.” Assessment is not optional here, and it is the step people skip because it feels like it is not real work. Azure Migrate does discovery, assessment, and, importantly, dependency analysis, which is how you find out that the “standalone” app has a scheduled job writing to a file share that a completely different department’s Access database reads every night. That file share is not in anyone’s documentation. It is in the dependency map.

And now the cautionary tale, because re-platforming is where the most expensive public failures happen. In April 2018, TSB Bank in the UK migrated to a new core banking platform. The Financial Conduct Authority’s enforcement notice is worth reading in full, but the TLDR is that a significant proportion of the bank’s 5.2 million customers were affected when the platform experienced technical failures immediately after cutover. TSB did not return to normal operations until December of that year. Eight months. The regulators fined the bank £48.65 million between them in December 2022, and TSB paid out £32.7 million in customer redress on top of that.

Here is the part that matters for your business, whatever size it is. The FCA’s finding was not “the code was bad,” it was that TSB “failed to organise and control the IT migration programme adequately” and failed to manage the operational risks of its outsourcing arrangements. The migration failed as a program, not as a technical exercise. Big-bang cutovers concentrate all of your risk into a single weekend, and the only thing standing between you and an eight-month outage is whether your rollback plan is real. The strangler fig exists precisely so you do not have to bet the company on one weekend.

Door Three: Rebuild

Sometimes you do have to start over. The signals are usually some combination of whether the platform itself is dead and unsupportable, the data model actively prevents the business model you need, the cost of change per feature has climbed past the cost of change in a new system, or the thing has become a genuine security liability that no amount of network isolation can fix. When rebuild is right, it is very right. Microsoft’s guidance points at rebuild for highly complex applications, monolith decomposition, and cases where advanced security and compliance requirements have to be designed in rather than bolted on.

But you should always walk into a rebuild with your eyes open, and the best essay on why is a quarter century old. In 2000, Joel Spolsky wrote “Things You Should Never Do, Part I” about Netscape’s decision to throw out its codebase and rewrite the browser from scratch. His argument was that the ugly code you want to delete is ugly precisely because it is full of accumulated bug fixes, each one representing knowledge somebody paid for. Delete the code and you delete the knowledge. Netscape spent years rebuilding while Internet Explorer took the market. Two and a half decades later, the essay still gets passed around engineering teams, which tells you something about how often the lesson needs relearning.

The modern version of the mistake is not “rewrite from scratch.” It is “rewrite from scratch, in microservices, because that is what mature companies do.” Two data points worth sitting with.

Shopify, which is not exactly a small operation, has written openly about the fact that its core commerce platform is still a monolith, just a modular one, with enforced boundaries between components instead of network calls between services. They chose the discipline of microservices without the operational cost of microservices. And in 2023, an Amazon Prime Video team published an internal case study, widely covered at the time, about moving one audio and video quality monitoring workload from a distributed serverless architecture back to a consolidated monolithic service, reporting roughly a 90 percent reduction in infrastructure cost. One team, one workload, not a repudiation of everything, but if the company that popularized service-oriented architecture can look at a specific workload and say “this should be one process,” you can too.

The rebuild that works, in our experience, has three properties. It is scoped to a capability rather than an application. It runs behind a facade so the cutover is a routing change instead of an event. And it has a hard rule that the old system stays running, untouched and unimproved, until the new one has been carrying real traffic for long enough that everyone forgot the old one was even there.

The Failure Mode Nobody Plans For

There is a fourth outcome that is not a door, and it deserves its own section because it is that nightmare scenario that actually keeps us up at night.

On August 1, 2012, Knight Capital Group deployed new order routing code to its production servers. According to the SEC’s administrative order, a technician copied the new code to seven of the firm’s eight servers and missed the eighth. The new code activated its behavior using a flag that had, years earlier, been used by an old feature called Power Peg. Power Peg had been dead since 2003, but the code was never removed. On that eighth server, the flag woke it up. In roughly 45 minutes, the system executed more than 4 million orders across 154 stocks, totaling over 397 million shares. Knight lost more than $460 million. The firm did not survive as an independent company. Nobody at Knight decided to run nine-year-old dead code in production. They just never deleted it, and eventually nobody remembered it was there. That is what legacy risk actually looks like. It is not slow performance or an outdated UI. It is a system containing behavior that no living person can predict. If your reaction to any part of your codebase is “I do not know what that does and I am not going to find out,” that is not a maintenance item. That is the whole business case.

