IT support for manufacturers in the Greater Toronto Area
The floor isolated from the office so an unpatchable machine PC can keep running safely, Wi-Fi that reaches the far end of the shop, vendor remote access that is logged and switched off, and the controls your automotive customer and your insurer both ask about. For GTA plants and job shops running Epicor, Sage 300, Dynamics 365 and SolidWorks.
What breaks in a plant, and why the office fix does not work on the floor
A manufacturing operation has two networks that were never meant to meet: the office, with email, ERP and CAD, and the floor, with machine controllers, HMIs and the PCs bolted to equipment that still run an operating system the vendor stopped supporting years ago. The failures we see sit on the seam between them. A CNC’s control PC gets a Windows update it cannot survive.
A ransomware infection that started in an email reaches a machine controller because both were on the same flat network. Wi-Fi that covers the office dies at the first steel column on the floor. The ERP is slow at shift change because the only link to it is shared with the cameras. And there is no maintenance window, because two or three shifts mean the plant never stops.
We set plants up with the floor treated as its own environment. Machine PCs and controllers are isolated on their own segment, reachable only through a controlled path, so a problem in the office cannot cross to the line and an unpatchable machine PC can keep running safely. Updates to office systems are staged around the production calendar rather than Microsoft’s. Monitoring watches the links to the floor and the ERP, not just the servers. And a vendor needing remote access to a machine gets it through a managed, logged connection that is switched on for the job and off afterwards.
Ransomware, supplier questionnaires and what the insurer now expects
Manufacturing is one of the most targeted sectors because downtime is so expensive and so visible. Sophos’s 2025 survey of manufacturers found that exploited vulnerabilities and malicious email were the two most common ways in, that about half of victims paid, and that the mean recovery cost excluding any ransom was over a million US dollars. The GTA numbers are smaller in absolute terms, but a plant that cannot ship for a week loses customers that do not come back.
The pressure to fix this now comes from two directions. Larger customers, especially in automotive, aerospace and food, send supplier security questionnaires before and during a contract, and a weak answer costs the business. Cyber insurers ask the same questions at renewal: multi-factor sign-in on every account, monitored endpoint protection on every computer, backups that cannot be altered and have been test-restored, patching within a set number of days, no end-of-life operating systems reachable from the network, and segmentation between the office and the floor.
Those line up with the Canadian Centre for Cyber Security’s baseline controls, and they are what the managed plan puts in place. For the machine PCs that cannot be patched, segmentation and isolation are the answer the insurer accepts, and we document it that way.
No regulator certifies IT providers, and we do not claim compliance on your behalf. What we provide is the controls, the documentation and the written answers to the questionnaire, so the person signing it knows what is behind each yes.
Manufacturing software and systems we support
The office side of a GTA plant typically runs an ERP such as Epicor Kinetic, Sage 300, Microsoft Dynamics 365 Business Central, SYSPRO or NetSuite, with Fishbowl or a similar tool at the smaller end, and CAD and CAM on SolidWorks, AutoCAD, Inventor or Mastercam. Automotive suppliers add EDI with the OEMs and tier-ones; food producers add traceability and labelling systems; job shops add quoting and scheduling tools. We support the servers, workstations and networks these run on and hold vendor contacts for the applications, so an ERP database fault or an EDI failure goes to the right vendor with the network ruled out.
The floor side is different. PLCs, HMIs and the PCs attached to machines are owned by the equipment vendors and often cannot be changed without voiding support. We do not touch the controllers.
We build the network around them: a segmented floor network, controlled paths to the ERP and to the vendor’s remote support, industrial-rated switches and access points where the environment demands them, and a documented map of what is connected to what, which most plants have never had.
Around both sit Microsoft 365 for email and documents, a hosted phone system reaching the office, the shipping desk and the floor supervisors, time and attendance terminals, cameras and access control, and the label printers and scanners that feed inventory. We inventory all of it in the first weeks and keep the map current.
What the managed plan covers for a manufacturer
The managed IT plan is priced per user per month and covers unlimited remote help desk, on-site visits across the GTA, endpoint protection, email filtering, multi-factor setup and Microsoft 365 backup. For a plant that translates into a few specific outcomes.
- A segmented plant network with the floor isolated from the office, industrial switching and Wi-Fi that reaches the far end of the shop, and a managed firewall with a backup line.
- Vendor remote access that is managed, logged and switched off when the job is done, instead of a TeamViewer account nobody remembers creating.
