Real talk on marketing and business technology.

Here's something most marketing agencies won't tell you: a lot of small businesses are spending money on marketing every single month and getting almost nothing back for it. Not because marketing doesn't work. Not because their product is bad. But because they're doing it backwards.

We see it constantly. A business owner hears they need to be on TikTok, so they start posting. Or they run Google Ads with a budget of a few hundred dollars and give up after two weeks when nothing happens. Or they hire someone to "do their social media," pay for content that gets posted three times a week, and wonder why their phone still isn't ringing.

The issue isn't effort. It's sequence. And it's the difference between marketing that compounds over time and marketing that bleeds money quietly.

Start with your foundation, not your megaphone

Before you post a single piece of content or run a single ad, your foundation needs to be solid. That means a website that actually loads fast on a phone, a Google Business Profile that's complete and verified, and a clear answer to the question every potential customer is silently asking: "Why should I pick you over the dozen other options I can find in thirty seconds?"

Most businesses skip this step because it feels slow. It's not the exciting part. But here's what happens when you skip it — you pay to send traffic to a leaky bucket. You run ads to a website that loads in six seconds on mobile, or looks broken on a small screen, and you wonder why your cost per lead is so high. It's not the ads. It's where the ads are sending people.

SEO is not a mystery — it's consistency

Search engine optimization sounds technical, and there are definitely technical elements to it. But the core of local SEO is simpler than most people think. Google wants to show its users the most relevant, trustworthy result for what they searched. Your job is to give Google strong signals that you are that result for the searches your customers actually make.

For a Chicago-based business, that means a few things:

• Your website should mention what you do and where you do it — clearly, multiple times, in the actual text of the page
• Your Google Business Profile should be fully filled out with your real hours, real photos, and a description that sounds like a human wrote it
• Other websites should mention and link to your business — even simple things like a listing on Yelp, your chamber of commerce, or a local directory help
• You should be consistently collecting reviews from actual customers, not in bulk, but steadily over time

None of this is complicated. It's just work that most businesses either don't know about or don't do consistently. The businesses that show up at the top of local searches aren't there because they cracked some algorithm. They're there because they've been doing the basics well for a while.

Paid ads work, but only in the right order

Google Ads and Facebook Ads can be incredibly effective. We use them for clients and we've seen what a well-run campaign does to a business. But a paid ad campaign on top of a weak foundation doesn't work — it just makes the problems more expensive.

If someone clicks your ad and lands on a slow website with no clear next step, they leave. You paid for that click. If your Google Ads campaign is running but you haven't set up conversion tracking, you have no idea which keywords are generating leads and which are just burning budget. And if your ad is pointing to your homepage instead of a page that's specifically designed to convert that search intent, you're losing leads that were already interested.

The sequence that works is this: get your foundation right first, then turn on paid traffic. Once the foundation is solid, even a small daily budget can drive real results, because every dollar you spend is landing on something designed to convert.

Social media: be useful, not just active

Social media is one of the most misunderstood parts of small business marketing. There's this belief that if you just post regularly, business will follow. Sometimes it does. More often it doesn't — because posting for the sake of posting isn't a strategy, it's noise.

The businesses that build real audiences on social media do it by being genuinely useful to the people they want to work with. A restaurant that posts their daily specials. A contractor who shares quick tips about what to look for in a quote. An IT company that explains common security mistakes in plain English. That kind of content builds trust in a way that generic lifestyle posts don't.

It also doesn't mean you need to be on every platform. Most small businesses are better served by doing one or two platforms really well than spreading themselves across six and doing all of them poorly. Where are your actual customers spending time? Start there.

Measurement isn't optional

The last thing we see go wrong regularly is businesses running marketing without tracking what's working. No analytics on the website, no conversion tracking in their ad campaigns, no way to connect a lead back to the source that generated it.

This matters because marketing decisions made without data are just guesses. And guesses are expensive when you're paying for them. Google Analytics is free and takes about thirty minutes to set up properly. Google Ads conversion tracking is built into the platform. Knowing which channel is generating your leads — and which is burning budget — is the difference between marketing that gets smarter every month and marketing that stays flat.

