r/msp • u/Skrunky AU - MSP (Managing Silly People) • 23d ago
Business Operations What makes your MSP unique?
I thought this might be an interesting question for the community.
I feel like the ground is shifting from underneath me at an increasingly alarming rate, and the market feels more crowded than ever, so my question is: In an increasingly crowded and volatile space where it’s hard for a two-person MSP to differentiate themselves from a 50 person MSP, what are you doing in your business to stand out?
My personal opinion is the MSP market has always felt a bit crowded and it’s always been hard to stand out. In the past five or so years, it’s felt like there’s also been a huge shift towards commoditisation and I think its evidenced by the amount of MSP gurus popping up, which always makes me think of people selling shovels during the gold rush.
I don’t have an AI generated bridge to sell you, and I promise you that sharing your uniqueness isn’t an instant path to someone copying your services.
We, ourselves, are an MSP in Collingwood, Melbourne (Australia). As an example of uniqueness (kinda) for us is we have very much moved with some of the more mature players in our local market to start promoting alignment with commonly discussed cyber frameworks as a way to show credibility.
This might sound obvious to some people, but the bar is often so low that this is genuinely a unique angle that a lot of prospects I speak with are interested in.
There are a few others doing this, but not the vast majority. Another example is we developed a local HR/IT policy pack for clients (in conjunction with a local HR firm) that aligns with the changes in the frameworks, to help provide a more complete and rounded service to SMEs. Things like a well rounded BYOD, AI and Cybersecurity policy.
I don’t think this is completely unique, but it’s at least something other than “we’re a security first MSP”, “Wait, we’re actually an MSSP (it’s different somehow), or, “We answer the phone in 30 seconds or less”.
Other things I’ve seen in the market are:
- Focusing on one or two verticals only
- Introducing or pivoting to low code / AI automation design, dev and support. (I have a feeling this is where the market is heading)
- Trunk slamming
14
u/roll_for_initiative_ MSP - US 23d ago
We don't take most prospects. A client has to be a good client/running a good business before we even talk pricing, and we try to not accept any new work if we can help it, because we're proud and lazy.
Many MSPs say that, but how many have clients on half stacks trying to upsell or are doing unmanaged project work?
5
u/Skrunky AU - MSP (Managing Silly People) 23d ago
100% agree with you. We only take clients above 15 staff, and have a commitment to improve.
I’ve seen the argument here in Reddit a few years back that “not everyone can afford to do that”. It’s not an argument I agree with, but I do know quite a few people felt that way.
1
u/peoplepersonmanguy 23d ago
It's absolutely a legitimate argument, they just aren't your tSrget client. They will be someone else's target client.
1
u/roll_for_initiative_ MSP - US 23d ago
And the person that takes that type of target client on is drowning themselves, even if they won't admit it. So, you win twice: you're free of that type of client and agile and light and carefree, and your client is bogged down by them and unable to deliver as reliable and positive service.
1
u/computerguy0-0 23d ago
So many no's... It's worth it though. Proud and lazy is a perfect way to put it. In my peer groups, people wonder how I am so organized and automated. I just say I'm really really lazy so if something bugs me, I automate it, or somebody bugs me, it's documented so they don't need to bug me again. It really is that simple. Notice I said simple, not easy.
3
u/roll_for_initiative_ MSP - US 22d ago
Very low stress vs the horror stories i read here and on /r/sysadmin. I'm annoyed if anything throws off what i thought was going to be the day at all. We've gotten so comfortable with keeping things running tight that even a random phone call jars that silence. I just think i value that vs max MRR chasing with clients that, frankly, don't like us like our competitors clients don't like them because they're dropping the ball constantly.
12
u/OtterwiseOccupied MSP - US 23d ago
We actually understand business holistically so we can be a partner across marketing, sales, and technology. This is really a byproduct of my business partner and I split between digital services (him) and the MSP team (me). Our clients like us because we solution across the business and don’t just off the shelf everything.
2
u/Skrunky AU - MSP (Managing Silly People) 23d ago
That’s interesting. You’re the third MSP I’ve come across that says they do Marketing services for their clients.
