WholeReach · industry directory

Managed IT Services

The companies that define the managed it services industry, each read on the same nine-check website rubric — a 0–100 score with the exact fixes — alongside the concepts, the developments and the questions that shape the field.

See the directoryGet your free score

The companies

18 companies in the managed it services industry, each graded on the nine things that decide whether a buyer or an AI assistant can find and trust them online. Open any name for the full write-up and the specific fixes.

70+ solid   45–69 gaps   under 45 costing customers

Sites we couldn’t reach

16 businesses whose website blocked our scanner — common when a site filters datacenter traffic, and not a sign the site is broken. A blocked site is never scored zero.

Who defines the managed it services market

The firms, funds and institutions that set the terms in managed it services — context, not local listings; never scored.

Managed IT Services guides

Concepts

Managed services agreement (MSA)

The master contract that defines the relationship — scope of covered services, covered environment, exclusions, service levels, fees, term, renewal, liability and termination. Everything an MSP argues about later is decided here.

Per-user vs per-device pricing

Per-user charges a flat monthly fee per employee covering all of that person's devices — it matches how an owner thinks about headcount and travels well when staff carry a laptop, phone and desktop, but it is unprofitable in device-heavy environments like manufacturing or labs. Per-device charges by workstation, server, firewall or network device — predictable to deliver and easy to audit, but it penalizes a clean estate and forces a pricing conversation every time a machine is added.

Tiered flat-fee packaging

Good/better/best bundles — typically support-only, support plus security, and a compliance or advisory tier. Simplifies selling and creates a natural upgrade path, at the cost of clients who want to buy one item out of the middle tier.

All-you-can-eat vs block hours vs break-fix

Three commercial postures. All-you-can-eat (unlimited remote support for a fixed fee) aligns the provider's incentive with stability. Block hours pre-purchase a bucket of time. Break-fix bills by the incident and pays the provider more when things break — the model managed services was invented to replace.

Monthly recurring revenue (MRR) and the valuation multiple

MRR is contracted revenue that recurs every month without a new sale — the core operating metric of the industry. It is also the basis on which practices are valued: buyers price an MSP as a multiple of adjusted EBITDA, and the multiple is driven by recurring-revenue share, contract quality and assignability, client concentration, growth, retention and owner-independence. A dollar of contracted recurring revenue is worth materially more than a dollar of project or hardware resale revenue.

Effective rate per endpoint

Total monthly contract revenue divided by the number of managed endpoints. Reveals what the provider is really charging once bundles, discounts and grandfathered agreements are stripped out, and makes wildly different pricing models comparable.

Gross margin per seat

Revenue per user minus the direct cost to serve that user — licensing, security stack, tooling and the labor consumed. The number that decides whether growth makes a provider stronger or just busier.

Service delivery cost as a percentage of revenue

All delivery labor and tooling divided by managed-services revenue. The standard efficiency benchmark for a support organization; drift upward almost always traces to unbilled scope, poor onboarding or unresolved root causes.

Technician utilization and billable ratio

The share of a technician's paid hours spent on client-facing work, and the share of that work that is chargeable. Low utilization is a scheduling and dispatch problem; high utilization with low margin is a pricing problem.

Tickets per endpoint per month

Support volume normalized by the size of the estate. The single best early-warning indicator of an unprofitable client — a rising rate means unresolved root causes, poor standardization or an environment that was never remediated after onboarding.

Mean time to resolution (MTTR)

Average elapsed time from ticket creation to verified fix. Should always be read alongside volume and priority mix, since closing easy tickets quickly can mask a queue of unresolved hard ones.

First-call resolution

Share of issues fixed on the first contact without escalation or a return visit. Drives client satisfaction more than raw speed and is the clearest measure of tier-one capability and documentation quality.

SLA response vs resolution targets

A response target promises how quickly a human engages; a resolution target promises when the issue is fixed. Most MSP agreements commit only to response, and buyers routinely misread that as a repair guarantee — the most common expectation gap in the industry.

Escalation tiers

The tier-one to tier-three structure that routes work by complexity, with defined criteria and time thresholds for handoff. Well-run tiers protect senior engineers' time; poorly run ones simply delay the right person seeing the ticket.

NOC and SOC

The network operations center watches infrastructure health — alerting, patching, backup verification and routine remediation — and is frequently outsourced to a wholesale NOC provider even by MSPs that market it as in-house. The security operations center is the 24/7 analyst function that triages detections, hunts threats and initiates containment; it is genuinely expensive to staff, which is why most small MSPs buy it as managed detection and response rather than build it. Buyers should ask which is actually staffed by the provider and which is a subcontract.