The businesses that get the most from their marketing budgets aren't necessarily the ones spending the most. They're the ones paying the closest attention to what the data is telling them and adjusting accordingly.

What this looks like in practice

If you're a Chicago business owner reading this and thinking about where to start, here's the honest version of what we'd recommend: Get your Google Business Profile fully set up and start collecting reviews. Make sure your website loads fast on a phone and has a clear call to action above the fold. Then — and only then — consider running ads or investing in ongoing content.

The businesses that do this in the right order don't just get better marketing results. They get results that compound. Every review they collect makes their profile stronger. Every page they optimize reduces their ad costs. Every piece of useful content they publish builds a little more trust with the people searching for what they offer.

That's not a quick fix. But it's how sustainable growth actually works.

There's a version of this conversation that happens pretty often. A business owner, usually running somewhere between five and fifty employees, tells us they're not really worried about network security because they're too small to be a target. They figure hackers go after big banks and hospitals, not local businesses.

Then we do a basic assessment and find default router passwords that haven't been changed in years, employee devices on the same network as their point-of-sale system, a shared "office" Wi-Fi password that's been the same since they moved in, and a handful of old accounts that former employees technically still have access to.

None of that is unusual. In fact, it describes the majority of small businesses we work with before we've made any changes. And the reason it matters is that attackers know it describes most small businesses. That's exactly why they target them.

The "too small to matter" myth

Cybercriminals don't sit down and manually decide which businesses are worth attacking. A large portion of attacks are automated — scripts scanning the internet for open ports, default credentials, and known vulnerabilities, flagging anything that looks like an easy entry point. The size of your business is irrelevant to that process. What matters is whether your defenses are weak enough to be worth the minimal effort it takes to walk through.

Small businesses have become increasingly attractive targets for exactly this reason. They often have real money moving through their accounts, store customer data, and rely on their systems to operate — but they almost never have the IT resources or security infrastructure that would make an attack difficult or expensive.

The vulnerabilities we see most often

After doing network assessments for businesses of different sizes across a range of industries, a few issues come up over and over. Not because businesses are careless — usually it's because no one sat down and walked through this stuff systematically.

Default and weak credentials

Routers, switches, printers, cameras, and networked devices of all kinds come with default usernames and passwords set by the manufacturer. Those defaults are publicly documented and among the first things automated scans check for. Changing them takes five minutes and closes one of the most common entry points in small business networks.

Flat networks with no segmentation

A flat network is one where every device can communicate with every other device — your laptop, the office printer, the server with your client data, the smart TV in the conference room, and the guest Wi-Fi your visitors use are all on the same network. If any one of those devices is compromised, an attacker has a path to everything else. Basic network segmentation — separating these into different zones — limits how far damage can spread if something goes wrong.

Stale accounts and excessive access

Employee turnover is normal. But in a lot of businesses, when someone leaves, their accounts don't get disabled promptly. Former employees may retain access to email, cloud storage, shared drives, or internal systems for weeks or months after they've left. Beyond departures, many businesses give everyone the same level of access to everything, when most employees only need access to a fraction of what's available. Both of these create unnecessary exposure.

No monitoring or alerting

One of the more unsettling findings in network assessments is when businesses discover they have no visibility into what's happening on their network. There's no logging, no alerting, nothing that would tell them if someone was trying to brute-force their way in, if a device was behaving strangely, or if large amounts of data were leaving the network at unusual hours. The average time between a breach occurring and it being detected is measured in weeks or months. Without monitoring, that gap gets even wider.

Unpatched software and firmware

Software updates aren't just about new features. A large portion of them are security patches — fixes for vulnerabilities that, once publicly disclosed, become targets for exploitation. Running outdated operating systems, unpatched applications, or old router firmware means running software with known holes that attackers can walk through. Keeping things updated is one of the highest-leverage, lowest-cost things a business can do for its security posture.

What's actually worth doing first

If you're reading this and realizing your network probably has some of these issues, the good news is that most of the highest-impact fixes aren't expensive or complicated. They're just things that need to happen.