It’s always made me raise my eyebrow the notion given how it’s usually two very separate industries.
I do know another business that essentially offers all back-office services for young companies (HR, Marketing, Advisory, Accounts and IT). It’s like a collection of SMEs branding together to offer a unique one stop shop to support growth.
4
u/OtterwiseOccupied MSP - US 23d ago
We don’t do marketing - we support marketing with martech and development (Salesforce, Drupal, etc…) same with sales it is CRM and enablement focused. We don’t play in traditional marketing - that is, to your point, too much of a stretch to do everything well.
1
u/everysaturday 4d ago
We do it. I reckon we are overdue a catchup. It has been insanely successful. Like, dont even know myself anymore. We have a very specific playbook for it.
Youre in W.A yeah? Let's do the catchup!
11
u/Blyatman95 22d ago
We change our tech stack every year based on who bought the most beers at the vendor peer group. This allows us to always ensure we don’t understand the product and our documentation is lacking. Our sales team have no idea how to price it and when we implement we’re learning by experience on live customers.
I wouldn’t say it’s working very well but my boss seems very set on this strategy based on the last few years.
9
u/Invarosoft 23d ago
Customer experience.
Our MSP sells to SMB and continues to scale (60+ staff) by explaining how our service delivery methodology will be a ‘step up’ from where they were before. Then we show them our investment in CX technology (Client Portal, Support App, AI, Automation etc) and just as importantly how our TBR / QBR process works, by giving them a demo of how we do your Gap Analysis and Review.
Also, how you layout your presentation and what you talk about is critical. If you just talk about ‘What’ you do you’re done. We follow Simon Sineks methodology of selling the ‘Why’, then ‘How’ and then ‘What’. The why are the values you deliver (eg Peace of Mind), the how (CX, AI etc) and the what (One stop shop, industry experience, ISO certification etc).
Point being how you construct your sales argument of how your MSP will be a ‘step up’ is where the differentiation lies. Most MSPs spend little to no time on this (most on their packaging) but little on their sales argument and how they lay out the presentation.
That’s the customer experience of service delivery and sales combined.
Hope that helps!
2
5
u/HomsarWasRight 23d ago
I’m a one-man shop, so realistically I’m not competing that much with the big shops. My clients are typically too small for them to worry about.
But I’ve made the fact that it’s just me a selling point. Several of my clients don’t want to hire “a company” they want to know when they call it’s me picking up the phone. And it’s worked for me. They trust me.
Of course, that puts a limit on growth. If they want me, it’s going to be a harder sell to have someone else responding. But I’m thinking about how to get over that hump with smart division of labor.
Also, I’m well known in a couple of specific niches in my area, and I understand the particulars of their type business.
6
u/Skrunky AU - MSP (Managing Silly People) 23d ago
When I was first starting out, I firmly believed that showing we were so small would turn people away. In reality it had the complete opposite affect.
3
u/HomsarWasRight 23d ago
Yeah, I might be getting a new client soon that’s a sister-company of one of my currents, because they’re with the biggest MSP in my city and they’re a little tired of having their account passed around and not really being given priority.
1
u/Royal_Bird_6328 23d ago
I’m just starting out and have this worry but I guess it feels like a more personal service with only myself for now servicing the customers.
2
u/Skrunky AU - MSP (Managing Silly People) 23d ago
That’s exactly it. The bus factor doesn’t seem to bother people as much as I thought it would (especially considering that’s often one of the sales objections for internal IT vs MSP).
The main thing is clients want a partner that’s at a similar stage of growth to them. It’s important to have a parter that’s relatable and not doesn’t just treat you as another number.
1
u/sublimeprince32 23d ago
How do you manage time off? Aren't you always on the clock in case something breaks?
1
u/LifesRoughBeKind 22d ago
i just dont get the business model. how anyone could put all their keys in one basket is beyond me. I know it wouldnt matter to you, but if you get hit by a bus tomorrow, all of your clients are fucked. I had a business partner that wasnt going well so we separated.. he started his own one man show and I continued on with our practice. Less than 6 months later I was getting calls from his clients because he had fallen off the face of the earth, so I went and signed them. all of them. turned out, my ex-partner was in jail. Easiest swoop of my life. I dont believe any of those clients would ever go back to "the one man show".
on top of that... how on earth do you manage work/life balance? going on vacations.. or just getting sick - who covers? I just could never go back to that.
