How to Evaluate a Managed Service Provider

To evaluate a managed service provider, test three things the sales process does not surface: what is actually in scope, what the provider's own security looks like, and what happens when you leave. Capability demos answer none of them. Those three answers predict the relationship better than any reference call.

I am Amelia S. Gagne, CEO of Kief Studio. We run managed operations, so read this knowing which side of the table I sit on. The detailed pieces are what an MSP scope of work should say, reading an MSP service level agreement, and how to offboard a managed service provider.

Why is it hard to evaluate a managed service provider?

Because the thing being sold is a promise about future behavior under conditions nobody is in yet.

You can inspect software before buying it. You cannot inspect how a provider handles a Friday evening outage until there is one. Every evaluation method is a proxy, and the useful proxies are structural rather than impressionistic.

The market is also large enough that quality varies enormously. Estimates of its size disagree substantially, which is itself informative: MarketsandMarkets projects the managed services market at $460.59 billion in 2026 growing to $705.22 billion by 2031, while other firms put 2026 between $370 billion and $437 billion. A category that analysts cannot size consistently is a category with unclear boundaries, and unclear boundaries are exactly the problem you are trying to solve in the scope document.

What should you establish before talking to anyone?

Your own situation, in writing. Otherwise the first provider you meet frames the problem, and every subsequent conversation is a comparison against their framing. That is the trap in recommendation before diagnosis.

Eight inputs shape what is actually viable, and we do not make technology recommendations without them:

• Current stack and integrations, including the things nobody wants to admit are still running.
• Hosting environment: cloud, self-hosted, hybrid, regulated.
• Budget including total cost of ownership, not license cost. The full argument is the sticker price is the smallest line item.
• Operational culture: how your team actually works and at what pace.
• Where the organization is going, not just where it is. See technology that fits today's org chart.
• Team skills, because the best tool is the one your team can operate.
• The actual pain point and its root cause, which is usually not what the symptom suggests.
• Hardware and site constraints, covered in the hardware problem nobody mentions during demos.

Write those down before the first call. The document is worth more than the vendor comparison spreadsheet.

What questions separate providers?

What is explicitly out of scope? The most informative question in the entire process. A provider with a clear exclusions list has been through enough engagements to know where scope fights start. A provider who says everything is included is either not listening or is pricing for a fight later.

What is your own security posture? This is the one buyers skip, and it is the highest-consequence one. A provider holds administrative access to your environment, so their compromise is your compromise. The Kaseya VSA incident affected roughly 1,500 downstream businesses through approximately 50 to 60 providers, none of whom had any relationship with the compromised product. Ask about MFA on their own administrative tooling, how remote monitoring access is segmented per client, and whether their technicians use unique credentials per environment rather than shared ones.

Joint advisory AA22-131A, issued May 2022 by CISA, the NSA, the FBI, and partner agencies in the UK, Australia, Canada, and New Zealand, recommends that customers ensure their contracts specify the provider implements baseline controls. Ask for that language.

Who actually does the work? Named tiers, escalation paths, and whether the senior engineer in the sales meeting appears again afterward. Also ask about their own key person risk, which is the bus factor applied to a vendor.

What does the first ninety days look like? Good providers describe a normalization period: asset inventory, documentation, access review, alert tuning. Three to nine months is a realistic range before steady state. A provider who promises immediate steady state has not done the discovery.

How should you read the pricing model?

Per-user and per-device monthly pricing dominates because it is predictable and easy to compare. Predictable is not the same as aligned.

Per-device pricing rewards the provider for more devices. Per-user pricing is more neutral. Flat-fee bundles shift utilization risk to the provider, which is good for you and priced accordingly. All-you-can-eat contracts sound generous and usually carry the tightest exclusions, because that is the only way they work.

The question is not which model is best. It is whether the model rewards the provider for the outcome you want. A provider paid per ticket has no financial reason to eliminate the cause of tickets, which is the general problem described in who benefits when someone recommends a technology product.

One market note worth knowing as leverage: providers report that the share of clients spending more than $25,000 a year has fallen sharply, and client acquisition is the binding constraint in the category, with most new clients switching from another provider. Buyers have more negotiating room than they assume.

What should you check on references?

Skip the happy-client call. Ask instead for a reference who had a serious incident, and a reference who left.

The second one is unusual to ask for and the answer is diagnostic. A provider who can hand you a former client's number has confidence in how they handle exits, which is the most reliable signal available about whether the relationship is held together by results or by switching cost. That is the subject of technology vendor contract exit terms.

What a good fit looks like

A provider whose exclusions are written down, whose own security posture survives the questions you would ask any vendor, who can describe the first ninety days in specifics, and who will contractually help you leave.

Nothing on that list is about technical brilliance. Technical capability is close to table stakes at the upper half of this market. The differences that show up over three years are operational discipline and honesty about scope, which is why what client retention actually measures is a more useful question than it sounds.

We run this model ourselves, two people delivering the output of a larger team, which is only possible because the operational discipline is the product. The method is at ltfi.ai and the reasoning is in the two-person studio model. Brian Gagne handles infrastructure and security architecture, and briansgagne.com is the deeper technical read.

Related reading

• What an MSP scope of work should say
• Response time is not resolution time
• Co-managed IT without splitting accountability
• What is included in managed hosting
• How to actually evaluate a technology vendor

Frequently Asked Questions

How do you evaluate a managed service provider?

Test scope, the provider's own security posture, and the exit terms, rather than capability. Ask what is explicitly excluded, how their administrative access to your environment is protected and segmented, who actually does the work at each tier, and what the first ninety days involve.

What should I ask about an MSP's own security?

Whether multi-factor authentication covers their administrative and remote monitoring tooling, whether technician access is segmented and uniquely credentialed per client, and whether they will accept contract language specifying baseline controls, as joint advisory AA22-131A recommends customers require.

Which MSP pricing model is best?

There is no universal answer, but check whether the model rewards the provider for the outcome you want. Per-device pricing rewards more devices, per-ticket arrangements do not reward eliminating ticket causes, and flat-fee bundles shift utilization risk to the provider and carry tighter exclusions as a result.

How long before a new MSP relationship reaches steady state?

Three to nine months is realistic, covering asset inventory, documentation, access review, ticket categorization, and alert tuning. A provider promising immediate steady state has usually not completed discovery.

What references should I ask for?

Ask for a client who went through a serious incident and a client who left. The second request is unusual, and a provider willing to make that introduction is telling you something reliable about how they handle exits.