Mitigating Risk When Selecting a MSP/MSSP
not all service providers are created equal
mud on the tires
Approximately 70-75% of our projects are built around managed services. This has been our focus for nearly a decade, because we saw the emerging gap in the workforce and the evolving nature of IT. As a result, we've got some mud on the tires. Bugs on the windshield. We've seen the good, the bad and the ugly. We've learned a few tricks along the way that we'd like to share with you.
native services vs outsourced
It is quite common for a MSP/MSSP to sell services or resources that they do not offer in house. Before you sign a contract with a MSP\MSSP, you need to fully understand what services are offered natively and what services are provided by a third-party. One would assume that service providers would be transparent and volunteer this information up front, but that is not always the case. Ask what they whitelabel.
Sometimes it's a big deal. Sometimes it's not. Context matters.
For example, if you're in the market for a robust CCaaS (contact center as a service) tool, you should prefer call recording sit natively in the stack. You'll run into quality issues if it does not. If you want to add voice biometrics, an advanced service, you'll struggle to find an enterprise CCaaS tool that includes this element and you should feel comfortable partnering with a preferred vendor who supports your CCaaS flavor.
Another example is SECaaS (security as a service) provider who utilizes a third-party tool in their stack, such as Crowdstrike, SentintelOne or MSFT Defender for EDR. I personally prefer this model for outsourcing with third-parties, because the toolsets are typically superior to what an MSP/MSSP can develop internally. It’s also common for MSPs to white-label SOC services on their paper. This is problematic if the MSP is not transparent about the source of the SOC services. The more hops you place between you and the truth reduces your time to resolution in the case of an incident or support case.
buying a product on another supplier’s paper
This is a common practice in the SaaS and managed service market. I’m often weary of these arrangements, but there are practical examples of how it makes sense.
If you’re in the market for a CCaaS solution and you have advanced needs, you will require bolt-on third-party applications. A common example is voice biometrics. The magic quadrant leaders for CCaaS all partner with leaders in the voice biometrics space. Procuring a voice biometrics solution on a contact center vendors paper is a common and practical practice.
I often see UCaaS vendors sell CCaaS solutions on their paper, and vice-versa. This is rarely a good idea. The UCaaS market is changing rapidly, with M&A activity eminent. If you procure Supplier A on Supplier B’s paper, you often lock yourself into the holistic solution, even if support and pricing changes over time. The supplier of record is also responsible for front-line support of a solution they did not build, which means your meantime to resolution is disrupted.
I commonly stumble upon end users who want to migrate because they bought solution A on supplier B’s paper, because they were already doing business with supplier B and solution A solved a problem. In reality, they find that support tickets often have a longer resolution time, because the technicians don’t have the same level of familiarity with the product. If the support issue requires an advanced technician or a bug fix, end users often find that there is a long delay as they wait for the ticket to be escalated to the top of Supplier B’s queue before it migrates into the hands of Solution A. Do you really need to buy a solution on someone else’s paper? It depends and context matters.
appropriate r&d to support ongoing improvement
During your discovery phase with a new vendor, inquire about their yearly R&D budget. This is a great indicator of their future viability in the marketplace. In 2023 we’ve seen a number of vendors pause their R&D budgets. This is often combined with layoffs. If a vendor takes these steps, there is cause for concern that their solution will stagnate and support will suffer. Ask if their R&D budget is on hold and ask how much they spend each year.
maturity of managed service practice
Value Added Resellers (VARs) have seen their profits erode as hardware becomes commoditized. As a result, many have pivoted into managed services. This is an extremely difficult transition for most VARs to make. We’ve also seen a large number of MSPs/MSSPs pop up in regional markets because their client base demanded ongoing support. If these organizations do not make the critical investments in tools, repeatable processes and hire the expertise needed to provide elite support, the endeavor will not be successful. Perhaps they make enough to keep the lights on, but the value that they provide to end users will drastically fall short of what’s available on the open marketplace.
Creating a sustainable managed service practice is an expensive and time-consuming proposition. These organizations must invest millions of dollars over many years before they become profitable. Often times the proper investments are not made and the development of the solution is rushed. It’s crucial that you prioritize MSPs with experience, appropriate staffing, modern toolsets, and tight processes. Ask for references who have been with the MSP/MSSP longer than 36 months.
size of NOC & support staff
Your MSP should have more than one NOC (network operations center), because that’s common sense. All reasonable standards for business continuity would indicate redundancy of operation centers is crucial to your success and survivability, assuming the nature of the managed services are critical to your ongoing business requirements. Always ask how many NOCs an MSP has and how many technicians it employs.