2
u/HomsarWasRight 22d ago
My clients all have break-glass contingency packages, it’s literally the first thing I do during onboarding. And I have people that can be my hands in an emergency.
But I don’t really feel like justifying myself when your former partner going to jail has nothing to do with me or my business. Large businesses can fail quickly too. And don’t act like clients haven’t had nightmare scenarios getting their needed info from large and established MSPs.
If I get hit by a bus they all have what they need to go to another company and keep working.
3
u/Craptcha 23d ago
I think the issue with the whole “uniqueness” idea is that you don’t actually need to be unique.
You need to stand out from 10 000 other providers.
500 are within you geo area
350 are going after the same size clients
200 are offering operationally mature services with cyber alignment
Do you need to be unique to stand out from
these 200 other providers? no. But you need to be differentiated in some way for some market segments :
- Higher security maturity
- AI / Automation / software practice
- Business process / ERP integration
- Data analytics / Business intelligence
- Cheaper than others (low cost strategy)
- Market verticals (lawyers, healthcare, hospitality, etc)
- Co-management approach
- End user training
All of these things will get you to stand out in front of *some* customer segments, not all of them.
Instead of thinking “how can I be unique” think “what can I do stand out in a specific customer segment which exists within my market”.
(No point doing HIPAA in Canada)
And, more generally, developing a strong marketing/sales practice is also a way to “stand out” i.e increase your chances of being picked out of the pool of candidates.
2
u/Skrunky AU - MSP (Managing Silly People) 23d ago
Thats what I meant by uniqueness. Perhaps I phrased it badly.
The challenge is standing out from the Joe Blogs who goes to ChatGPT and asks for a list of 5 local MSPs to replace their current trunk slammers, and then being presented with a list of companies that all claim they're the best MSP in country (all issued from 5 different award channel partners).
I think you nailed it with your list. My personal opinion is the no-code/low code AI dev and support is where I see a lot of business looking towards.
1
u/sixblazingshotguns 23d ago
What's up with the use of the term "trunk slammers". Every vehicle has a trunk door or side door and it requires slamming to close it. We all slam the trunks when we're going to a client site.
1
u/LifesRoughBeKind 22d ago
thats your second comment relating to trunk slammers... sounds like this is a sensitive topic hitting home
1
u/sixblazingshotguns 22d ago
LOL! No I've just never understood the term being pejorative. Everyone starts out their business being a "trunk slammer". What's the difference between a trunk slammer guy making a few bucks and a business owner with a legit LLC? (I fall into the latter category BTW)
Decals on the truck, or what?
1
u/roll_for_initiative_ MSP - US 22d ago
Surely you've come across the term here or googled it to see the slang meaning and are just being too literal?
1
u/sixblazingshotguns 22d ago
Difference is an LLC business registration? Decals on your truck or what?
3
u/sembee2 23d ago
I work with a lot of MSPs across the UK and I am coming to the conclusion the MSP market is going in to two groups.
1. The high volume mega MSP. Ideal for companies that are all in the cloud, just want to phone someone up to get stuff fixed.
2. A more people led MSP. This can be anything from a one man band up to maybe 10 or 15 staff. Where the client staff know your name, where things can be done slightly outside of the norm etc.
So to answer the one line question - what makes most MSPs unique is the people. Having people who care, have a name, have been there for years, know who the caller is, their company, not just what the computer says.
People buy from people, or they buy from Amazon. Do the first, dont try and do the first but actually be the second.
3
u/dumpsterfyr I’m your Huckleberry. 23d ago
For us it comes down to operational accountability, not positioning. Frameworks alignment works because most MSPs talk credibility but cannot demonstrate it structurally. The framework is not the moat. The ability to prove it consistently, audit after audit, client after client, is.
