Who Is Watching Your IT Systems While the Office Is on Summer Break?

Kaspersky’s data for January-April 2026 shows malware attacks targeting SMEs and disguised as popular AI tools (ChatGPT, Claude, DeepSeek) rose roughly five-fold compared to the same period a year earlier; over the same months, attacks hidden behind messaging and video apps like Telegram, WhatsApp, Zoom and Teams passed 415,000. Those numbers are worrying every month of the year, but they carry extra weight in July and August, because the person who would normally notice an attack is usually the one on holiday.

In a 10-15 person office, IT is typically handled by one person, or by an outside provider who monitors during business hours. When that person, or that provider’s day shift, goes on leave, nobody is watching the server, the backup job or the network traffic. If an alert fires, no one sees it. If it doesn’t fire, no one calls to check either way.

Why summer opens a different kind of risk window

Attackers pay attention to the calendar. Periods when internal teams shrink, decision-makers are unreachable, and “urgent approval” requests (an invoice payment, a bank detail change, a delegated sign-off) slip through unquestioned are prime conditions for ransomware and business email compromise. Add a physical dimension on top: a broken air conditioner, a power cut, or a simply full disk can go unnoticed for days while the office sits empty.

The real issue isn’t that “attack risk went up” — it goes up every year regardless. The real issue is that monitoring capacity tends to shrink in the exact same season the risk grows.

Who’s actually watching? Three scenarios, three different outcomes

The same IT setup produces very different results depending on how it’s monitored:

Scenario	Summer coverage	Typical response time	Cost impact
No monitoring, “we’ll call if something breaks”	Nobody, issue surfaces when staff return	Days	Small problems become expensive repairs
One internal person, business hours only	Coverage drops to zero while they’re away	Unpredictable	Full risk sits with the business, no backup person
RMM + MDR, monitored around the clock	Holidays and weekends make no difference	Minutes to hours for P1 issues	Fixed monthly cost, predictable

The third row pairs two things that sound similar but aren’t. RMM (remote monitoring and management) watches infrastructure health — disk space, a crashed service, a missing patch. MDR (managed detection and response) watches behavior — an account logging in at an unusual hour, files starting to encrypt in bulk — with a human analyst in the loop. A business that installs one and assumes the other is covered often has a gap it doesn’t know about.

A checklist before everyone leaves

Five minutes’ worth of checks before the office empties out:

• Has the backup actually completed successfully for the last three days, or has someone just confirmed it’s “installed”?
• Is multi-factor authentication (MFA) enforced on the systems that matter most — ERP, email, accounting?
• Is the emergency contact list current, or are last year’s names still sitting there unused?
• Are unused remote access accounts (VPN, RDP) disabled before the break starts?
• Has holiday-period coverage with your monitoring or support provider actually been confirmed in writing, or is it an assumption?

That last point gets skipped most often. “We monitor 24/7” and “the same team is on call during the holidays” are two different claims. Don’t take the first as proof of the second — ask directly.

What extra summer coverage realistically costs

Adding RMM and MDR on top of an existing IT contract, even just for summer, is usually a modest add-on to a per-user or per-device fee — full around-the-clock MDR on its own costs more. The exact number depends on environment size and the product chosen, so instead of a flat figure, ask any provider for a breakdown: devices monitored, applications covered, and whether human analyst hours are actually included. A quote that’s just a software license and one backed by a 24/7 SOC team should not sit in the same price range.

Frequently asked questions

My IT is a one-person team and they’re about to go on holiday. What should I do? At minimum, arrange temporary RMM coverage, or a holiday-period add-on to your existing support contract, for the systems that matter most: server, backups, email. No monitoring at all doesn’t remove the risk, it just delays discovering it.

Do I need RMM and MDR set up together? Not strictly, but it’s the safer combination. RMM alone tends to catch a ransomware incident late, since it watches infrastructure rather than behavior. MDR alone can leave you unaware that a disk is about to fill up and take a service down with it.

Is holiday-period monitoring actually necessary for a small business, or is it overkill? It depends on scale. A five-person office carries relatively low exposure. A 15-20 person business running an ERP system or holding customer data can see a few unnoticed days cost several times more than an early fix would have. The honest question is what you’d actually lose.

Before the office empties out for summer, let’s review what your current monitoring setup actually covers, and confirm whether “24/7” from your provider means the same thing in August as it does in March — get in touch.