A scientific investigation into infrastructure investment, threat landscape, and building an impenetrable security architecture for Bright Side Plumbing's $6M growth trajectory.
Before recommending any investment, we must examine what went wrong and quantify the damage. Facts first, emotions second.
Based on 7 security dimensions (access control, vendor management, data protection, monitoring, backup, network security, incident response), BSP scores 35/100. Industry standard for a $3M service business targeting $6M is 75+. This gap represents significant financial and operational risk.
A marketing contractor and his web development partner operated as a coordinated team with exclusive control over ALL digital marketing infrastructure. No oversight, no documentation, no access audits, no separation of duties. Stephanie repeatedly caught the web dev partner accessing Google Ads and other accounts he had no business being in. All logs were kept exclusively by the contractors. When the relationship ended, BSP discovered a web of parallel systems designed to capture, redirect, and potentially sell leads that belonged to Bright Side Plumbing. The work computer was wiped before handover, destroying potential evidence.
Embedded a Housecall Pro booking widget (token: 5001b4d8...) on callbrightside.com despite BSP using ServiceTitan. Leads flowing through HCP may have routed to an account BSP did not control. CallRail tracking numbers (913-358-0252, 913-358-0380) from distant Atchison, KS rate center were also discovered.
Created "PMax v1 (Russ)" campaign spending $42K+ lifetime with ZERO conversion tracking. Google's AI had no signal on what converts, optimizing for clicks instead of booked jobs. Budget escalated wildly ($75 to $1,800/day) resetting Smart Bidding each time.
Family members' phone numbers added to BSP's system but misconfigured so they never pulled up properly. This caused radio advertising leads ($31K channel) to be LOST because calls could not reach those numbers. Direct revenue loss.
Multiple deactivated Google Ads accounts found (AW-404985988, AW-242993149). A canceled account (5822122013) marked "Bright Side Plumbing" was also discovered. These accounts may have had lead form extensions routing to email addresses or CRM systems BSP does not control.
Russ operated with Wesley, Founder/CEO of Origin Thrive (web dev + marketing agency, founded 2010 as "yMarketing"). Wesley was repeatedly caught inside Google Ads, analytics, and other BSP accounts he had no business accessing. Stephanie flagged this multiple times. Wesley designed the "100 Year Plumbing Company" webpage and was secretive about it, not letting BSP see the work until completion. Google Ads records confirm a pending STANDARD access invitation for wesley@originthrive.com from January 2025.
All reporting logs and activity records were kept exclusively by Russ, never shared with BSP ownership. The work computer (Lenovo, now in BSP possession) was wiped before handover, destroying browser history, cached credentials, email archives, downloaded exports, and any evidence of lead diversion or unauthorized account access.
Live API investigation conducted March 11, 2026 across Google Ads, ServiceTitan, and WordPress.
A second "Bright Side Plumbing" account exists in CANCELED status under the MCC. It had its own LSA campaign at $1,142.86/day budget and 12 GA4 conversion actions. Kalen was invited to this account by fallonmedials@gmail.com in September 2024.
Pending ADMIN invitation since June 2024. Also invited Kalen to the canceled shadow account in Sep 2024. This person had admin-level access before Russ. Possibly a previous agency.
Wesley, Founder and CEO of Origin Thrive (web dev + digital marketing agency, founded 2010 as "yMarketing"). Pending STANDARD access invitation since January 2025. Stephanie repeatedly caught Wesley accessing Google Ads and other BSP accounts without authorization. Wesley designed the "100 Year Plumbing Company" webpage and was secretive about the project, not letting BSP see it until completion. Team includes Liyana (marketing), Kaitlyn (design), Payton and Kayden (interns).
The WordPress site administration email is currently set to: russell.satterfield@callbrightside.com
This means Russ receives ALL WordPress admin notifications: security alerts, password reset requests, plugin update notices, new user registrations, and system emails. If his @callbrightside.com email is still an active mailbox, he has ongoing visibility into the website's security state.
The work computer was reset before handover. The dovew user profile was created fresh on March 2-3, 2026.
Zero traces of Russ's data, browsing history, saved passwords, bookmarks, or installed software were found.