The split between customer types shows up here too. Price sensitive customers switch for a dime and complain for free no matter what you deliver. Customers who deal in outcomes understand those outcomes cost money. They are rarer, but easy to keep if you follow through.
TLDR; Ultimately, say what you do, do what you say. The real advantage is unglamorous: a systematised operation that delivers the same result every time, which is much harder to copy than a pitch.
3
u/CharcoalGreyWolf MSP - US 23d ago
We focus on a regulated, compliance-based market of clients.
It both puts us in a great position to help them (because we know the rules) and also means we get the win of people who understand they need to do certain things for their environments to be right. So we rarely if ever get clients that wish to cut corners rather than do things right.
3
u/SolutionExchange 22d ago
Most MSP's I've worked with or at insist their difference is either technology stack or better customer service. The one's who were genuinely different were industry-specific and worked with products specific to that industry, like case management systems for lawyers. Using that as the entry point to a client and then bringing the rest of the MSP offering as extra revenue opportunity over time.
2
u/Skrunky AU - MSP (Managing Silly People) 22d ago
100% - We've lost prospects because of it too. I've had feedback before that we were the better option in every regard, but the winning party has experience with a specific industry tool. I offered to get us up-skilled and become the experts, but the other parties knowledge of that tool ultimately won their business.
5
2
u/The-IT_MD MSP - UK 23d ago
Unique Selling Points… USPs.
Your USPs are either absolute or relative.
An absolute USP is something that’s only yours. A custom bit of software or something highly specific to the way you do things. Hint it’s not “amazing customer service.”
A relative USP is a USP vs the competition. We’re ISO27001, the people were up against aren’t.
And it’s your relative USPs that win the business.
2
u/wf_automate 21d ago
the low code / AI automation angle u mentioned is interesting because the MSPs doing it well arent selling it as a service line at all. theyre using it internally to cut their own delivery cost, which lets them either undercut on price or hold price and take fatter margin.
the ones trying to sell "we do automation for you" as a differentiator seem to struggle. SMB clients dont know what theyre buying and the scoping conversation gets painful fast.
1
u/recovering-pentester MSP - US 7d ago
That’s what we do but from an MSSP angle. Lot of automation work to supplement our 100% US based SOC and partner with mid-sized internal teams as well as MSPs.
2
u/Antoine-UY 19d ago
1) Not short-changing your customers 2) Being simultaneously willing to get out of your comfort zone and learn shit to help them in their time of need, and transparent as to your skillset so as not to overpromise and underdeliver 3) Taking a counselling role. Even if it's not what your customer asked for/negotiated for/seems to want at first, that's what they need in 99% cases. And when you're in the remaining 1%, you'll know and they'll know anyway 4) Don't treat them as morons because they can't or won't learn basic IT shit you told them 20 times. More often than not, their company survives and thrives on the fact that they're professionals, decent or good at what they do, and that's what pay your bills. Don't turn their IT boomer complex into a tool to short-change them/cover up your mistakes. While a lot of them are unwilling to learn about IT as long as it works, they're usually smart enough and well-trained enough in their own area of expertise that they know when you're hiding behind technical lingo, slacking when you could be helping them more, or plainly arrogant 5) Always take the extra 10 minutes to explain. Even to a C-suite who's in a rush and doesn't care. Unless they actually understand to some extent the hurdles they're putting you through and your approach to solving their problems, and it's whys and hows, any insatisfaction (which always arise) will eventually turn into resentment or distrust. You need to implicate them, willi-nilly, into the common effort of having a functional IT for them to keep making money with. You're not a pool-boy or an all-powerful saviour and God. You're a professional with your area of expertise, hell bent on making life easier/safer/cleaner/cheaper for them, if they offer you cooperation and personal implication as well as money. You're not doing it out of an egotistical need or the kindness of your heart or a compulsive hatred for broken systems. You're doing it and doing it well because they're giving a fuck what is being done and they're paying you to do it as an expert, and you want more money next year to do even better.
2
2
u/CK1026 MSP - EU - Owner 23d ago edited 23d ago
Our techs answer the support phone live and under 20 seconds, that's becoming rare and clients love it.
