FAQ
Questions IT teams ask us most
The Storcom FAQ answers the questions IT managers ask most about AI, security, cloud, backup, disaster recovery and infrastructure, from shadow AI and managed EDR to RPO vs RTO, immutable backups and VMware licensing. Each answer stands on its own and reflects how Storcom designs, delivers and supports these services for IT teams of every size.
Last updated
AI
What is shadow AI?
Shadow AI is the use of AI tools that IT has not reviewed or approved, often on personal accounts. It matters because company data can leave in prompts and uploads with no record. Storcom finds it using the endpoint, firewall and cloud telemetry you already collect.
Do we need new security tools to govern AI?
Often not at first. Identity, endpoint protection, firewalls and cloud posture tools can enforce most of an acceptable-use policy once they are tuned for it. Where a gap remains, we recommend a specific tool and explain what it adds.
Should we block AI tools entirely?
Blanket blocking usually pushes use onto personal devices where you can see nothing. Most organizations do better with a short list of approved tools, clear rules on what data may be entered, and monitoring. Storcom helps you set that list and enforce it.
What is the NIST AI Risk Management Framework?
The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance published by the U.S. National Institute of Standards and Technology in January 2023. It organizes AI risk work into four functions: Govern, Map, Measure and Manage. Storcom uses it as the structure for AI policy and controls.
What is AI Detection and Response (AIDR)?
AIDR is security tooling that monitors how users, applications and agents interact with AI, detects risky or malicious activity such as prompt injection and data leaks, and enforces policy. CrowdStrike Falcon Guardian is the AIDR capability of the Falcon platform.
What infrastructure does an AI workload need?
It depends on the workload. Training and fine-tuning need GPU servers, fast storage and a high-throughput network. Inference needs less compute but steady, low latency. Retrieval systems need room for a growing document and vector store. Storcom sizes each part before anything is ordered.
Should we run AI on premises or in the cloud?
Steady, heavy workloads and data with strict residency rules often cost less and are easier to control on premises. Experiments and bursty work usually fit Azure or AWS. Storcom models both, plus hosted private cloud for the supporting systems, and gives you pricing on each.
Security
What does managed EDR include?
Managed endpoint detection and response (EDR) pairs an EDR agent on every laptop and server with people who watch, investigate and act on its alerts around the clock. With Storcom, that includes agent deployment and policy tuning, 24×7 monitoring and response on CrowdStrike Falcon or Arctic Wolf, containment such as isolating an infected host, and reporting your team can act on. Storcom support is available 24×7×365 if you need to talk to someone.
What is the difference between EDR, MDR and XDR?
EDR (endpoint detection and response) is software that records activity on laptops and servers and detects and blocks threats there. MDR (managed detection and response) adds a team that monitors and responds to those detections around the clock. XDR (extended detection and response) widens detection beyond endpoints to identity, email, cloud and network data. Storcom helps you pick the level that matches what your team can staff.
What is continuous vulnerability scanning?
Continuous vulnerability scanning checks systems for known vulnerabilities and misconfigurations all the time instead of in a periodic snapshot, and ranks findings by risk. Storcom’s continuous risk scanning uses CrowdStrike Falcon Spotlight, which reads vulnerability data from the Falcon agent already on your endpoints, so there are no scan windows or separate scanners to manage. Your team gets a prioritized list and fixes what matters first.
What does a managed firewall service include?
A managed firewall service hands day-to-day firewall operations to a provider: alerting and monitoring, firmware management, policy changes and reporting. Storcom manages firewalls from vendors including Cisco, with monitoring, firmware updates and reporting backed by 24×7×365 phone support. Your team keeps visibility without carrying the firewall alone.
We don’t have a security team. Where should we start?
Start with the controls that stop and contain the most common attacks: endpoint detection and response on every device, a well-managed firewall, continuous vulnerability scanning, and immutable backups you have actually restored from. Storcom’s managed EDR, managed firewall, continuous risk scanning and managed recovery give lean IT teams specialist coverage without specialist headcount. A discovery call is where to begin.
Working with Storcom
Where is Storcom located?
Storcom, Inc. is based at 825 S. Batavia Ave. in Geneva, Illinois, in the western suburbs of Chicago. We serve organizations throughout Chicagoland and work with customers across the U.S. Monitoring, support and managed services are delivered remotely, and our engineers go on site when a deployment or migration calls for it.
What is a Storcom discovery call?
A discovery call is the first step of every Storcom engagement: a no-cost conversation about what you run today, what is changing and what you need to protect. You leave with a plain answer about whether Storcom can help and what the next step would be. Storcom does not run scans or assessments as a first step.
How does an engagement with Storcom work?
Every engagement follows four steps: discover, design, implement and manage. We start with a discovery call, design an architecture and roadmap around your workloads, recovery objectives and budget cycle, then handle procurement, migration and deployment. If you choose a managed service, we monitor, test and support it 24×7×365 against an agreed service level.
