Previously – https://blog.ciaops.com/2026/07/28/the-recurring-problem-a-managed-services-story-chapter-3/
Denise Okafor called on a Thursday in February, and this time there was no anger in her voice at all, which was somehow worse. “We’re moving our IT relationship to Meridian Health IT at the end of our contract term,” she said. “They only work with medical practices. Their entire pitch was built around HIPAA and nothing else. Dave, I like you. I’ve liked working with Bridgepoint for six years. But I can’t keep explaining to my board why our IT provider treats a medical practice exactly the same as a landscaping company. We need a security team that speaks our language natively, not one that’s learning it because we complained.”
Bridgepoint’s ninety-day notice clock started that afternoon. $640,000 in annual revenue — nearly seven percent of the company’s total — was walking out the door, and it was walking toward a competitor that had done exactly one thing Bridgepoint hadn’t: picked an industry, gone deep, and built a service around that industry’s specific compliance reality instead of a generic bundle stretched to cover everyone.
Dave took the loss personally, because it was personal — Lakeside had been one of his first ten clients — but the number that actually kept him up that week wasn’t the $640,000. It was something Marcus said almost in passing, trying to soften the blow: “At least it wasn’t Baptiste. If we lost Baptiste on top of this, that’d be real trouble.”
Baptiste Manufacturing was Bridgepoint’s single largest client, at just under 19 percent of total revenue — a family-owned metal fabrication company that Tom Baptiste had built up from his father’s two-man machine shop. Dave hadn’t thought about customer concentration in those terms before. He thought about it constantly after that.
Two weeks later, he got a call from Tom that gave him a preview of exactly how that could go. Baptiste’s plant manager had started using a free AI chatbot to draft supplier emails and, it turned out, to summarize confidential pricing data from a shared drive he didn’t fully understand the access permissions on. Nothing had leaked — yet — but Tom had found out from his own son, who worked on the shop floor and had seen it happening, and he was furious that nobody at Bridgepoint had ever mentioned that this was even a risk worth managing.
“You guys handle our computers,” Tom said. “Isn’t this exactly the kind of thing you’re supposed to be telling us about?”
Dave didn’t have an answer for that either. Bridgepoint had never offered anything resembling a policy for how clients’ own employees used AI tools, because as recently as eighteen months earlier, it hadn’t occurred to anyone that this was IT’s job to manage. It clearly was now. Somebody was going to own that conversation with clients. Dave just didn’t know yet whether it would be Bridgepoint or whoever Bridgepoint’s next competitor turned out to be.
CIAOPS 