Two weeks ago I shut both down. Not because anything broke. Because I had finished building a replacement, and the last step before cutting over was an audit of every site the old system claimed to be watching.

That audit found two problems. Both had been sitting there for a while. Both were invisible on the green dashboard.

// THE AUDIT

What the audit found

The first one: a site listed in my records as hosted on one platform was actually running on a completely different one. That sounds like a paperwork error, and it started as one. But the backup plan for that site was built on the assumption of where it lived. On the host it was actually on, the backups had been stalled for thirteen days. Thirteen days where a hacked site or a bad update would have meant restoring from a two-week-old copy, if we were lucky.

The second one: seven sites were running an outdated version of my own monitoring plugin, quietly sending back incomplete reports. The reports still arrived. They just had less in them than they were supposed to, and nothing anywhere flagged the difference.

Here is the part worth sitting with. Nobody did anything wrong. The contractor did his job. The platform did its job. The dashboard was green because the dashboard was measuring what it could see, and everything it could see was fine. The problems lived in the gap between what was being measured and what actually mattered.

// THE FAILURE MODE

The failure mode of rented monitoring

A monitoring tool has one dangerous property: its failure mode looks exactly like good news.

When it misses something, it does not show you a red light. It shows you nothing, which reads as green. The more you trust the summary, the less anyone looks underneath it, and the tool’s whole sales pitch is that you should not have to look underneath it.

That is not a reason to skip monitoring. It is a reason to be suspicious of monitoring you have never verified yourself. When you rent the tool, verification is nobody’s job. The vendor assumes you are checking your own setup. You assume the vendor is checking. The contractor in the middle assumes the green checkmarks mean what they appear to mean.

When I built the replacement, verification stopped being optional, because I had to prove the new system worked before I could turn the old one off. Polling every site. Confirming every backup path independently, against the actual host, not against my records of the host. That forced audit is what surfaced both problems, and it is the real reason I am glad I did the build. The $4,000 a year in savings is nice. The audit is what mattered.

// THE REPLACEMENT

What the replacement actually does

Nothing about it is exotic. Each client site runs a small plugin that reports its real state: software versions, pending updates, security posture, uptime. Backups get verified against the hosting platform directly, not assumed. Performance gets measured on a schedule. Once a week or once a month, depending on the client, all of it gets compiled into a report a human can actually read, with a plain-English summary up top, and lands in the client’s inbox.

Two design rules came out of the experience, and I would hold them for any reporting system, in any business:

• A gap must look like a gap. If a data source fails, my reports say “not recorded.” They are not allowed to show a zero, because a zero is a claim and “not recorded” is an admission. The old system’s core sin was rendering missing data as good news.
• Verify against the source, not the record. The backup check asks the hosting platform what it actually did, not my notes about what should happen. Records drift. Sources do not.

AI has a seat in this system, and it is a deliberately narrow one. It writes the plain-English narrative at the top of each report, translating the raw numbers into what they mean for the client’s business. It is explicitly forbidden from inventing specifics. If the data does not say it, the narrative cannot claim it. That is the shape I think AI belongs in for operations work: doing the explaining, never the pretending.

// THE QUESTION

The question to take from this

You do not need to build your own monitoring stack. Most businesses should not. But if any part of your operation reports to you through a dashboard, a weekly email, or a contractor’s summary, it is worth asking one question: when did someone last verify it against the source?

Not “is the dashboard green.” When did a person actually check that the green means what you think it means? If the answer is “never” or “when we set it up,” then you do not know what your monitoring is missing, and neither does it. The two problems I found had been sitting under green checkmarks for weeks. The only reason they surfaced is that switching systems forced someone to look.

You do not have to switch systems to look. You just have to look.

If you want a second set of eyes on what your tools are actually telling you, get in touch. Describing the setup usually takes ten minutes, and the gaps tend to show up fast.