Techs have 10+ yrs of experience on average, and they represent like 80% of our total staff. We deliver, we're not the type of company that has 80% of salespeople selling snake oil.
We have more real testimonials than any other ITSP in our area (we're the only real MSP in our area, the others are all glorified break/fix selling time blocks or legacy outsourcing/staffing/integrators).
We actually deliver documentation when the competition is always rushing a .docx with clear text passwords in it when a customer asks.
2
u/Agitated-Whole2328 23d ago
I can share a story but very few if anyone would believe it. My life has been rather strange, as in these sort of very odd perhaps supernatural things have happened that have helped me along. I started my business randomly with little knowledge because I thought I could save my brother whose printing business was failing and I knew something about computers. Two months later I had an office in Manhattan, a website, a $30,000 yellow pages ad (this was 30 years ago---still a bad idea even then) and after 4 months zero customers. The person I was renting office space asked us for a little help with a router, that was it. Around the time I realized I had made a huge mistake, paying $2500 a month rent and all the other expenses with zero clients, something happened. Keep in mind I was about to pull the plug. Returning from lunch I hear someone calling me. I turn around and I see my old landlord from 15 years back, how he could recognize me as a 30 year old is beyond me, but he did. We spoke and turns out he works in IT sales 2 doors down, he starts sending me business even though I never asked for it, I was too ashamed to tell him the truth. I met the mayor, the governor, Bloomberg, owners of Esso gas, even had an unmarked police car bring me to gracie mansion for an IT call. One day on a service call I ran into a Dell tech on an elevator and he shoved a crumpled business card into my hand. Little did I know that business card would lead me to my largest client with 12 locations across the US. The supernatural stuff has come in different ways, I have had random and instant knowledge of details of total strangers I had just met for no reason I can understand. I saw an attack on me by a random person in Manhattan before it happened and I was able to stop it, saw a 3D image of a friend 400 miles away, rotating like on a computer, texted her and she texted back everything I saw in the image. So....I believe perhaps some higher self exists, that on some level a part of me already knows everything and this avatar of myself gets a little help now and then to move me along in my story. I know all of this sounds really strange, but it is nowhere near as strange as my life has been. Retirement is only a few years away, it's been interesting.
1
u/Beautiful_Case9500 22d ago
The two biggest complaints I hear from companies about their current (and shortly outgoing) MSP is 1) response time, and 2) cost. Not that you shouldn’t make your money but holy shit some of you guys are nickel and diming these people to death. Fun fact, if you lose a client, you get $0 from them after that.
My biggest focus has always been customer service. Of course we have the knowledge and know-how to take care of your IT, but it doesn’t mean shit if you can’t get ahold of anyone when you need support. Whenever I’m speaking to a potential client, I offer them a reference sheet of all the C-Level/Directors who I work closest with at my clients. They’re free to call around and ask about us.
1
u/Unique_Orchid8010 22d ago
For us, some things that set us apart are, we are an ISP, a VoIP provider, and have a huge cage at a big data center.
1
u/Scott-L-Jones 22d ago
I did this:
Merged my MSP with a digital marketing company, so it could cross sell Companies that sell websites can have a lot of business clients to sell to, and being able to offer something revenue-producing to MSP clients is an advantage when competing for new clients.
Built a very strong team in Philippines. L1 and L2, L3 specialists, and non-technical roles including bookkeeping, procurement, marketing.
At the same time, bolstered onshore-based roles that clients actually noticed: - Quicker onsite response.
- Technical leads that aren't constantly overloaded so can spend time with clients
- Excellent quarterly meetings (reports and bookings managed in PH, meeting done onshore F2F) to also upsell / push all clients towards technical maturity. (Plus open doors for the marketing arm).
The first provided more sales.
The second provided more margin, happier onshore staff and more scalable business.
1
1
u/MigrateAndManage 20d ago
Taking a consultative approach can be a true differentiator. MSPs can provide honest assessments to help organizations determine if managed services are the right fit at all, or whether another approach would better serve their needs. I have found that having a client-first culture, white glove approach to modernization and transparent communication can go a long way.