Can we buy products from Storcom and run them ourselves?
Yes. Storcom delivers technology as products you own, services we manage, or a mix of both. A common pattern is to buy storage arrays or servers through Storcom and run them in-house, then add managed EDR, backup or disaster recovery where your team is stretched.
What are Storcom’s support hours?
Storcom support is available 24×7×365 by phone at 1 (866) 610-7472, by email at recoversupport@storcom.net, and through the online ticket portal. Call for anything urgent, such as an outage or an active recovery. Email and the portal work well for requests that can wait for a reply.
How do I open a support ticket with Storcom?
Open a ticket in the Storcom support portal at https://recoverportal.storcom.net:9676/portal, or email recoversupport@storcom.net. Include your company name, a callback number, the affected systems and what changed before the problem started. For anything urgent, call 1 (866) 610-7472, which is answered 24×7×365.
Cloud
What is a hosted private cloud?
A hosted private cloud is dedicated compute, storage and networking that runs only your workloads, located in a provider’s data center and operated by that provider. You get isolation and a predictable monthly cost without owning or refreshing the hardware. Storcom runs dedicated hosted private cloud for organizations moving off on-premises infrastructure or looking for a way out of rising VMware licensing costs.
Should our workloads go to private cloud or public cloud?
It depends on the workload. Steady workloads with known resource needs often fit a right-sized private cloud with a fixed monthly cost, while elastic or cloud-native applications usually belong in Azure or AWS. Storcom sizes both options during design and supports Azure, AWS and IBM Cloud as well as dedicated private cloud, so the recommendation follows the workload.
What is object storage used for?
Object storage keeps data as objects in a flat namespace, usually accessed through an S3-compatible API, which suits large volumes of unstructured, cold or archival data. It is a common target for backup copies because object lock can make those copies immutable for a set retention period. Storcom provides object storage for cold and archival data and as an off-site backup target.
How do we avoid overprovisioning when we move to the cloud?
Size from real utilization data, not from the specs of the hardware you are replacing. Measure CPU, memory, storage and growth for each workload, right-size before you migrate, and model what a failover or seasonal peak would cost. Storcom sizes this way during design, after the discovery call.
Can Storcom manage our Azure or AWS environment?
Yes. Storcom designs, migrates and manages workloads in Microsoft Azure and AWS, including resource management, backup and security controls. Public cloud can also serve as a disaster recovery or backup target for on-premises systems.
Backup
What is the 3-2-1-1-0 backup rule?
The 3-2-1-1-0 rule says to keep three copies of your data on two different types of media, with one copy off-site, one copy offline or immutable, and zero errors when you verify restores. It extends the older 3-2-1 rule to account for ransomware that deletes or encrypts any backup it can reach. Storcom designs Veeam-based backup to this pattern, including immutable off-site copies and restore validation.
What is an immutable backup?
An immutable backup is a copy that cannot be changed, encrypted or deleted until its retention period ends, even by someone with administrator credentials. It is usually enforced with object lock on object storage, a hardened Linux repository, or write-once media. Immutability matters because attackers often go after backups before they encrypt production systems. Storcom includes immutable off-site copies in its backup designs.
Does Microsoft back up Microsoft 365 data?
Microsoft keeps Microsoft 365 available and replicates it for its own resilience, but standard subscriptions do not include an independent backup copy you control. Under Microsoft’s shared responsibility model, protecting your data from accidental deletion, ransomware, departing users and retention gaps is your job, and recycle bins and retention policies cover only limited windows. Storcom backs up Exchange Online, SharePoint Online, OneDrive and Teams with Veeam.
How often should we test backup restores?
Test restores on a regular schedule and after any significant change, such as a new application, a storage refresh or a backup software upgrade. A backup job that reports success only proves data was copied, not that you can bring a system back within your recovery time objective. Storcom includes restore validation and reporting so you have evidence that recovery works.
What is backup as a service (BaaS)?
Backup as a service is off-site backup delivered and run by a provider, so you get protected copies without building and managing a second site. Storcom’s Veeam-based cloud backup sends copies from your environment to Storcom-managed cloud storage, keeps them immutable, and monitors the jobs for you. It is a straightforward way to cover the off-site and immutable parts of the 3-2-1-1-0 rule.
Disaster recovery
What is the difference between RPO and RTO?
Recovery point objective (RPO) is the maximum amount of data, measured in time, you can afford to lose, so it sets how often you back up or replicate. Recovery time objective (RTO) is the maximum time a system can be down before the outage does unacceptable harm, so it sets how fast recovery must be. Storcom designs recovery to a stated RPO and RTO for each application tier, then tests against them.
What is the difference between DRaaS and backup?