So Which Door? A Legacy Application Modernization Decision Path

Here is the compressed version of the sequence we walk clients through.

1. Start with an assessment, always. Inventory, dependency map, support dates, change frequency, and an honest read on who understands what. This takes weeks, not months, and it is the cheapest investment you will make. Azure Migrate handles the infrastructure side. For .NET specifically, GitHub Copilot app modernization tooling will now assess a codebase and propose and even apply a remediation plan for the Azure move, which has meaningfully changed the cost of the analysis step in the last couple of years.
2. If the app is fine but isolated, wrap it. The business need is almost never “this app is old.” It is “this app cannot talk to anything.” Solve the stated problem first. Then decide.
3. If the app is fine but the floor is falling out from under it, re-platform. Dead operating system, dead database version, dying hardware, unsustainable patching burden. Move it, change as little as possible, and do it in slices with a real rollback plan.
4. If the app cannot express what the business now needs, rebuild the part that cannot. Not the whole thing but the part behind a facade, with the old one still running.
5. If nobody can explain what it does, that is an emergency regardless of which door you pick. Buy the knowledge back through documentation, characterization tests, and observability before you touch anything. Don’t freak out yet, we got you.
6. And if two people log in and neither can explain why, retire it. Go find them, there are usually three of them and they cost more than anyone realizes.

One more thing, because it gets left out of every modernization plan and then eats it from the inside, decide up front who owns the new thing. A facade needs monitoring. A PaaS deployment needs someone watching cost and scaling. A rebuilt service needs an on-call rotation. If the answer to “who runs this” is a shrug, you have not modernized. You have moved the ghost into a nicer house and handed it the keys. A shrug is not an answer. It is the sound a system makes on its way to becoming legacy again.

Where CSW Solutions Fits

We are a local company based out of Chicago, which means two things for you. First, you are going to talk to the people doing the work, not an account manager who relays your questions to a team you never meet. Second, we do not have a bench to keep busy, so we have no incentive to sell you a rebuild when a facade would do. We have talked clients out of rewrites. It is one of our favorite parts of the job.

We work across custom software development, AI and automation, and managed IT and cloud, and legacy application modernization touches all three. Someone has to write the code, someone has to make sure it’s secure and scalable, run the platform afterward, and increasingly someone has to figure out where AI actually belongs in the new system instead of where it looks good in a deck. We build on Azure, and we are deep enough in it to tell you which service is the right fit and which one is just the one Microsoft is promoting this quarter.

A typical engagement starts with an assessment. It comes down to what you have, what it depends on, what is about to lose support, and what it is costing you in the places you have not been measuring. You get a document with a recommendation and a number attached to each option, including the option of doing nothing. Sometimes it says “wrap it, revisit in two years.” Sometimes it says “this needs to be rebuilt and here is the sequence.” Either way you own the document, and you are free to hand it to somebody else.

If Windows Server 2016 or SQL Server 2016 is in your environment, the clock on that is real and it is short. If Kevin’s pricing module is in your environment, the clock on that is unknowable, which is worse.

Either way, the first conversation is free and we will tell you the truth about what we find. Reach out to us any time and let us go look at what you’ve got together. Bring the AC unit story. We collect those.

Previsible’s 2025 AI Traffic Report looked at 19 Google Analytics properties and found that AI referred sessions went from 17,076 to 107,100 comparing January through May of 2025 against the same stretch in 2024. That is a 527% year over year jump, and in one of the accounts they studied, ChatGPT traffic climbed from roughly 600 visits a month to more than 22,000. Legal, finance, health, insurance, and small business services made up about 55% of all the traffic coming from large language models. Which is to say, not sci-fi verticals but your verticals.

Meanwhile, the front door of the internet quietly changed shape. Semrush tracked more than 10 million keywords through 2025 and found that the share of AI Overviews attached to commercial intent queries went from 8.15% to 18.57%, a relative increase of about 128%. Transactional queries went from under 2% to nearly 14%. Translated out of analyst dialect, this was the AI summary used to show up when people wanted to learn something. Now it also shows up when people are getting ready to buy something.

