The brass paperweight on Paul’s desk is a solid hemisphere of lead-weighted felt that hasn’t moved more than three inches in a decade. It sits there like a heavy, polished thumb pinning down a stack of blueprints that no one uses anymore, because everything is in Revit now.

That paperweight represents the old weight of the office-the physical gravity of a founding partner who built this Tribeca architecture studio when the neighborhood still smelled like roasted coffee and wet cardboard instead of artisanal soap. It is an object that demands to be worked around.

The Bruised Purple Tuesday

It is 6:40 p.m. on a Tuesday. The light outside the window is that bruised purple color you only get in Lower Manhattan when the humidity is high. Renata, the office manager, is staring at two browser tabs.

In the first, she has the new IT onboarding checklist provided by their managed service provider. In the second, she has an email from Paul. The subject line is just ‘Login thing,’ and the body is a single sentence: ‘Can you just turn the code thing off for me? I’m on site half the week and it’s slowing me down.’

Renata knows the ‘code thing’ is Multi-Factor Authentication (MFA), or the digital practice of proving you are who you say you are by typing a secondary number from your phone. She also knows that she already approved a bypass for his iPad last month.

She starts to type ‘Of course, Paul,’ then pauses. She deletes it. She types ‘I’ll check with IT,’ then deletes that too. She is currently the only person in the office besides two junior designers who are huddled over a rendering of a staircase, and she knows that if she grants this one exception, the entire security posture of the firm is effectively dead.

The problem with a twelve-person office is that there is nowhere for a double standard to hide. In a massive corporation, the CEO might have an assistant who handles their logins, and the rank-and-file never see the breach in protocol. But in a small studio, the receptionist sees the managing partner skip the line.

The Broadcasting of Vulnerability

The office manager hears the complaint about the ‘annoying’ security prompt. By Wednesday morning, the junior designers will be asking why they have to use the authenticator app if Paul doesn’t. Renata is the one stuck enforcing a rule that the person who signs her paycheck has decided is beneath him.

That moment of accidental visibility-of being caught in a state that didn’t match the professional ‘policy’ I usually project-is exactly what happens when leadership asks for an IT exemption. You think you’re just making your own life easier, but you’re actually broadcasting your vulnerability to the entire room.

The Myth of Technical Security

I used to believe that security was a technical problem. I thought if you just bought the right firewall and the right encryption-which is basically a digital secret decoder ring that turns your files into gibberish for anyone without the key-you were safe. I was wrong.

I spent three years telling clients that their biggest risk was a rogue hacker in a hoodie. It wasn’t. The biggest risk is the most powerful person in the room deciding that the rules are for the people who report to them. In a twelve-person firm, security isn’t a setting; it’s a social contract. When the leader opts out, the contract is shredded.

Small organizations run on unwritten rules about who is allowed to be ‘difficult.’ Usually, that privilege is reserved for the person with the most talent or the most equity. But IT is the great equalizer.

A phishing link (a fake email designed to trick you into giving away your password, or digital bait for the gullible) doesn’t care if you founded the firm in 1994. In fact, hackers prefer the partners because they have the highest level of access. If Paul’s account is compromised because he didn’t want to spend four seconds typing a code, the intruder doesn’t just get Paul’s emails; they get the keys to the entire kingdom.

The Stress Fractures in the Clay

“They don’t look for the strongest part of the jar; they look for the stress fractures. They look for where the clay was thinnest, which was usually where the potter got tired or lazy toward the end of a long day.”

– Maya C.M., archaeological illustrator

Security in a small business is exactly like that clay. The policy document is the beautiful, symmetrical design of the jar, but the ‘upward exemption’-the boss deciding they are too busy for the rules-is the stress fracture. It’s where the structure is thinnest.

When an MSP (a Managed Service Provider, or the team you hire to be your external IT department) rolls out a new security baseline, they are trying to bake the clay evenly. But they can only do their job if leadership supports the process.

