> What’s the alternative given that most small/medium-sized companies know very little about IT security? Removing the "remote" from "remote administration".

> What’s the alternative given that most small/medium-sized companies know very little about IT security? Removing the "remote" from "remote administration". It's more expensive but probably still not cost-prohibitive -- driving around to client sites and installing updates is not particularly skilled labor. Plus even the worst-case scenarios are far less worse because you already have a local workforce who can do site visits to manually recover systems locked down by ransomware attacks. Data might get stolen, but at least you have continuity of business.