That is the whole story in two numbers. More people are arriving from AI, and AI is increasingly answering the questions that used to end in a phone call to you. This makes AI search visibility, being the company the model actually names, the lead generation problem nobody put on this year’s budget.

The Uncomfortable Middle of the Funnel

Here is the thing nobody ever dared to say out loud at the marketing meeting. For most SMBs, the top of the funnel was never really the website. It was word of mouth, referrals, the Chamber breakfast, the guy who knows a guy. The website’s job was basically to survive the background check that followed.

AI search inserted itself directly into that momentum without a hitch, and it did something more aggressive than Google ever did. It stopped handing out ten blue doors and started giving one answer with footnotes. When a facilities manager types “best commercial HVAC service near Naperville with 24 hour emergency support,” the model does not return a list for them to evaluate. It evaluates for them, names two or three companies, and offers a short reason for each. You are either in that paragraph or you are not in the conversation. There is no page two of an answer.

But the Traffic is Minimal, So Who Cares?

Fair pushback. AI referrals are still a rounding error in most accounts. Microsoft Clarity studied 1,277 domains over eight months and confirmed it. AI traffic grew 155.6% while search grew 24%, social grew 21.5%, and direct grew 14.9%, but even after all that growth AI still accounted for less than one percent of total traffic. Now the part that should make you sit up. In the same study, visitors arriving from large language models clicked through to sign up at a rate of 1.66%. Visitors from traditional search did it at 0.15%. That is roughly eleven times the rate. On subscription conversions, Copilot referrals converted at 17 times the rate of direct traffic and 15 times the rate of search. More than half of the sites in the sample had already turned AI sourced visitors into signups or subscriptions.

Microsoft’s own writeup on how AI search is changing the way conversions are measured, stacks up the corroborating research. 56% of sites saw higher conversions from AI driven sessions, with high traffic sites converting at 7.05% versus 5.81% for organic. AI referrals at 11.4% versus 5.3% for organic across global ecommerce. And Microsoft Advertising reports that Copilot powered buying journeys run 33% shorter and are 76% more likely to end in a lower funnel conversion.

Think about what that means mechanically rather than as a statistic. A nonhuman, digital model just spent four turns of conversation qualifying someone, narrowing the field, and then it named you. The person who clicks your link is not browsing. They have been pre-sold by a machine with no financial stake in the outcome, which, ironically, makes it the most persuasive salesperson you will ever have.

You do not want some of that traffic. You want every bit of it you can get.

What Losing Looks Like

Chegg is the cautionary tale everyone should know. In February 2025 the education company sued Google, alleging AI Overviews had gutted its business. The numbers in the filing were not subtle. Their fourth quarter revenue of $143.5 million went down 24% year over year, a $6.1 million net loss, and non subscriber traffic went down 49% in January 2025 alone. That’s compared to the more feasible 8% decline a couple of quarters earlier. The company was worth under $200 million and trading around a dollar a share by the time it filed.

Chegg’s problem was in a structural way that most SMBs are not. Their entire product relied on answers to questions, which is exactly the thing generative AI does for free. If your business is a service delivered by humans in a specific place, you are not facing that particular guillotine. You are facing a quieter one. If the AI model has nothing useful to say about you, it will say something useful about your competitor. If it cannot find your service area, it picks the company whose service area is written in plain text on a crawlable page. This is not malice. It is retrieval. The model quotes what it can read, verify, and restate with confidence.

And there is a version of this that is worse than being skipped and that is being described incorrectly. Stale hours, a phone number from two offices ago, a service you stopped offering in 2021, or even a certification you let lapse. All of that gets scraped, blended, and delivered to a prospect in a confident tone of voice with your name on it. You do not get a chance to correct the record before the meeting.

What Winning Looks Like

The encouraging news is that many of the companies doing well in this space are not doing anything mystical. They are doing what is legible.

An agency called Intercore Technologies restructured a Chicago personal injury firm’s site around answer first content. They created roughly 50 core pages rewritten to lead with the answer, FAQ sections built out to real depth, a proper legal entity schema markup, and a presence across more than one platform so the model had multiple corroborating sources. The result was a 68% visibility across ChatGPT, Perplexity, and Claude, 156 new clients traced to AI recommendations, about $2.34 million in attributed revenue, and a 16.9% conversion rate on AI sourced leads. Broworks, a webflow development shop, added custom schema, comparison tables, and FAQ blocks. They reported that 10% of its organic traffic was coming from LLMs, 27% of AI referred sessions became sales qualified leads, and that those visitors ended up spending 30% longer on site rather than traditional organic ones. Go Fish Digital ran the play on itself and saw a 43% growth in monthly AI driven traffic and an 83% lift in conversions from that traffic over three months. Apollo.io took a different route entirely, building out a community subreddit and publishing genuinely detailed competitor comparisons. It now sees a 63% citation rate on AI prompts about brand awareness in its category. HubSpot has already collected several of these if you want to read even more about them.