The location of NOCs and location of support technicians can also matter. If you have strict compliance requirements, it’s crucial that you validate who has access to your data. For example, if you fall into scope for CMMC, you’ll likely demand that all NOC locations for a potential MSP/MSSP be located in the United States. Furthermore, you’ll want to ensure that only US citizens have access to your data.
That brings us to the topic of near-shore support. MSPs/MSSPs commonly utilize near-shore support models to 1) provide a follow-the-sun model for 24/7 coverage 2) provide an economic alternative. If you don’t have any compliance needs to consider, the utilization of near-shore support is purely a preference based on your appetite for reduced costs and expectations for support. Always ask where the NOC/SOC is located and who staffs it.
Finally, who staffs the technicians? Are they badged employees or contract? How does a supplier maintain quality if they don’t directly employ and train the technicians?
evolving landscape due to PE investments and M&A
Private Equity made a big splash in the tech scene. Many of the local or regional VARs (value added resellers) and MSPs (managed service providers) were snapped up by large entities. This often causes a disruption in support and legacy processes are challenged. In many cases, redundant positions are terminated, which creates a ripple of change that varies in severity based on the tribal knowledge and talent of the outbound resource.
If your organization goes public or is acquired by a PE group, how do we see the organization evolve? History tells us that the desire for increased profitability and reduced expenses could become the primary goal. Extreme profitability can be the enemy of great support, as we’ve seen repeatedly.
We've also seen great examples of outside investors making massive improvements in MSPs (managed service providers) that upgrade their infrastructure stack, eradicate technical debt, improve security and processes. It’s possible that this investment could improve the business and customer satisfaction, while yielding a longterm reward that makes this initial investment a sound move for all. This is nirvana. You should ask a prospective vendor if they are in talks to be acquired or if they’ve recently been acquired.
If a vendor has recently merged, you can expect disruption to business as usual. This could be mild or it could be massive. The maturity of the organizations and the attention they give to the migration combine to define the outcome. Merging systems is a herculean task. For example, if two MSPs merge they must collapse ticketing solutions or face certain doom by notification sprawl. If two MSPs collapse ticketing solutions and you’re their customer, you should plan for a disruption to your service. Now consider the vast number of systems and processes that have to be collapsed, rebuilt or thrown out the window.
We are currently experiencing the pain of massive mergers. Clients approach us daily to help them overcome the pain felt by their old MSP being acquired or merging with another business. In some cases, it’s a momentary obstacle that we quickly overcome. In some cases, the MSP becomes so fractured that they will not be your long-term partner. You should ask if any mergers or acquisitions are on the horizon.
jack of all trades | master of none
It’s extremely difficult to staff a managed service practice. The average tenure for employment continues its downward trajectory and MSPs/MSSPs constantly fight to onboard new talent and ramp them up quickly. If the service provider does not have a healthy talent acquisition and retainment practice, you will feel the burn.
This is especially true if you have unique requirements that fall outside of the typical scope of the provider. For example, fully managed services that cover the entire stack are increasingly popular. On occasion, end users request that a provider take over the management of legacy systems, such as premise-based storage, compute, firewalls, switching or PBX. While these requests are relatively common, it does pose a potential risk. Does the service provider have the adequate staffing to handle items that are out-of-scope for their core services? Assuming they do today, how do you ensure they maintain these capabilities? Are your service provider’s resources single-threaded?
Finally, it comes down to your expectations. Are you looking for very specific requirements that are unique to you, or will you be satisfied with generalist? I see this most commonly with helpdesk-as-a-service (also known as service desk-as-a-service), which is a quickly growing offering. Typically, service providers staff their NOCs with generalist for technician roles. Before you sign an agreement, you should validate your requirements and expectations and ensure that the service provider staffs accordingly. Does the service provider adequately staff to meet your unique requirements?
questions to consider
Does the service provider whitelabel elements of their solution?
If you buy a solution on another vendor’s paper, will it impact your time to resolution?
Does the service provider invest an adequate amount of budget to R&D?
Can the service provider provide references who have utilized the service longer than 36 months?
How many NOCs/SOCs does the service provider have and where are they located?
Who has access to your data? Does it leave the US? Does the service provider staff non-US citizens?
Does the service provider directly staff (rather than outsourced) its NOC/SOC staff and technicians?
Has the service provider recently been acquired or is an exit event on the horizon?
Does the service provider have adequate resources to cover your needs? Is there redundancy with these resources?
What is the service providers average tenure for staff?
Are there alternative service providers who can excel at my requirements?
Does this service provider play nice with the tools and services I consume today and plan to consume in the future?
Does this service provider limit me in the future (vendor lock-in)?