All files, browser profiles, and credentials on the machine belong to Robert Dove (post-March-3).
If Russ's activity existed on this machine before the wipe, it was destroyed at the filesystem level.
Three critical questions drive this investigation.
At what revenue threshold does a dedicated server make financial sense? Physical vs. virtual vs. hybrid cloud: which architecture fits a $3M plumbing company targeting $6M with 25+ integrated systems?
What vendor access controls, offboarding protocols, and monitoring systems eliminate the insider threat vector permanently? How do we detect lead diversion in real-time?
BSP's competitive advantage is Kalen's 5th-generation expertise, proprietary processes, customer data, field intel, and AI-powered systems. How do we protect intellectual property at every layer?
We hypothesize that a cloud-first architecture with Zero Trust security, automated vendor controls, and real-time monitoring will protect BSP's growth trajectory at a fraction of the cost of a physical server.
Core concept: Every user, device, and network request is treated as potentially hostile, regardless of whether it originates inside or outside the organization. 81% of organizations are adopting Zero Trust by 2026 (Gartner). This means:
If Zero Trust had been in place, Russ could never have created parallel lead capture systems because he would have had scoped access to Google Ads only, with no ability to embed third-party widgets on the website or provision phone numbers without multi-party approval.
We compare three infrastructure approaches across cost, security, scalability, and operational complexity. Data sourced from 2026 industry benchmarks.
Including hardware, maintenance, IT support, power, cooling, insurance, and depreciation
Verdict: BSP does NOT currently meet any of these criteria. A physical server would add cost and complexity without proportional benefit.
Each layer addresses a specific attack surface. Current status shown.
Multi-factor auth, SSO, role-based access, automated offboarding. The #1 defense against insider threats. Prevents another Russ from ever having unchecked access.
Cloudflare WAF, DDoS protection, bot filtering, SSL/TLS, HSTS headers, CSP policies. Shields callbrightside.com from external attacks and code injection.
Real-time log analysis, anomaly detection, click fraud monitoring, API abuse detection. Catches suspicious behavior before damage occurs.
Encrypted backups, API token rotation, secret management, database encryption at rest. Protects customer data, financial records, and proprietary intel.
Multi-party approval for Google Ads changes, vendor access agreements, quarterly access audits, documented offboarding checklists. Directly prevents the Russ scenario.
Automated daily backups, tested restore procedures, business continuity plan, geographic redundancy. Ensures BSP can recover from any incident.
Nexus Guardian self-healing, error encyclopedia, automated security audits, anomaly-based alerting. The bleeding edge: systems that defend themselves.
Every threat BSP faces, ranked by likelihood and impact, with specific countermeasures tailored to prevent the exact attack vectors Russ exploited.
Nine enforceable rules that make the Russ incident structurally impossible to repeat. Not guidelines. Not suggestions. Non-negotiable operational requirements.
Kalen or Stephanie MUST hold Owner/Admin access on every platform: Google Ads, Analytics, GSC, ServiceTitan, WordPress, 3CX, Cloudflare, Hostinger. No exceptions. No "I'll set it up for you."
CRITICALEnable Google Ads Multi-Party Approval (released 2026). High-risk changes (budget, campaign creation, account access) require a second administrator's verification. Russ could never have changed budgets from $75 to $1,800 unilaterally.
CRITICALWhen ANY vendor, contractor, or employee leaves, ALL access across ALL systems must be revoked within 24 hours. Use a centralized checklist: Google, ServiceTitan, WordPress, 3CX, email, phone system, physical keys.
CRITICALEvery 90 days, review who has access to every system. Print the user lists. Verify every name is current. Remove orphaned accounts. This is a 30-minute task that prevents months of damage.
HIGHAll lead capture, booking, phone tracking, and analytics must go through BSP-owned accounts only. No contractor creates accounts in their own name. If a vendor needs access, they get a scoped role on BSP's account.
CRITICALEvery ad dollar must have conversion tracking. Run a monthly check: are phone calls, form fills, and bookings being recorded? If tracking breaks, pause spending immediately until fixed. Never spend blind again.
HIGHMonthly scan of callbrightside.com for unauthorized scripts, iframes, widgets, tracking pixels, or third-party code. The HCP widget went undetected for months. Automated scanning catches it in minutes.