The caveat is that these are self reported agency case studies, not audited financials. Treat the direction as real and the decimal places as marketing. But the pattern is consistent and boring in the best way. Stat your business clearly. Label it so machines can parse it. Make sure more than one source on the internet says the same thing, and you’ll see results.

AI Search Visibility: What Microsoft Actually Tells You to Do

Here is where it gets practical, and where the advice is mercifully concrete, because Microsoft has been unusually forthcoming about this. Copilot is built on Bing’s index, which means Bing’s guidance is not a side quest. It is basically documentation for how to get into an AI answer.

Start with the scoreboard you did not know existed. In February 2026 Microsoft launched AI Performance in Bing Webmaster Tools as a public preview. It shows total citations, how many of your pages get cited per day, which specific URLs get referenced, and the grounding queries the AI used to find you. That last one is the good stuff. It is the closest thing anyone has to getting a keyword report for AI answers, and it is free. If you take one action after reading this, make sure it is verifying your site in Bing Webmaster Tools and opening that tab.

Then fix the plumbing. Microsoft’s guidance on keeping content discoverable with sitemaps in AI powered search is refreshingly specific. Use XML rather than plain text so the metadata survives. Make your lastmod values honest and precise in ISO 8601 format with a timestamp, so it reflects when the page content actually changed and not when your CMS republished the sitemap file. Freshness signals influence both in how fast you get indexed and how accurate the AI answer about you will be. Stop worrying about changefreq and priority, because Bing ignores both. And pair your sitemap with IndexNow, which pings participating engines the moment a page changes instead of waiting for a crawler to wander by. It is a single HTTP request. Most modern platforms have a plugin, and if yours does not, it is an afternoon of work.

Check that the crawlers can get in at all. Microsoft publishes a list of which crawlers Bing uses and a robots.txt tester inside Webmaster Tools. We have found blanket disallow rules in more client robots.txt files than we would like to admit, usually left over from a staging environment or added by a well meaning developer during a scraping panic. Blocking AI crawlers is a legitimate strategic choice for some publishers. It is almost never the right choice for a services business that wants to be recommended.

Write for extraction, not just for reading. Microsoft Advertising published a direct guide on optimizing your content for inclusion in AI search answers, and it reads like a checklist because it really is one. Use JSON-LD schema markup to label what things are: products, services, reviews, FAQs, events, organizations. Break content into modular chunks with real H2 and H3 headings, Q and A blocks, lists, and tables, because models retrieve passages rather than whole pages. Write self contained answers of one or two sentences that still make sense when they get yanked out of context, since that is exactly what happens. Anchor claims in measurable facts, and their example is perfect: “42 dB” beats “quiet.” And do not bury the good part in a tab, an accordion, a carousel, or a PDF. If a human needs to click to reveal it, assume the model never saw it.

That last point deserves its own sentence. Fact density is the whole game. “We serve the greater Chicago area with fast response times” is a sentence a model cannot do anything with. “We provide managed IT support to businesses in Cook, DuPage, and Lake counties, with a one hour response SLA on critical tickets and 24/7 phone coverage” is a sentence a model can quote, and will.

Then measure it honestly. Microsoft Clarity added dedicated channel groups, AIPlatform and PaidAIPlatform, which separate organic links inside AI chat responses from paid placements inside AI products, across ChatGPT, Copilot, Gemini, Claude, and Perplexity. You get sessions, conversions, heatmaps, and session recordings filtered to just those visitors. Watching a recording of someone who arrived from an AI recommendation is genuinely instructive, because they behave nothing like a search visitor. They arrive knowing things. They skip your careful narrative homepage flow and go looking for the one specific fact the model told them about, and if they cannot find it in about ten seconds they leave and go ask again.