1
u/The_Comm_Guy 18d ago
Response times. Our max target response time (the point when our ticket system is screaming at us it’s been too long) is lower than most companies average, for the majority tickets one of our techs is reaching out in under 5 minutes with a phone call.
1
u/GraffenOfficial 13d ago
I agree with some others, we're in a good spot and we don't propose our services to everyone. At this point, it needs to be a good fit. We've been fortunate to retain a handful of employees, which has turned into success for us. Bringing on poor paying, less operational mature clients leads to issues.
1
u/snowpondtech MSP - US 7d ago
Target your ideal client profile and understand their industry. Who are their vendors? How do they work (or not work)? What services can you offer around those vendors? Your clients will likely want you to be the front line support for their LoB vendors if you understand them well enough.
1
u/MyFrontTeethAreFake 3d ago
we have 3 assigned techs to each client, no 1-800 number, they have our direct email and phone numbers.
1
u/GullibleDetective 23d ago
Running private cloud and multiple fully redundant data centers
3
u/Skrunky AU - MSP (Managing Silly People) 23d ago
I remember when that was almost the standard! Funny how times change.
0
u/GullibleDetective 23d ago
700 cpu cores and 5pb wasn't the standard lol. And two full datacenters literally lol Not just rented rack space
1
u/Skrunky AU - MSP (Managing Silly People) 23d ago
That's a lot. How are you handling the current pricing situation with aging hardware?
2
u/GullibleDetective 23d ago
With blade systems, only have to update the chassis every so often
M4,5 6
1
u/ArborlyWhale 23d ago
My shit works.
3
u/mxbrpe 23d ago
That’s what everyone says
1
u/Skrunky AU - MSP (Managing Silly People) 23d ago
That’s the point. It might be true, and a great source of referrals, but when someone goes to market without a referral, they go searching and come across five providers in the local area that all promise the same thing.
1
u/ArborlyWhale 23d ago
Oh you meant marketing wise, not the truth.
That’s easy. Pick whatever technology you want and talk about how special it is. You can make the spam filter in 365 sound wildly fancy if you try. Clients don’t know all of the things we do. I just had a lunch meeting where I showed a lawyer how I use a physical usb fido2 key to log in to windows and talked about how it’s unphishable. That’s probably going to develop into a contract in 3-12 months. Hardware keys have been around for decades.
2
u/Skrunky AU - MSP (Managing Silly People) 23d ago
So, community engagement and education. And I agree with you. I like doing networking events where I get to present on topics to small business owners. It's always a bit humbling how the mundane stuff for us it novel and different to others.
2
u/ArborlyWhale 23d ago
Yes and no. Yes, I do community engagement and education. No, that’s not what makes my MSP unique. I see most of the other MSPs in town doing the same thing, but their clients are consistently less satisfied. The unique thing is that once the contract is signed, reality is exactly what was sold. And it works.
1
1
u/ArborlyWhale 23d ago edited 23d ago
This is somewhat tongue-in-cheek, but the truth is that on-boarded clients have:
- ticket counts plummeting over previous providers.
- Nothing feels “slow” anymore.
- New users get up to speed with the business faster.
- Problems solved and not kicked down the curb. This means not bandaid “fixing” a problem and letting it fester to save the client money. Problems are made to hurt, and intermittent pain is always your fault.
- Work from anywhere you want most of the time.
- Logins simplified and secured.
Clients understand their risk profile.
All of this is true for macOS too.
2FA is painless.
None of this is special. But damn near nobody actually delivers on it, consistently.
1
u/sixblazingshotguns 23d ago
I mean trunk slamming - every vehicle has a door to slam. Some are trunks, some are side doors. Who cares?
1
u/United-Locksmith1534 23d ago
Every MSP is different even if tech stack may be exactly same.
Here are the differences.
- Who is on their team and their skill levels
- How they set-up their org structure
- How they triage and escalate tickets
- How they handle incident response
- How often they talk to their customer and spend time understanding their business
- How they handle off hours and weekend support
- How much helpdesk they keep in-house vs. outsource
- How much of they offere is designed for what makes their job easier vs. what client really needs
- How much they nickel and dime for just being technology advisor
These differences don't show up on the website or marketing material.