Help desk vs service desk

A help desk fixes incidents. A service desk owns the whole service relationship — incidents plus requests, changes, problems, assets and communication. The distinction signals process maturity, and clients feel it in how requests and changes are handled.

vCIO (virtual CIO)

A fractional executive relationship providing strategy, budgeting, roadmap, risk and vendor governance to a business too small for a full-time CIO. The role that separates a strategic partner from a support vendor, and the main defense against price-based displacement.

Technology business review (QBR)

The recurring — typically quarterly — meeting where the provider presents ticket trends, security posture, project status, lifecycle risk and next-period budget. The primary retention and upsell mechanism, and often the only time the client's owner sees value made visible.

Technology roadmap and budget planning

A multi-year plan for refresh cycles, license renewals, end-of-support deadlines, security investments and projects, expressed as a spending forecast an owner can approve. Converts reactive emergency spending into planned capital.

Onboarding, discovery assessment and offboarding

Onboarding is the structured intake at the start of an engagement — network and asset discovery, credential and license takeover, documentation build, risk findings and a first-90-days remediation plan; skipping or underpricing it is the most reliable way to lose money on an account for its entire life. Offboarding is the mirror image: returning documentation and credentials, transferring tenant and domain ownership, removing agents and management tooling, and a defined transition-assistance period. A provider's offboarding terms are a fair proxy for how it treats clients generally.

Client concentration risk

The share of revenue coming from the largest one or few clients. High concentration depresses valuation and gives a single account veto power over pricing, scope and staffing decisions.

Contract term, auto-renewal and right to audit

Initial term, renewal mechanics, notice period and price-escalation clauses decide whether a provider can absorb vendor cost increases and whether the revenue is transferable in a sale — longer contracted terms with clean assignment language are what MSP buyers actually pay for, while aggressive auto-renewal with short notice windows erodes client trust. A right-to-audit clause gives the client the ability to inspect the provider's controls, subcontractors and evidence; regulated clients and their auditors increasingly demand it, and providers usually satisfy it with a SOC 2 report instead.

Limitation of liability

The contractual cap on the provider's exposure, commonly tied to fees paid over a recent period. It creates the structural mismatch at the center of the industry: a modest monthly fee against a breach that can cost the client many multiples of the entire contract value.

Cyber insurance requirements flowing down

Carrier questionnaires now require MFA, EDR, tested and immutable backups, email filtering, privileged-access separation and training. The client must attest to these, so the MSP effectively inherits the underwriting checklist as a delivery requirement — and a misrepresented control can void a claim.

Incident response retainer

A pre-negotiated engagement with a specialist IR firm guaranteeing response time and rates before an incident. Cheaper and faster than negotiating during a live ransomware event, and increasingly expected by insurers and boards.

RMM (remote monitoring and management)

The agent-based platform that inventories, monitors, patches, scripts and remotely controls managed endpoints. The operational backbone of an MSP — and, because it holds privileged access to every client, its single largest security liability.

PSA (professional services automation)

The system of record for the practice: tickets, time entry, contracts, projects, procurement and invoicing. Where the business is actually managed; the quality of PSA data determines whether any of the delivery metrics can be trusted.

Endpoint detection and response (EDR)

Behavior-based endpoint security that records process activity, detects malicious patterns rather than known signatures, and supports isolation and rollback. Now a baseline requirement rather than an upsell, largely because insurers demand it.

Managed detection and response (MDR)

EDR plus a human analyst team doing 24/7 triage, investigation and response on the client's behalf. The dominant way small businesses obtain security operations, and the fastest-growing line on most MSP price lists.

SIEM (security information and event management)

Central collection and correlation of logs from endpoints, identity, network and cloud, with alerting and retention. Frequently required for compliance evidence; log volume and tuning effort are what make it costly to deliver.

MFA and conditional access

Requiring a second factor, and shaping access by user, device compliance, location and risk signal. The highest-leverage control available to a small business, and the one item every cyber-insurance questionnaire asks about first.

Privileged access management (PAM)

Controlling and recording administrative credentials — vaulting, just-in-time elevation, separate admin identities, removing standing local-admin rights. Critical for MSPs specifically, whose own technicians hold the keys to every client.

Patch cadence and vulnerability management

A defined schedule and testing ring for operating-system, third-party and firmware updates, paired with scanning and risk-based remediation. Measured by patch compliance percentage and time-to-patch on critical vulnerabilities.

3-2-1 backup rule and immutable backups

Three copies of data on two media types with one off-site — extended in the ransomware era with immutable or air-gapped copies that cannot be altered or deleted within a retention window, because modern attackers target the backups first.

RTO and RPO

Recovery time objective is how long the business can be down; recovery point objective is how much data it can afford to lose. Set with the client per system and per budget, then designed to — and, critically, tested against.

Disaster recovery testing

Scheduled restore verification, failover exercises and tabletop drills that prove recovery objectives are achievable. Untested backups are the most common finding in post-incident reviews and a standard audit exception.