If the managing partner treats the security rollout as an optional inconvenience, the rest of the staff will treat it as a joke. Renata knows that if she clicks ‘disable’ for Paul, she is effectively telling the other 11 employees that their data doesn’t actually matter.

The Real Face of Functional IT

Most small business owners in New York City are surprised to learn what actual, functional IT support should look like. They are used to ‘break-fix’ guys who show up only when the printer is screaming. They don’t realize that a real partner provides vCIO advisory (a Virtual Chief Information Officer, or a person who tells you how to spend your tech budget so you don’t waste it on shiny toys).

This advisory only works if it’s based on transparency. You need to know what you’re paying for, and you need to know that the rules apply to everyone from the intern to the owner. This is where InterDataLink finds its footing, by insisting on a standard that doesn’t buckle under the weight of a partner’s ego.

In a twelve-person firm, the office manager often has the least authority but the most responsibility for enforcement. Renata shouldn’t be the one to tell Paul no; the policy should tell Paul no. But policies are just ink on paper unless they are modeled.

When a firm treats security as a technical setting someone configures once, they are missing the point. It is a habit. And habits are dictated by the person at the top of the food chain. If the silverback gorilla doesn’t think the fence is necessary, the rest of the troop is going to start looking for the exit.

The Erosion of Culture

I’ve seen this erosion happen in other ways, too. It starts with the MFA code. Then it’s the password requirements (which are usually a mix of uppercase, lowercase, numbers, and symbols, or a sequence specifically designed to be forgotten immediately after you create it).

Then it’s the ‘shadow IT’ where a partner starts using their personal Gmail because the company server is ‘too slow.’ Each one of these is a tiny leak. Individually, they don’t sink the ship. But collectively, they create a culture where the ‘real’ rules are just whatever is most convenient for the person in the corner office.

The cost of these exceptions isn’t just measured in the risk of a data breach. It’s measured in the loss of respect for the office manager. Every time Renata has to explain to a junior staffer why they have to follow a rule that Paul ignores, her professional capital is spent.

She is forced to defend an absurdity. (This is known as ‘cognitive dissonance’ in psychology, or the mental gymnastics required to believe two conflicting things at once). Over time, this is how you lose your best people. They don’t quit because of the software; they quit because the leadership is exempt from the reality everyone else has to live in.

The Walk Toward the Door

The reality of NYC business is that everything is more expensive-rent, coffee, and certainly IT support. Rates in the city often run 23 percent higher than the national average. When you are paying that kind of premium, you cannot afford to let the person at the top undermine the very systems you are paying to implement. If you are going to invest in a security baseline, you have to be willing to live inside it.

Renata finally stops typing. She doesn’t send the ‘Of course’ email. Instead, she gets up from her desk and walks toward Paul’s office. He is still there, looking at a site photo on his phone, squinting through his expensive glasses. She realizes that her job isn’t to be the person who says ‘yes’ to the boss; her job is to be the person who protects the firm, even from the boss.

“Paul,” she says, “about that code thing. If I turn it off for you, I have to turn it off for everyone. And I don’t think you want to be the reason we have to tell the client their designs were leaked because we didn’t want to type six digits.”

– Renata, Office Manager

Paul looks at her. He looks at the brass paperweight. He looks back at his phone. There is a long silence, the kind that usually precedes a lecture or a concession. He sighs, a sound that carries the weight of a thousand billable hours.

“Fine,” he says. “Show me how to make the app stay logged in for eight hours at least.”

It’s a small victory, but in a 12-person office, small victories are the only ones that actually hold the walls up. Renata walks back to her desk. The purple light outside has turned to a deep, ink-wash black. She checks the box for Paul’s MFA enrollment. She doesn’t feel like a hero; she just feels like someone who finally made the rules real.

The office was quiet now, the only sound the hum of the HVAC system trying to cool 12 different computers that were all, finally, locked behind the same door.