- Security controls that answer supplier questionnaires and the cyber-insurance renewal, with unpatchable machine PCs handled by isolation and documented that way.
- Backups of the ERP, the CAD library and the file server, with a written recovery order that gets shipping and production scheduling back first.
- Server care for the ERP and file servers, with a replacement plan and updates staged around the production calendar.
- Microsoft 365 with shared mailboxes for orders, purchasing and quality, and licences removed the day someone leaves.
Work with a clear start and finish is quoted as a project before anything begins. For manufacturers that is usually one of these.
- Floor and office network segmentation with a documented map of every connected deviceFixed quote
- Shop-floor Wi-Fi survey and redesign with industrial-rated access pointsFixed quote
- ERP server replacement or move to a hosted platform, cut over between shiftsFixed quote
- Plant expansion or second building: cabling, network, VPN and camerasFixed quote
- Security hardening and written responses for a customer supplier questionnaireFixed quote
What we set up for a typical 80-person job shop
Take a precision machining shop with 20 office and engineering staff, 60 on the floor across two shifts, 14 CNC machines with their own control PCs, an ERP on a server in the office, and a SolidWorks library that is the company’s real asset.
The network is split into office, engineering, floor, cameras and guest segments on industrial-rated switching, with the floor segment reaching the ERP through one controlled path and nothing else.
The 14 machine PCs stay exactly as the vendors delivered them, isolated so they cannot reach the internet or the office, and the map of which machine is on which port lives in the documentation. Vendor remote support comes in through a managed gateway that is enabled per ticket and logged. The ERP server runs on a supported Windows Server version, backed up nightly to a local appliance and off site with the copy immutable for 30 days; the CAD library is backed up the same way with versioning. Engineering workstations are specified for SolidWorks and imaged so a failed one is rebuilt in an afternoon. Office staff run Microsoft 365 with multi-factor sign-in enforced and email filtering in front. Updates to office systems are staged for the plant’s one quiet window, Saturday afternoon, and floor systems are not updated by us at all. The shop answers its automotive customer’s supplier questionnaire from a document we maintain, and the insurer’s renewal form from the same one.
Where we support manufacturers
On-site visits are included in the managed plan across the GTA, and for plants that means the floor as well as the office. The region’s manufacturing sits in Mississauga along Dixie, Tomken and the airport industrial area, in Brampton’s industrial parks, along Highway 400 and Highway 7 in Vaughan and Concord, in the Etobicoke and Scarborough industrial districts of Toronto, whose employment areas hold more than 117,000 goods-producing jobs across some 5,000 establishments, and in Oakville and Milton along the QEW and 401. Markham, Pickering, Ajax, Hamilton and Burlington plants are covered on the same terms, and a plant beyond the GTA is supported remotely with visits arranged as needed.
Questions people ask
Will you touch our machine controllers or PLCs?
No. The controllers, HMIs and the PCs attached to equipment belong to the machine vendors and changing them can void support. We build the network around them: isolated on their own segment, reachable only through a controlled path, with vendor remote access managed and logged. That isolation is also the answer an insurer accepts for operating systems that cannot be patched.
We run two shifts. When do you do maintenance?
In a window agreed around your production calendar, usually a few hours on a weekend, with security fixes that cannot wait discussed with you first. Office systems are updated in that window; floor systems are not updated by us at all.
Do you support Epicor, Sage 300 and Dynamics 365 Business Central?
Yes, along with SYSPRO, NetSuite, Fishbowl, SolidWorks, AutoCAD, Inventor and Mastercam. We support the servers, workstations and networks they run on and hold vendor contacts for the applications, so a database or EDI fault reaches the right vendor with the network already ruled out.
Our automotive customer sent a supplier security questionnaire. Can you help?
Yes. We maintain a written description of your controls, including segmentation, multi-factor sign-in, endpoint protection, backup immutability and testing, patching and vendor access, and we answer the technical sections with you. Where a control is missing we say so and quote what it would take to add it.
What does managed IT cost for a plant?
The managed plan is $125 to $175 per user per month for staff with an account and a computer, which usually means office, engineering, supervisors and shipping rather than every operator. Industrial switching, access points, firewalls and servers are quoted separately, and a segmentation project or a Wi-Fi redesign is a fixed-price project.
Can you cover a second building or an expansion?
Yes. A second plant or an addition gets cabling, network, Wi-Fi, cameras and a VPN link to the main building as a fixed-price project, then comes under the same managed plan. On-site visits across the GTA are included.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.