Start with the basics: change default credentials on every networked device, make sure you have a guest Wi-Fi network separate from your main business network, and do a quick audit of who has access to what — paying particular attention to people who no longer work there.

From there, think about where your most sensitive data lives and what would happen to your business if you couldn't access it for a week. That usually helps prioritize what gets attention next. If your operations run through a single server or cloud platform, that's where you want strong authentication, regular backups, and some form of monitoring.

You don't need to solve everything at once. A phased approach — starting with what's highest risk and lowest effort, then working toward more comprehensive coverage over time — is both practical and effective. The goal isn't perfection. It's making your network meaningfully harder to compromise than the average business on the same block.

The backup question most businesses can't answer

We always ask businesses the same question during an assessment: if ransomware encrypted every file on your network tomorrow, how long would it take you to get back to normal operations, and what would it cost?

For businesses with good backup practices and a tested recovery plan, the answer might be a day or two. For businesses without backups — or with backups that have never been tested — the answer is often "we'd be out of business." And that's not a hypothetical. It happens to businesses that assumed they were too small to worry about it.

A proper backup strategy — with offsite or cloud copies, regular testing, and a clear recovery process — is one of the most important things a business can have, and it's often underestimated until it's needed.

A word on security as an ongoing practice

One thing worth being direct about: network security isn't something you do once and forget. The threat landscape changes, your network changes, your team changes. What was secure enough a year ago may not be today.

That doesn't mean you need a full-time security team. It means building some regular habits — reviewing access periodically, staying on top of updates, doing an annual check on your network configuration, and having someone you can call when something looks wrong.

For most small businesses, that means having a trusted IT partner who knows their setup and can give them straight answers. Not someone who sells fear, but someone who understands the actual risk profile of a business your size and helps you spend your time and money on the things that matter most.

That's what we try to be for our clients. If you're not sure where your network stands, we're happy to take a look.

Let me start with something uncomfortable. If you've been running Google Ads for more than a few months and you haven't looked closely at your search terms report, there's a very good chance a meaningful portion of your budget has been going to clicks that had no realistic chance of turning into a customer.

That's not a knock on Google Ads as a platform. It's one of the most effective advertising tools available to small businesses when it's set up properly. The problem is that the default settings favour Google's revenue, not your return. And most accounts are still running on the defaults.

Here are the five signs we see most often when we audit an account for the first time.

Sign one: your campaign is on broad match with no negative keywords

Broad match keywords look reasonable on paper. You add "digital marketing chicago" and feel like you've covered your bases. But broad match in its current form means Google can show your ad for searches that are only loosely related to what you typed. We've seen accounts where a local IT company's ads appeared for "IT jobs near me" and "IT certification courses online." Those clicks cost real money and had zero chance of converting into a client.

The fix is straightforward: switch your most important keywords to exact or phrase match, and build a negative keyword list that blocks anything irrelevant. This is not a one-time task. It's something you review weekly for at least the first month of any campaign.

Sign two: you're sending all traffic to your homepage

The homepage is the worst possible destination for a paid ad in almost every situation. It's designed for people who already know who you are and want to explore. Someone who just searched "network security audit chicago" doesn't want to arrive at a homepage and figure out where to click next. They want to land on a page that answers their exact question and makes it easy to get in touch.

Dedicated landing pages — even simple ones — consistently outperform homepages by a significant margin for paid traffic. The page should match the ad headline, address the specific search intent, and have one clear call to action. Nothing else.

Sign three: you have no conversion tracking

This one surprises people. Around a third of the small business accounts we look at have either no conversion tracking or broken conversion tracking. That means the campaign is spending money with no way to tell Google which clicks led to a phone call, a form submission, or any other meaningful action.

Without this data, Google's automated bidding strategies are optimising for nothing. They're essentially guessing. Conversion tracking is not optional — it's the foundation everything else is built on. Setting it up takes about an hour and it changes how every subsequent decision is made.