HIGHMaintain a master list of every phone number associated with BSP. Test each number monthly. If a number doesn't ring to BSP, investigate immediately. No mystery tracking numbers from distant rate centers.
HIGHEvery contractor signs a written agreement: (1) BSP owns all accounts, data, and creative, (2) contractor gets scoped access only, (3) all credentials must be documented, (4) access terminates immediately upon contract end.
MEDIUMVendors CANNOT grant access to partners, subcontractors, or associates without explicit written approval from BSP ownership. Every person who touches BSP systems must be named, documented, and individually credentialed. No shared logins.
CRITICALAll reporting, analytics, and activity logs must be stored in BSP-owned systems, never exclusively by the vendor. Google Ads change history, Analytics reports, and campaign data must be accessible to BSP at all times. No vendor-only records.
CRITICALAny computer used for BSP work must have: (1) MDM or endpoint management software, (2) automatic cloud backup of work files, (3) BSP admin access to the device, (4) device cannot be wiped without BSP authorization. Work product stays with the company.
HIGHData-driven recommendations based on BSP's current situation, growth trajectory, threat landscape, and budget constraints.
| Criteria | Physical Server | Cloud (Current + Hardened) | Hybrid (Recommended Phase 2) |
|---|---|---|---|
| Upfront Cost | $8,000-$15,000 | $0 (already running) | $500-$2,000 (NAS device) |
| Monthly Cost | $700-$2,500 | $150-$350 | $200-$450 |
| Insider Threat Protection | Low (physical access = total access) | High (IAM, audit logs, MFA) | High (same as cloud) |
| Prevents "Russ Scenario" | No (doesn't address access controls) | Yes (Zero Trust + MPA + IAM) | Yes (same controls) |
| Disaster Recovery | Manual (if server dies, you're down) | Automatic (snapshots, zone redundancy) | Best (cloud + local backup) |
| Scale to $6M Revenue | Requires hardware upgrade | Click a button, resize VM | Same as cloud |
| IP Protection | Physical lock + hope | Encryption + IAM + audit trail | Best (encrypted local + cloud) |
| Requires IT Staff | Yes ($40K-80K/year or MSP) | No (managed by Nexus AI + GCP) | Minimal (NAS setup once) |
| VERDICT | NOT RECOMMENDED NOW | RECOMMENDED (Phase 1) | RECOMMENDED (Phase 2, Q3 2026) |
Harden cloud, implement Zero Trust, enable MPA, revoke all legacy access, deploy security stack
Add encrypted NAS backup, local file sharing, offline redundancy for critical data
Re-evaluate physical server need based on team size, data volume, and compliance requirements
A prioritized, phased plan with specific actions, costs, and timelines. Phase 1 addresses the highest-risk items immediately. No action is optional.
| What Russ Did | What Stops It | Status | Phase |
|---|---|---|---|
| Created HCP widget on BSP website | Monthly website code scan + WAF content security policy | Phase 2 | Week 1 |
| Provisioned mystery CallRail numbers | Phone number registry + monthly test calls | Not Started | Week 1 |
| Changed Google Ads budgets wildly | Multi-Party Approval (requires 2nd admin to confirm) | Not Started | Week 1 |
| Ran PMax with zero conversion tracking | Monthly conversion tracking audit + automated alerts | Partial | Week 2 |
| Sole control over all platforms | Owner-level access for Kalen/Stephanie on ALL systems | In Progress | This Week |
| No offboarding when he left | 24-hour access revocation checklist + automated deprovisioning | Not Started | Week 2 |
| Created accounts under his email | Vendor Access Agreement (BSP owns all accounts) | Not Started | Week 3 |
| Left with no documentation | System inventory doc + credential vault (1Password/Bitwarden) | Not Started | Week 2 |
| Web dev partner accessed BSP accounts | No unauthorized subcontractors policy + individual credentials per person | Not Started | Week 1 |
| Kept all logs/reports to himself | BSP-owned activity logs policy + Google Ads change history monitoring | Partial | Week 2 |
| Wiped work computer before handover | MDM + cloud backup + BSP admin access on all work devices | Not Started | Week 3 |