The WISPs that are started by people with no/little background in NOC operations leave themselves to build, not only insecure, but inefficient networks rather q

The WISPs that are started by people with no/little background in NOC operations leave themselves to build, not only insecure, but inefficient networks rather quickly. I started my career on the network side and have worked for a number of ISPs (small and large). And while a WISP creator can make it - they can also just as easily create a bad product unknowingly. Case in point... I have family that only had one option for Internet service. Long story short a utility owned a WISP and no longer wanted to run it (they ran it OK, but made a number of mistakes when choosing architecture and products to go to market with). One of their employees bought it out and started making worse choices. The owner clearly had never scaled a network nor did this person have any formal training in networks or the protocols he'd have to manage and monitor. I've submitted no less than a dozen vulnerabilities within their network and have had to install a monitoring stack for said family members to show the owner of the WISP that during peak hours they were dropping a significant percentage of packets, latency was spiking and SLAs were not being remotely met. The owner has refused to acknowledge any and all data I've provided to them, saying that "things are working well". Yet, I have now a years worth of logged data in a very consumable format that shows otherwise. The reality is I ended up randomly meeting someone who had worked for them and the conversation was such that the owner was furiously trying to figure out how to fix the problems, but had neither the technical skills to do so or the budget to revamp the architectural flaws. Starting a WISP almost certainly is not for everyone. Getting it working correctly is only one aspect, but keeping an open network secure for your users is not trivial. Not only do you need a working knowledge of multi-user networks but also a decent perspective with regard to the threat models involved. If you can't, minimally, check those two boxes it seems (to me) a bit egregious to expect others to fork over money and trust you for said services.