Hi everyone,
I’m facing a challenging situation at work and could use some advice. I work as an IT support specialist at a family-owned health business, and my boss has repeatedly refused to upgrade an outdated Windows 7 system despite significant security risks and operational issues. The system is no longer supported by Microsoft, is vulnerable to serious exploits, frequently crashes, and has outdated BIOS firmware.
I’ve asked my boss multiple times over the past two months to upgrade the system, but he has consistently refused, insisting that we have enough security measures in place. However, I’m not confident in these security measures, as the system is connected to the internet and it can literally be hacked by a exploit within the operating system, potentially bypassing all of our firewalls. (e.g. EternalBlue, BlueKeep)
I’ve prepared a new system with Windows 10 as a backup, ready to be deployed if the current system fails. I’ve also laid out a plan that would cause minimal disruption, allowing the employee who uses this system to temporarily use the software on his laptop while we make the switch. Despite this, my boss still refuses and has become visibly frustrated with my repeated requests. I’m worried about getting fired for taking the initiative to address this critical issue.
The Windows 7 system connects to our main server to access a specific piece of software via the web browser, which we host locally. It would be a straightforward replacement, but my boss’s resistance and erratic behavior make it difficult to move forward.
I’m considering talking directly to the owners about this issue, as my boss’s refusal puts our operations at risk, but I’m concerned about potential repercussions. I want to ensure I handle this professionally and protect myself from any blame if a security breach occurs.
Most of my requests have been verbal, and an email I sent to my boss about upgrading was never responded to. I’m looking for advice on whether I should discuss this with the owners directly, the potential risks and benefits of taking this step, and how I can best document my efforts to protect myself. I definitely feel like I’m going to be used as a scapegoat. I’m also planning on seeking employment elsewhere after I get my Network+. This is my first IT job, I’ve only been working here 3 months and I already want to leave.
I appreciate any advice or experiences you can share. Thank you!
to emphasise something missed - you said the employee using the old machine asked for an upgrade?
make sure you have it in writing. from them, in a full clear email, what they want and exactly why they want it. They need to be verbose enough to cover every point. (it’s okay to secretly help them, but do NOT have your fingerprints on it).
Then, reply and forward that email to your boss, with your professional opinion of their request and their reasons for it.
Include cost for proceeding, and what the costs will be for doing nothing.
Acknowledge that this matter has been spoken in person, an apologise for the informal tact; that this email is intending to follow proper procedure, which you will continue to do in the future.
Ask to confirm their response so you can officially deal with the matter one way or another.
The main thing to add, to clarify: you are the middle man. Don’t make it look like you are the one wanting to do this. The employee is. You are wanting to do your job, which is dealing with problems that are brought to you.
These seems more like a tactic you’d use at a big corporation since everyone has a boss above them. At a small clinic like this, it’s probably fruitless as the stubborn owner isn’t going to stop being stubborn over an email and documentation.