Backup keeps copies of data you can restore, but restoring whole systems takes time and needs hardware to restore onto. Disaster recovery as a service (DRaaS) replicates servers to a ready recovery environment where they start in a planned order, so the business runs there until the primary site is back. Most organizations need both: backup for retention and file-level restores, DRaaS for the applications that cannot wait. Storcom offers both on Veeam, with Zerto where continuous replication is needed.
How long does ransomware recovery take?
There is no single number, because recovery time depends mostly on preparation: whether clean, immutable backups exist, how fast you can find a restore point that predates the infection, whether investigators need systems held for forensics, and whether a tested runbook sets the recovery order. Teams that have rehearsed recovery to a clean environment get back much faster than teams working it out mid-incident. Storcom tests recovery against your RTO so you know your timeline before you need it.
How often should we test disaster recovery?
Test on a regular schedule and whenever production changes in a way that affects recovery, such as a new application, a new site or a platform migration. A real test fails over systems in the planned order, confirms applications work for users, and produces a written report of what passed and what needs fixing. Storcom’s Managed Recovery Program runs these tests and assigns a service delivery manager who owns the failover.
What is a disaster recovery runbook?
A disaster recovery runbook is the documented, step-by-step procedure for failing over and failing back: which systems recover first, what they depend on, who does each step, how to confirm applications work, and who to call. It turns recovery from memory into a checklist anyone on the team can follow under pressure. Storcom documents runbooks as part of managed recovery and keeps them current as your environment changes.
Infrastructure and VMware
What changed with VMware licensing after Broadcom bought VMware?
After Broadcom completed its acquisition of VMware in late 2023, it ended perpetual licenses in favor of subscriptions, consolidated products into bundles such as VMware Cloud Foundation and VMware vSphere Foundation, and moved to per-core pricing with minimum core counts. Many of the IT teams we talk to have seen renewal quotes rise sharply as a result. Storcom models three paths before you renew: stay and right-size, move to a hosted private cloud, or re-platform, with pricing on each.
What are the alternatives to VMware?
The main options are to stay on VMware with a right-sized license, move workloads to a hosted private cloud, or re-platform to another hypervisor such as Microsoft Hyper-V, Nutanix AHV or Red Hat virtualization. Public cloud is a fourth path for workloads that fit it. Storcom compares these options against your workloads, skills and budget cycle and prices them before you commit, so the decision is not made under renewal pressure.
When should we refresh a storage array?
Plan a refresh when the array is approaching end of support, when its support renewal costs more than the array is worth to you, when capacity or performance can no longer keep up, or when it lacks features you now need, such as immutable snapshots and ransomware detection. Start before the support end date so the replacement can be budgeted, migrated and tested without a gap in coverage. Storcom compares Dell, HPE, Everpure and IBM FlashSystem options against your data and workloads.
Can a storage array detect ransomware?
Some modern arrays can. IBM FlashSystem with FlashCore Module 5 analyzes every I/O with machine learning and, according to IBM, detects ransomware in under a minute, while Dell PowerStore and PowerMax and the HPE Alletra Storage MP B10000 also build ransomware detection into the array. Immutable snapshots then give you a clean point to recover from. Storcom sizes and deploys all of them.
Should we choose hyperconverged or three-tier infrastructure?
Hyperconverged infrastructure (HCI) combines compute, storage and virtualization in one cluster that you scale by adding nodes, which simplifies management for small teams. Three-tier infrastructure keeps servers, a shared storage array and the network separate, so each can be sized and refreshed on its own schedule. Storcom designs both, using Nutanix for HCI and Dell, HPE or Lenovo servers with Dell, HPE, Everpure or IBM arrays for three-tier builds.
What’s covered?
AI
Shadow AI, governing AI with the tools you own, AIDR, the NIST AI RMF and where AI workloads should run.
Security
Managed EDR, EDR vs MDR vs XDR, vulnerability scanning and managed firewalls.
Working with Storcom
Location, the discovery call, how engagements run and how to reach 24×7×365 support.
Cloud
Hosted private cloud, public cloud fit, object storage and sizing before you migrate.
Backup
The 3-2-1-1-0 rule, immutable backups, Microsoft 365 backup and restore testing.
Disaster recovery
RPO vs RTO, DRaaS vs backup, ransomware recovery and DR runbooks.
Infrastructure and VMware
Broadcom licensing changes, VMware alternatives, storage refresh timing and HCI vs three-tier.
Didn’t find your question?
Send it through the contact page or call 1 (866) 610-7472. If you need help with a system Storcom supports, email recoversupport@storcom.net or open a ticket in the support portal.
If the question is really “where do we stand?”, a discovery call is the place to start. It costs nothing, and it is how every engagement begins.
Start with a discovery call.
Tell us what you run today, what is changing and what worries you. We listen, ask questions and tell you plainly whether and how we can help. No cost, no commitment.