From Outage Headline to Managed IT Opportunity

How I researched UT San Antonio's August technology outage before deciding what I would sell or whether I should sell anything at all

A note on this analysis: UT San Antonio has not publicly released a final root cause or complete incident report. This article is an outside-in sales research exercise based on public reporting, university communications, technology documentation and job postings. Confirmed facts are separated from hypotheses and those hypotheses should change when new evidence changes.

The article that started the research

In August, I read a KSAT story reporting that UT San Antonio had delayed the start of fall classes after what the university described as attempted unauthorized activity against its technology systems. The story said UTSA had taken services offline as a precaution. A reader comment also claimed that the phones and Internet were not working on campus. That comment was unverified, but it gave me a question worth researching: was UTSA dependent on an outside hosting or telecom provider or was it operating its own infrastructure?

That question matters if you sell Managed IT services. A public outage is a business trigger, but the trigger does not tell you what to sell. Before calling the prospect, I wanted to understand the environment behind the problem.

The first discovery changed the direction of the research. UTSA operates substantial technology infrastructure internally. University Technology Solutions says it provides virtual server hosting, server installation and management, DNS, DHCP, file services, Windows and Linux server management, monitoring, backups and recovery. UTSA also documents a dedicated research data center with backup power, redundant cooling and direct backbone connectivity. This was not simply a small organization waiting for a cloud host to come back online.

Infrastructure and vendor triage

The phone outage provided another clue. UTSA publicly identifies its telephone environment as a VoIP solution built around Cisco Unified Communications, including Unity Connection, Contact Center Express and Webex. AT&T also provides supplementary services, including business-continuity options for departments during campus telephone or network outages.

Then I looked at how UTSA hires people to run the environment. A 2026 Enterprise Network Engineer posting described responsibility for enterprise network hardware, routers, switches, LAN, WAN, VPN, IP addressing, network security, servers and data-center documentation. A Senior Network Analyst posting sought familiarity with Cisco, Juniper and Palo Alto networking equipment, VMware and Hyper-V virtualization, Dell PowerVault storage, Active Directory, Azure AD and Windows Server.

Job postings do not prove that every named product is deployed everywhere. They do, however, show the capabilities UTSA expects its technical staff to understand. Combined with UTSA's own service documentation, the picture became clear: this is a sophisticated internal IT organization with networking, server, storage, identity, voice and data-center responsibilities. That changes the potential sales motion from 'replace their IT' to something closer to 'where could an outside partner extend their IT team?'

The timeline changed our theory: What we learned and How the sales hypothesis changed






























Instead of forcing a conclusion, the sales plan shifts from 'we know your problem' to 'we have researched enough to ask useful questions.'

The Friday timing especially caught my attention because of my background in hosting. A Friday incident can be operationally painful. Internal specialists may need to be called back in, while outside vendors and escalation teams may be operating with reduced weekend staffing. We cannot say the attacker deliberately chose Friday for that reason, but it is a legitimate resiliency question. A company may have redundant hardware and still discover that it does not have the same redundancy in people.

Patience can protect credibility, but it can also cost the sale

There is a sales dilemma here. Immediately calling UTSA after the headline with 'we provide cybersecurity services' would have been poorly informed and could look like ambulance chasing. At that point, we did not know whether UTSA outsourced its infrastructure, whether the outage was caused by DDoS, whether systems had been intentionally isolated, or whether the existing vendors were performing exactly as designed.

But research can become procrastination. While one salesperson waits for perfect information, another MSP may be making a relationship. The better rule is not 'research everything before you call.' It is: research until you know enough to have a useful conversation.

Incumbent vendors have an even stronger advantage during an emergency. If a current network, security, telecom or infrastructure partner answered late Friday, brought engineers onto calls Saturday, coordinated escalations, located hardware, assisted with containment and stayed engaged through recovery, that vendor was effectively reselling its value in real time. Reliability during a crisis can become the strongest renewal presentation a partner ever gives. The opposite is also true. If a critical vendor was difficult to reach until Monday, that becomes a potential opening for a competitor.

What would I ask UTSA now?

As of September 7, I still would not call UTSA claiming to know the root cause. UTSA's public incident page continues to say the activity was detected at the network edge, that expert partners helped contain it, and that the university found no evidence at that stage that data was accessed or exfiltrated. The university restored services carefully and used phased passphrase resets before the semester began.

· How much of the network, server and data-center environment is managed internally today and where do outside partners supplement the team?
· During the August incident, where did the organization experience the greatest resource strain?
· How quickly were critical third-party vendors able to provide the right technical resources over the weekend?
· Did the incident expose any areas where additional redundancy is needed, either in technology or in people?
· Are networking, infrastructure, monitoring, disaster recovery, security or hardware projects now higher priorities because of what happened?
· Are there specialized functions your internal engineers would rather have an outside partner augment so they can remain focused on higher-value work?
· If another major incident began at 8 p.m. on a Friday, what would you want available by midnight that you did not have in August?

The trigger does not tell you what to sell

This research began with a cybersecurity story, but the eventual opportunity may not be a cybersecurity sale. The useful opportunity could be 24/7 engineering coverage, network support, Cisco/VoIP expertise, monitoring, server infrastructure, hardware refresh, backup and recovery, disaster-recovery testing, vendor coordination, staff augmentation or co-managed IT.

It's also possible that there is no opportunity. UTSA may ultimately conclude that its internal teams, safeguards and existing partners performed exactly as expected. Good prospect research has to allow for that answer. The goal is not to manufacture pain because you have a service to sell.

The goal is to understand the prospect well enough to know whether there is a conversation worth having.

I still do not know what caused UTSA's August outage. UTSA has not publicly presented a final root cause and some of the theories we considered along the way have already weakened as new information emerged. That is part of the lesson. Good sales research is not about making your first theory fit the facts, it's about changing the theory as the facts change.

What I do know now is considerably more useful to a salesperson than what I knew when I first read the headline. I know more about UTSA's infrastructure, the capabilities it maintains internally, several technologies and partners around that environment, how restoration unfolded, and which questions I would ask before proposing anything.

That is the difference between finding a phone number and researching an opportunity.

Sources consulted

· KSAT, “UTSA delays start of fall classes after attempted cybersecurity breach,” August 2026. Original story that prompted this research.
· UT San Antonio Today, “As fall semester kicks off, assistance is available to those needing help resetting their passphrases,” incident update page, Aug. 17–25, 2026.
· UT San Antonio Today, “UT San Antonio brings stronger Wi-Fi to campuses,” Aug. 10, 2026.
· UTSA University Technology Solutions, Telephone Services and Cisco Unified Communications documentation.
· UTSA University Technology Solutions, Server & Storage Options and Server Services documentation.
· UTSA Research Data Center / technology offerings documentation.
· UTSA Enterprise Network Engineer job posting, 2026.
· UTSA Senior Network Analyst job description/posting.
· Texas Cyber Command, incident reporting and response guidance.