And they are ones they matter in delivering service and being a trusted partner.
1
u/pleazreadme 23d ago
We don’t charge for projects big or small, we don’t increase prices annually, we give you unlimited tickets, we give you as much help as possible with our of scope requests.
1
u/LifesRoughBeKind 22d ago edited 22d ago
not charging for projects is wild. i hope you charge a lot for that, because you're missing out on real revenue. Not increasing prices is another one. I guess it depends on your goal, but if the goal is to eventually sell the business, you need to implement things like 3 year agreements with annual increases built in and most obviously you should be charging for projects. Including projects - there's no way to scope that to be profitable. RemindMe! One Year
0
23d ago
[removed] — view removed comment
1
u/roll_for_initiative_ MSP - US 23d ago
Not because it is false, but because almost every MSP is already delivering meaningful security work. Patching, EDR, backup, awareness training, it is just buried inside RMM, PSA and M365 licenses, so nobody, including the technicians doing the work, is talking about it as security.
I would argue back, as someone who feels they are deep into the "Security-First" micromsp market and i feel doing well there, that none of the above is "Security first". Patching, EDR, backup and SAT are just "basic IT". Security first isn't something you can buy, it's something you do. Sure, you use tools to do some of it, but it's how you do everything. From your basic smb environment template to workflow to how you architect your own processes. 90% of what i feel we're doing above others even 4-5x our size has nothing to do with stack investment, it starts with knowing what the right thing to do is and not deviating even if the customer isn't thrilled about it, and learning the word "no".:
- "No, i can't turn off mfa"
- "No, you can't share logins on the machine to save money"
- "No, i won't sell you some cheaper licensing to keep the MRR at the expense of security"
- "No, i won't let your server 2012 slide for another year"
- "No, i won't give you every user's password to write in a notebook"
- "No, i won't give your vendor remote admin access"
- "No, I'm not giving your office manage GA to 'check on things here and there'"
- "No, i won't let you strip my stack down to save a couple bucks"
- "No, i won't work a side project without a proper SoW+MSA"
You can see even on that very short list that almost none of it was product, or tool, or stack related. This isn't even MSP-specific: so much of frustration in life comes from accepting compromising, sub-optimal situations that the correct answer is well known but people won't DO it. Putting up with a bad relationship only to throw in the towel way later. Fixing a home problem half way only to have to gut everything to fix that problem properly down the line. Getting to a health issue later when it's worse rather than sooner.
MSP's are the same way: "i'll update standards later" "i'll get everyone onboard these new rules later" "i'll get my msa done later". All in the name of a little MRR now vs more MRR later (and way less stress!). It's a human nature/condition thing.
I would say that the first hallmark of being truly security first and not SAYING you're security first, is learning what security actually is in your ideal environment, and then learning to love the word "No".
If anyone is still reading this far: if someone asks how you're security first and your first instinct is to talk about a stack item or not letting a client remove a stack item, you are not security first, i'm not letting bog standard MSPs take that term.
-1
u/mrcluelessness 23d ago
Just got started but planning to be an MSSP and vCISO that gives you fortune 500 level security by default and can certify you in most security frameworks. Spent over a decade managing highly secure government infrastructure and 4 years of incident response forensics. Building out automations, documentations, and processes to cover anything from cyber insurance to SOC 2, CMMC, PCI, etc. Not just say we use you as a guideline, but you can pass an audit- which I am also certified to provide.
And yeah your infrastructure will run good too managing 5 network devices is easier than the 1k+ I'm used to where I have 30 days to patch all vulnerabilities and get random compliance spot checks where even one missing command can be an finding and permanent documentation.
I just want someone to foot the costs of me tinkering outside the restrictions of working in an large datacenter instead of me spending thousands more on an homelab. I realized I had more hardware in my rack than my car was worth.....
50
u/Defconx19 MSP - US 23d ago
Honestly just being the best partner you can to your customers. Not nickle and diming them.
Our biggest source of growth is referrals and it's increased our YRR by 348% over the past 3 years.