Sign four: the search partners and display network are both turned on

When you create a Search campaign, Google checks both of these boxes by default. Search Partners shows your ads on websites like Amazon and other Google partners. The Display Network shows your ads on millions of third-party websites as image or text banners. Both are very different from showing ads in Google Search results, and both typically have significantly lower intent and conversion rates.

For most small businesses with limited budgets, you want your money going to people actively searching on Google, not browsing other websites. Uncheck both and see what happens to your cost per lead. In most cases it drops noticeably.

Sign five: you're not checking the search terms report

The search terms report shows you the actual words people typed before clicking your ad. It's different from your keyword list. And it's often where you discover that your "marketing services" campaign has been showing for "marketing services degree" and "what is marketing services" for the last three months.

This report should be reviewed at least once a week during the early stages of a campaign. Anything that triggers your ads but couldn't realistically convert into a client should become a negative keyword. Over time this makes your campaign progressively more efficient without spending any more money.

None of this requires a big budget to fix

The frustrating part about wasted ad spend is that fixing these issues doesn't require more money. It requires more attention. A well-managed campaign on $500 a month will consistently outperform a neglected campaign on $2,000 a month.

If you're currently running Google Ads and you're not sure whether any of these apply to you, we offer free account audits. We'll look at the actual data, tell you what we find, and give you an honest assessment of where the money is going. No obligation to work with us — just a clear picture of what's happening.

When remote work became mandatory overnight for millions of businesses, the priority was keeping people connected and productive. Security was the problem to solve later. For most businesses, later never really came.

What's left is a collection of stopgap measures, personal devices accessing corporate systems, and network configurations that were designed for a world where everyone sat in the same building. Attackers have had years to study these patterns. The threat landscape adapted a lot faster than most businesses did.

This isn't about blame. The scramble was real and the pressure was enormous. But understanding what actually changed — and what that means for your business today — is how you start fixing it.

The network perimeter essentially disappeared

Traditional network security was built around a perimeter. You had your office network, and everything inside it was (roughly) trusted. Everything outside it was not. Firewalls, access controls, and monitoring were all designed around this model.

Remote work dismantled that model almost completely. Employees are now connecting from home networks that you have no control over, on personal devices that may or may not have proper security software, through internet connections that are shared with everything else in their household. The traffic that used to stay inside a controlled environment now travels across the public internet before it ever touches your systems.

Many businesses responded with VPN access — which was the right instinct — but the implementation was often rushed. VPNs set up quickly under pressure frequently had weak authentication, broad access permissions, and no monitoring. They created a tunnel into the network without controlling what could come through it.

Personal devices became business devices

One of the most common and least discussed security issues from the remote work shift is device sprawl. Employees who couldn't get company equipment used personal laptops and phones. In many organisations this became a permanent arrangement.

Personal devices don't go through your IT procurement process. They don't get enrolled in your endpoint management system. They don't receive your security policies. And when an employee leaves the company, their personal device — which may still have cached credentials, saved passwords, or local copies of work files — leaves with them.

The fix here isn't necessarily replacing every personal device with a company-issued one, though that's ideal. At minimum it means mobile device management software that can enforce basic security policies on any device that accesses company systems, and clear offboarding procedures that include revoking access before the last day of employment rather than after.

Shadow IT filled the gaps

When the tools businesses had in place didn't work well for remote teams, people found their own solutions. File sharing through personal Dropbox accounts. Team communication through personal WhatsApp groups. Collaboration through tools the IT department didn't know existed.

This is sometimes called shadow IT, and it's not a sign of malicious intent. It's a sign that legitimate needs weren't being met. But it creates real risk — data sitting in systems outside your control, business information shared through platforms with unknown security practices, and no visibility into where sensitive files end up.

The response isn't to ban personal initiative. It's to make sure your approved tools actually work for people, that there's a clear and easy process for requesting new software, and that you have at least basic visibility into what services are being used to access and share business data.

Home networks are a different problem than office networks

The average home network has a consumer-grade router, a password that was set up once and never changed, and a collection of smart TVs, game consoles, and IoT devices all sitting on the same network segment as the work laptop. It's a very different environment from a managed office network.