Business continuity plan (BCP)

The wider plan for operating through disruption — alternate work locations, communication trees, manual workarounds, vendor contacts and decision authority. Broader than IT recovery and increasingly requested by clients' own customers and insurers.

Email security and DMARC/SPF/DKIM

Filtering plus the three DNS-based authentication records that let receivers verify a sender's domain. SPF authorizes sending hosts, DKIM signs messages, DMARC sets policy and reporting — now effectively mandatory for reliable bulk delivery and a common first deliverable in an onboarding remediation.

Phishing simulation and security awareness training

Recurring simulated phishing campaigns with targeted micro-training and reporting on click and report rates. Cheap, measurable, contractually useful for compliance evidence, and one of the few controls that produces a metric an owner immediately understands.

Zero trust and least privilege

Assume no implicit trust from network location; verify every request against identity, device posture and context, and grant each account only the access its role requires. In practice for an SMB this means conditional access, device compliance, admin-rights removal and segmentation — not a product purchase.

CIS Benchmark hardening

Applying the Center for Internet Security's consensus configuration baselines to Windows, macOS, Microsoft 365, browsers and network gear. Gives an MSP a defensible, citable standard for 'secure by default' instead of house opinion.

Asset inventory

A current, authoritative list of hardware, software, cloud services, identities and data locations. The first CIS Control for good reason — nothing else can be patched, secured, backed up or budgeted if it is not known to exist.

Shadow IT

Software, SaaS subscriptions and now AI tools adopted by staff outside IT's knowledge. Creates unmanaged data locations, orphaned accounts, duplicate spend and compliance exposure; discovery and a sanctioned-tool path work better than prohibition.

License true-up

Reconciling assigned licenses against actual headcount and entitlement at renewal. Recovers real money on both sides — unassigned seats after turnover, and under-licensing that surfaces as an audit liability.

Microsoft 365 tenant management

Day-to-day administration of the environment where most SMB work now happens: identity and groups, conditional access, Intune policy, sharing and retention governance, secure-score remediation, and third-party backup of the tenant's data.

CSP and distribution margin

Buying Microsoft and vendor subscriptions through the Cloud Solution Provider program or a distributor such as Pax8, then reselling with a margin and owning the billing relationship. A meaningful profit line, and the reason vendor price increases hit MSP margins directly.

Co-managed IT

A shared model where an internal IT person or team keeps ownership of some functions while the provider supplies tooling, after-hours coverage, security operations, project capacity and escalation depth. Sold as augmentation rather than replacement, which removes the internal team's incentive to block the deal.

