Our managed helpdesk is not a single tier of support. It is a layered operations stack where every component addresses a specific failure mode. Here is what each layer does and what happens to the Richmond region businesses that skip it.
Tier 1 — ConnectWise Manage
Tier 1 Helpdesk: Immediate End-User Support
Tier 1 covers the day-to-day support requests that consume your employees’ time if they are not resolved quickly: password resets, MFA device issues, Microsoft 365 access problems, printer connectivity, VPN configuration, software installs, and basic hardware troubleshooting. Every Tier 1 ticket is answered by a live engineer — not a chatbot, not a voicemail, not an email queue that clears when someone gets to it. Target response: 15 minutes for critical issues, same business day for standard requests. For the Richmond region businesses across all industries, Tier 1 resolution speed is the metric your staff notices most directly in their workday.
Prevents: productivity lost to unresolved access issues, shadow IT workarounds that introduce security risk, and staff frustration that turns IT problems into HR problems.
Without it: a paralegal locked out of her Microsoft 365 account at 8 am waits four hours for a callback. The deposition brief does not get filed on time. The attorney pays the price for an IT problem that should have resolved before breakfast.
Tier 2/3 — Escalation Engineering
Tier 2 and Tier 3: Infrastructure and Incident Escalation
Tier 2 handles issues beyond Tier 1 scope: server errors, application integration failures, email flow problems, network segmentation issues, and team-wide outages. Tier 3 handles infrastructure-level escalations: server replacements, storage failures, complex Microsoft 365 tenant issues, firewall configuration changes, and active security incident response. Capital Techies maintains a bench of engineers at all tiers so escalations move immediately — not to a queue, but to a named engineer with context already pulled from the ticket. For CMMC Level 2 compliance, Tier 3 incident documentation supports the incident response and audit logging requirements in NIST SP 800-171.
Prevents: helpdesk tickets dying in an escalation queue with no ETA, critical server issues waiting for a solo IT contractor to become available, and security incidents handled by technicians without the authority or tooling to contain them.
Without it: a server error at 4 pm becomes a full outage by 5 pm because the Tier 1 tech who took the ticket cannot escalate to anyone with access to the server room configuration.
24/7 On-Call — ConnectWise Automate
Remote Monitoring and After-Hours On-Call
Agents running on every server, workstation, and network device report health, performance, and security events to our operations center continuously. When a drive health threshold is crossed, a service crashes, or an anomalous process starts running, the alert reaches an engineer before a user files a ticket. After-hours on-call means a Priority 1 event at 11 pm on a Saturday — ransomware activity, server down, internet outage, Microsoft 365 inaccessible — reaches a live engineer within 15 minutes. For the Richmond region defense contractors, on-call is a compliance requirement: the 72-hour DFARS incident reporting clock does not stop on weekends. For Richmond hospitality businesses, Friday evening is not after-hours — it is peak hours. On-call coverage is included in our managed plans, not sold as an add-on.
Prevents: Saturday-night outages that become Monday-morning disasters, ransomware dwell time that compounds because no one was watching when the alert fired, and DFARS reporting deadlines missed because the IT vendor was unavailable.
Without it: the property management system authentication failure that fires its first alert at 6 pm Friday gets investigated at 9 am Monday — 63 hours later, after a lost weekend of revenue and a front desk running on paper.
SentinelOne + Microsoft Defender
Endpoint Detection and Security Incident Response
SentinelOne’s AI-driven endpoint detection and response runs on every managed endpoint, detecting behavioral indicators of ransomware, credential theft, and lateral movement faster than signature-based tools. Microsoft Defender for Business is layered across the Microsoft 365 environment, covering email, identity, and cloud application threats. When either platform generates a security alert, it flows into our helpdesk as a Priority 1 incident — not into a secondary tool that nobody checks. Engineers contain the affected endpoint, preserve forensic evidence, and begin remediation immediately. For CMMC Level 2, endpoint protection and incident logging are core control requirements under NIST SP 800-171. For HIPAA-covered entities, the endpoint protection layer is part of your technical safeguards documentation.
Prevents: ransomware spreading across the network during the hours before a technician arrives on-site, breach incidents that go undiscovered for months, and compliance findings for missing endpoint security controls.
Without it: the ransomware that hits one workstation at 2 am has six hours to spread before anyone arrives. With it, the endpoint is isolated in minutes and a Tier 3 engineer is already working the incident.