There are practical steps here that don't require replacing every employee's home router. A VPN with proper split tunnelling routes work traffic securely without impeding personal internet use. Clear guidance about keeping work devices on a separate network from smart home devices — most modern routers support a guest network that functions as a simple separation — makes a meaningful difference. And multi-factor authentication on all business systems means that even if home network credentials are compromised, getting into company systems still requires a second factor.

Where to start if you haven't started yet

If your remote or hybrid work security hasn't been properly reviewed since the initial scramble, the most useful starting point is an honest inventory. Which users have remote access? Through what mechanism? What devices are they using? What do they have access to that they probably shouldn't?

This doesn't require expensive software. It requires sitting down with the people who manage your systems and working through what actually exists versus what you assumed was in place. In our experience, that conversation produces a short list of high-priority fixes that can meaningfully reduce exposure without requiring a major investment.

Network security doesn't need to be perfect to be effective. It needs to be meaningfully harder to breach than the average alternative. Most businesses aren't far from that bar — they just haven't taken the step of finding out where they actually stand.

There's a particular kind of frustration that comes from doing everything you're supposed to do — building a decent website, staying active on social media, maybe even running some ads — and still not showing up when someone nearby searches for exactly what you offer.

Local SEO is the reason. And it operates differently from general SEO in ways that trip up a lot of businesses. You can have a technically well-optimised website and still rank nowhere for local searches because you've missed the signals Google uses specifically to determine geographic relevance.

Here's what those signals are and where most Chicago businesses fall short.

Your Google Business Profile is probably not complete

This is the single most impactful thing for local visibility, and it's also the most commonly neglected. A Google Business Profile that's been claimed but not properly set up is almost as bad as not having one.

Complete means: every category filled in, not just the primary one. A business description written in plain language that includes what you do and where you do it. Actual business hours that are kept current — including holiday hours. At least ten recent photos, not the logo you uploaded three years ago. Services listed individually, with descriptions. And a consistent posting schedule, even if it's just twice a month.

Most importantly: reviews. Not a burst of reviews from everyone you know, but a steady stream over time from actual clients. Google reads the velocity of reviews as a signal of business health. A business that gets two or three genuine reviews a month consistently outperforms one that got forty reviews in a week and nothing since.

Your NAP isn't consistent across the internet

NAP stands for Name, Address, and Phone number. Google cross-references these details across dozens of directories, review sites, and data aggregators to verify that a business is legitimate and that its information is trustworthy.

If your business name is listed as "ALBAR Solutions" in one place and "Albar Solutions LLC" in another, or your old address is still showing up on Yelp while your website shows the new one, Google treats that inconsistency as a signal of unreliability. It doesn't necessarily penalise you, but it does reduce how confidently it's willing to surface you in local results.

Fixing NAP consistency isn't glamorous work. It means going through Yelp, Bing Places, Apple Maps, Yellow Pages, and whatever industry-specific directories are relevant to your business, and making sure every listing matches your current information exactly.

Your website doesn't mention Chicago enough

This sounds too simple to matter but it does. Google needs textual evidence that your business operates in a specific location. If your website says you offer "digital marketing services" without mentioning Chicago, Illinois, or specific neighbourhoods, Google has less reason to show you to someone searching in Chicago versus someone searching anywhere else.

This doesn't mean awkwardly inserting the city name every other sentence. It means making sure your homepage clearly states where you operate, that your service pages mention the area you serve, and that your contact page has your full address. A dedicated page for each major service area you want to rank in is worth considering if you serve multiple parts of the city or surrounding suburbs.

You're not building any local links or citations

A citation is any mention of your business on another website — a directory listing, a mention in a local news article, a feature in a community blog. Links and citations from local or regional websites carry more weight for local rankings than links from unrelated national sites.

Practical ways to build these: get listed in the Chicago Chamber of Commerce directory. Reach out to local business blogs and offer to contribute a short article. Sponsor a local event and ask for a mention on their website. Join industry associations that maintain member directories. None of these is a quick win, but over three to six months they add up.

