@cbacigalupo These are different ways of approaching and managing released platforms (regardless of the underlying technology). You mentioned large companies like Toyota Argentina, and in that case, it doesn’t surprise me that the Client gets involved in the details. If you have a management contract, it’s normal for the Client to “not want to know anything” and to take aspects like security and maintenance for granted. The situation changes when the Client is small to medium-sized; they fundamentally lack the awareness, and if elements like security and maintenance aren’t properly conveyed, it’s clear that the “uninformed” Client doesn’t appreciate any input, failing to recognize its added value. In your case, where you sell and manage the infrastructure/hosting side, it obviously allows you to “bury” routine maintenance in the costs, but you understand that it wouldn’t be sustainable otherwise (no one works for free). This is why small Clients find themselves in two situations: automatic updates and disabled updates. In this case, two scenarios emerge: – Automatic updates > risk of ending up with the site locked down in case of plugin and/or script collisions, and NO ONE assigned to fix the problem. – Disabled updates > risk of being exposed to potential attacks and system breaches. From my personal experience, we’ve acquired many Clients who found themselves in these two situations, who subsequently not only appreciated the contribution to restoring the platform but expressly asked to be followed as a focal point for any problem related to the site (mail, backups, updates, etc.). Finally, regarding your statement where you claim to give more importance to “core error to a security breach,” some considerations need to be made. First of all, the “cost and benefit of this approach” must be evaluated, assessing together with the Client whether they are willing to run the risk of service downtime and, at the same time, assessing the risk of exposure to potential new breaches (imagine an e-commerce that doesn’t work for hours or days). There are many solutions that can be implemented (creation of test and development environments, creation of redundant clusters, backup and restore systems), but as you rightly pointed out, it all depends on how much the Client is willing to pay. Everything else we experience daily is history…
Warm regards
Alessandro