Cisco Meraki
Network Management and Helpdesk Network Support
Cloud-managed firewalls, switches, and wireless access points with continuous monitoring, intrusion prevention, and network segmentation managed by our operations center. When a switch port fails, a VLAN misconfiguration creates a performance bottleneck, or a firewall rule change breaks an application, our engineers have remote visibility into the network topology and can diagnose and resolve without waiting for on-site access. For Richmond hospitality businesses, we segment guest Wi-Fi from the property management system and the cardholder data environment — a PCI DSS v4.0.1 requirement. For defense contractors, boundary protection and network segmentation are CMMC access control requirements. Network tickets resolved remotely, not after a site visit.
Prevents: flat-network ransomware spread, PCI scope creep from unsegmented guest networks, firewall misconfiguration drift that opens security gaps, and network outages that wait for an on-site technician when remote diagnosis would take ten minutes.
Without it: a guest device on your hotel Wi-Fi sits on the same network as your PMS server. When that device is compromised, your cardholder data environment is one hop away from an attacker with full network access.
KnowBe4
Security Awareness Training and Phishing Simulation
KnowBe4 delivers automated security awareness training and simulated phishing campaigns to your staff — the layer that reduces the volume of helpdesk tickets generated by human error. Phishing clicks, credential submission to spoofed login pages, and unsafe email attachment handling are the leading causes of initial access in breaches across all the Richmond region industries. KnowBe4 simulations identify high-risk users before a real attacker does, and the training modules address the specific social engineering patterns targeting the DoD supply chain, healthcare, hospitality, and professional services verticals. When a user correctly identifies and reports a phishing simulation, that is a helpdesk success that never required a ticket.
Prevents: credential theft via phishing, malware delivery through email attachments, and the downstream breach incidents and helpdesk remediation tickets that a single successful phish generates.
Without it: a Glen Allen defense contractor employee receives a spoofed email appearing to come from an HII program office. She clicks the link, enters her credentials, and the attacker is inside the network before the next helpdesk shift begins.
Vulnerability Management
Vulnerability Management and Patch Oversight
Our vulnerability management platform provides continuous vulnerability scanning across your endpoints and infrastructure, identifying unpatched software, misconfigured services, and known exploitable conditions before attackers find them. Vulnerabilities discovered through scanning feed directly into our patch management workflow — ConnectWise Automate deploys patches on a managed schedule aligned to criticality and your change management preferences. For CMMC Level 2, patch management is a required control under NIST SP 800-171 SI-2; documented patch schedules and scan results support the audit evidence requirement. For Virginia’s breach notification law (Va. Code 18.2-186.6), demonstrating a proactive vulnerability management program supports the “reasonable security measures” defense in a breach investigation.
Prevents: ransomware entry through unpatched vulnerabilities, compliance audit findings for missing patch documentation, and the breach events that follow when known vulnerabilities sit unpatched for months because nobody is tracking them.
Without it: a critical Windows vulnerability published in February sits unpatched on seven workstations in June. A ransomware group that has been exploiting that exact vulnerability for four months finds it on your network through an automated scan. The helpdesk ticket that follows is a very different kind of ticket.
On-Site Dispatch
On-Site IT Support Across All Seven Cities
Remote resolution handles the majority of helpdesk tickets — typically 80% or more. When physical access is required — hardware replacement, server room work, cable troubleshooting, conference room AV diagnosis, or a situation where remote tools cannot reach the affected system — Capital Techies dispatches an engineer to your location across all of the Richmond region: Richmond, Henrico, Chesterfield, Short Pump, Glen Allen, Hanover, Midlothian, and the broader metro. On-site dispatch is included in our managed plans; there is no per-visit charge that makes you hesitate to call when you need physical hands. For multi-location organizations across the Richmond region, on-site support under a single managed agreement eliminates the fragmented vendor problem of having a different local IT shop for each office.
Prevents: hardware failures that linger because nobody can authorize an on-site visit, conference room AV outages the day of a client presentation, and the cost of managing separate IT vendors across multiple the Richmond region locations.
Without it: the server room in your Chesterfield office needs a drive replaced. Your IT vendor is based in Richmond and charges a $250 trip fee. The decision takes two business days. The server runs on a degraded array through the weekend.