You haven't touched your profile in months

Google treats inactivity as a negative signal. A business that posts updates, responds to reviews, answers questions, and keeps its hours current looks like an active, operating business. One that hasn't been touched since the account was claimed looks like it might not exist anymore.

The minimum viable activity level is responding to every review (positive and negative) within a week and posting an update at least twice a month. It doesn't take long. It does make a difference.

Local SEO is slower than paid advertising. You won't see results in a week or even a month. But the results it produces are durable in a way that ad spend isn't — and for most local businesses, the search traffic it generates over time becomes one of the most consistent sources of new enquiries they have.

Business owners are almost always poor judges of their own websites. Not because they have bad taste — most don't — but because they're too familiar with what the site is supposed to say. They read it with the knowledge of someone who already understands the business, the services, and the context. Visitors arrive with none of that.

The gap between how a business owner reads their own website and how a first-time visitor experiences it is where a lot of leads disappear. Understanding that gap is the first step to closing it.

The five-second test most websites fail

When someone lands on your website for the first time, they make a decision in roughly five to eight seconds about whether to stay or leave. That decision is based almost entirely on whether they can immediately answer three questions: What does this business do? Do they do it for people like me? What should I do next?

Pull up your homepage right now and ask yourself those three questions as if you'd never heard of the business before. If the answers aren't immediately obvious — not discoverable after a minute of reading, but immediately visible in the first screen — then you're losing people before they ever get to learn anything about you.

The most common failure here is a headline that prioritises cleverness over clarity. "Empowering businesses to reach their potential" tells a visitor almost nothing. "Chicago digital marketing and IT services for small businesses" tells them exactly what they need to know. The second version is less poetic but it keeps people on the page.

Mobile experience is often an afterthought

More than half of all web traffic is on mobile devices. On local service searches — "IT company near me," "marketing agency chicago" — that number is higher. Yet many business websites that look fine on a desktop become cramped, slow, or difficult to navigate on a phone.

The test here is simple: open your website on your phone right now. Not in a browser emulator on your laptop, but on an actual phone. How long does it take to load? Can you read the text without zooming in? Are the buttons large enough to tap easily? Is the phone number clickable?

If you're sending paid traffic to a mobile experience that fails any of those tests, you're paying for clicks that leave immediately. Every second of load time above three seconds drops conversion rates meaningfully. That's not a rough estimate — it's well-documented in page performance research.

There's no clear next step

A website without a clear call to action is a brochure. It might inform people, but it doesn't prompt them to do anything. And people, when not told what to do next, generally do nothing.

The call to action doesn't need to be aggressive. It doesn't need to say "BUY NOW" in red capital letters. But it does need to be present, prominent, and specific. "Request a free consultation" is better than "Contact us." "Get a free audit of your current network" is better than "Learn more." The more concrete the offer, the easier it is for someone to say yes to it.

And it should appear before the fold — meaning without scrolling — on both desktop and mobile. Most visitors who would have converted don't scroll far enough to find a call to action buried at the bottom of a long page.

Your trust signals are either missing or unconvincing

Before a new visitor contacts you, they're implicitly asking: is this business real? Are they credible? Will they actually deliver what they're offering? Your website needs to answer those questions before the person has to ask them.

Trust signals include: a physical address (not a P.O. box), a real phone number, named staff or at minimum a named founder, genuine client reviews, examples of past work, and any relevant certifications or industry associations. Many small business websites are missing several of these, which leaves the visitor with unanswered doubts that make them hesitant to reach out.

Reviews deserve particular mention. A Google review widget embedded in the website that shows your actual current ratings and recent reviews is more convincing than any amount of polished copy. People trust other customers more than they trust marketing, and the absence of visible social proof is one of the most common reasons websites fail to convert the traffic they receive.

What to do with this information

Start with the five-second test. If someone can't answer the three basic questions immediately, that's the highest-priority fix. Then check mobile performance. Then add or improve a specific call to action. Then audit your trust signals.

None of these changes requires rebuilding the website from scratch. Most can be addressed with targeted updates to existing pages. The goal is not a perfect website — it's a website that converts a meaningful percentage of the visitors it already gets, before you spend anything additional on traffic.