One big thing to note is that attribution here is imperfect and everyone knows it. A lot of AI referred traffic shows up as Direct when the source is stripped, and Clarity does not retroactively reclassify history. Which is part of why Microsoft argues in that conversions piece that you should stop staring at last touch clicks and start tracking upstream signals such as citation frequency, impressions in answers, or how queries get refined. Preference now forms before the click, sometimes entirely without one. Their five KPIs for an AI mediated web is a decent starting framework if you like your metrics tidy.

The Credibility Loop Nobody Warned You About

Here is the strategic wrinkle, and it is the reason this belongs on other desks rather than only in marketing. Everything that makes you visible to an AI model is also what makes you look competent to a human. Structured data means someone thought about how your services are categorized. Honest lastmod timestamps mean somebody is maintaining the site. Real service area definitions, specifics instead of adjectives, case studies with numbers in them. A model reads those as retrievable facts. A buyer reads them as a company that has its act together.

The inverse is equally true and considerably more expensive. A site the AI cannot parse is usually a site with a stale CMS, a plugin stack nobody has updated, content written by committee in 2019, and no one clearly accountable for it. Prospects sense that even when they cannot name it. Now the machines are broadcasting it, in complete sentences, to people who asked for a recommendation.

There is also a genuine timing argument, and I say this as someone allergic to false urgency. AI Overview coverage has been volatile: Semrush measured it at 6.49% of queries in January 2025, peaking near 24.61% in July, then settling back to 15.69% by November. Google is clearly still tuning. Commercial coverage kept climbing anyway, and a separate Semrush analysis of more than 600,000 keywords found commercial intent SERPs with AI Overviews grew another 71% between November 2025 and April 2026, with finance up 231%. Zero click rates, for what it is worth, actually dipped slightly, from 33.75% to 31.53%, so the apocalypse narrative was totally oversold. The trend is not that clicks vanish. The trend is that fewer companies get shown, and being one of them is worth more than it used to be.

The window is open because most of your competitors are still arguing about whether this is real. Being early to a channel where a machine hand delivers pre qualified buyers is not a small edge. Ask anyone who bought Google Ads in 2006.

Your AI Search Visibility Checklist for Monday

TLDR? Or if you want the short version, in order, on a scale of hours rather than quarters, we’ve got you covered.

1. Verify your site in Bing Webmaster Tools and look at AI Performance.
2. Ask a few models what they say about your company and your top three service queries, and write the answers down verbatim so you have a baseline.
3. Check robots.txt for anything blocking AI crawlers.
4. Fix your sitemap’s lastmod values and turn on IndexNow.
5. Add organization, service, and FAQ schema to the pages that matter.
6. Rewrite your five highest intent pages so the answer comes first and the specifics are numeric.
7. Turn on Clarity’s AI channel groups so you can prove any of this actually worked.

None of that is glamorous but all of it compounds.
And you’re welcome.

Where CSW Solutions Comes In

Now the part where I tell you what we do, because you have read a couple thousand words and we always give a straight answer at CSW Solutions. We are a Chicago based IT and AI consulting firm. The reason we care about this particular topic is that it sits exactly where our service lines overlap, and it is a rare problem where the technical fix and the revenue fix are the same fix.

On the managed IT and cloud side, we do the unsexy foundation work: getting your site properly indexed, verifying you in Bing Webmaster Tools, cleaning up robots.txt and sitemaps, wiring up IndexNow, and making sure your Azure hosted site is fast, secure, and consistently crawlable. Models cannot cite a page that times out.

On the custom software development side, we do it all. We implement the structured data layer that makes your content machine readable, and we fix the CMS and template problems that bury your best facts inside tabs, accordions, and PDFs. If your service catalog lives in a system that nobody can export cleanly, that is a development problem wearing a marketing costume, and we have solved it a number of times.

On the AI and automation side, we build the monitoring loop. We track what the major assistants actually say about you, catch the moment they start describing you incorrectly, and automate the freshness signals so your published facts stay current without somebody remembering to do it. We also help you keep the internal knowledge that feeds all of this in one governed place, on Microsoft 365 and Azure, rather than scattered across eleven people’s laptops.

If you would rather just get your code up to speed or modernize ERPs in your company, those are fine reasons to call us too. Reach out to CSW Solutions and let us take a look. The models are already answering questions about your business. It would be nice if they got them right.