What’s happening

• Private equity has become the dominant consolidator of the MSP market. Platforms such as Evergreen Services Group, New Charter Technologies, Integris, Thrive and Ntiva have acquired dozens of local providers, and Austin-founded CMIT Solutions itself became part of a larger franchise platform. For a small business this changes the local landscape quietly: the owner-operator it hired is acquired, the account manager changes, tooling and security stacks are standardized onto the platform's choices, and pricing moves toward the acquirer's model. The independent local shop is now a genuine differentiator rather than a default. 2026-08
• MSPs have become a preferred target for attackers precisely because they hold privileged access to many businesses at once. The 2021 Kaseya VSA supply-chain attack, in which the REvil group exploited the RMM platform to push ransomware downstream through MSPs to their clients, remains the defining case. The 2024 ConnectWise ScreenConnect authentication-bypass vulnerability (CVE-2024-1709) reinforced it. CISA and international partners have issued joint advisories specifically on MSP compromise, and privileged-access hygiene inside the MSP is now a due-diligence question buyers ask. 2026-08 source ↗
• Cyber insurance underwriting has effectively become a de facto security standard for small business. Carriers now require multi-factor authentication on email and remote access, endpoint detection and response, tested and immutable backups, and separated administrative accounts before they will bind or renew a policy. This has done more to move SMB security baselines than any regulation, and it has shifted the MSP conversation from 'do you want security' to 'here is what your carrier requires' — with the added risk that an inaccurate control attestation can jeopardize a claim. 2026-08
• The FTC's amended Safeguards Rule, effective June 9, 2023, extended formal information-security-program obligations well beyond banks to non-bank 'financial institutions' — auto dealers, mortgage brokers and lenders, tax preparers, collection agencies, payday lenders and finders. A further amendment effective May 13, 2024 added a notification requirement for certain security events. The rule names specific elements — a designated qualified individual, written risk assessment, access controls, encryption, MFA, monitoring, testing, training, vendor oversight and an incident response plan — which maps almost line for line onto a managed security offering, and it created a large new compliance-driven buying population among ordinary small businesses. 2026-08 source ↗
• CMMC has moved from proposal to program. The Department of Defense's 32 CFR Part 170 final rule establishing the Cybersecurity Maturity Model Certification program took effect December 16, 2024, with the companion acquisition rule phasing CMMC requirements into defense contracts. Level 1 relies on self-assessment, Level 2 generally requires third-party certification against the NIST SP 800-171 controls, and Level 3 adds government assessment. For MSPs this created a distinct, defensible niche serving defense suppliers — including manufacturers and engineering firms that had never previously bought a formal security program — and it also puts the MSP itself in scope when it handles controlled unclassified information. 2026-08 source ↗
• AI is changing help-desk economics from both ends. Assistants now draft ticket responses, summarize long threads, suggest resolutions from documentation, generate scripts and auto-triage intake, while client-facing chat deflects password resets and how-to questions before they become tickets. Because most MSP contracts are flat-fee per user, every deflected or shortened ticket falls straight to gross margin — which makes automation a margin strategy rather than a headcount strategy. The countervailing pressure is that AI raises the bar on what clients consider basic, and simultaneously creates new work: governing Copilot access, data residency and shadow AI use. 2026-08
• Co-managed IT has become one of the fastest-growing shapes of the engagement. Rather than replacing internal staff, providers supply tooling, 24/7 and holiday coverage, security operations, project capacity and specialist depth alongside an existing IT manager or small team. It removes the internal team's incentive to resist the deal, it fits mid-sized businesses that have outgrown one IT person but cannot staff a department, and it produces stickier relationships because the internal advocate stays in place. 2026-08
• Vendor price increases are compressing MSP margins from underneath. Microsoft's New Commerce Experience restructured Cloud Solution Provider terms and introduced a premium for month-to-month flexibility over annual commitment, and security and backup vendors have raised prices repeatedly as they add AI and managed-service components. Because most MSP contracts are flat monthly fees with annual escalators — if any — the cost increase lands immediately while the price increase lands at renewal, and providers who never built an escalation clause into their agreements absorb it entirely. 2026-08 source ↗
• Technician supply is the binding constraint on growth. Experienced service-desk and security engineers are scarce and mobile, wages have risen faster than most MSPs' contract escalators, and the roll-up buyers compete for the same people. The practical responses have been standardization to reduce the skill required per ticket, documentation and automation to make tier-one effective, offshore and near-shore NOC capacity, and apprenticeship pipelines built around CompTIA credentials. 2026-08 source ↗
• M&A pricing has professionalized. Buyers value MSPs on adjusted EBITDA with the multiple driven by recurring-revenue share, contract quality and assignability, client concentration, retention, growth and owner-independence — not on headline revenue. That has pushed sellers to clean up month-to-month handshake agreements, raise underpriced legacy clients, separate project revenue from recurring revenue, and remove the owner from delivery well before going to market. It has also made contract terms a strategic asset rather than paperwork. 2026-08
• The security frameworks MSPs sell against were both refreshed. NIST released Cybersecurity Framework 2.0 in February 2024, adding a sixth function, Govern, and explicitly broadening the framework's audience beyond critical infrastructure to organizations of all sizes — which makes it far easier to apply to a small business. The Center for Internet Security continues to maintain the CIS Critical Security Controls with Implementation Group 1 defined as essential cyber hygiene for small organizations with limited expertise, which is the most practical, citable starting baseline an MSP can hand a client. 2026-08 source ↗
• Consolidation is happening on the vendor side too, not just among providers. Kaseya's acquisition of Datto completed in 2022 brought RMM, PSA, backup and documentation under one roof, and similar consolidation across security and backup vendors has reduced the number of independent choices in the stack. MSPs have responded by weighing platform convenience and bundle pricing against concentration risk — a single vendor outage, breach or price change now propagates across the entire practice — and distribution marketplaces such as Pax8 have grown by making it easier to assemble and bill a multi-vendor stack. 2026-08 source ↗
• The channel's own information infrastructure is shifting. Channel Futures, long the home of the MSP 501 ranking and the industry's main trade publication, now publishes as Channel Dive, while CRN continues as the primary solution-provider news outlet and CompTIA remains the certification and workforce authority after separating its certification business under new ownership. Providers who used ranking-list placement as a marketing asset are re-evaluating which credentials and listings clients actually recognize. 2026-08 source ↗
• Austin is an unusually deep market for managed IT services and an unusually competitive one. The metro combines a high density of professional-services firms, medical and dental practices, engineering and construction companies, and venture-backed startups — exactly the twenty-to-two-hundred-seat businesses that buy managed services — with the Texas Department of Information Resources headquartered downtown running cooperative contracts that shape public-sector and higher-education IT purchasing statewide. CMIT Solutions, one of the largest managed-IT franchise networks in North America, is headquartered in Austin, and national roll-ups have been acquiring or opening Austin offices, so local independents increasingly compete against platform-backed firms in their own city. 2026-08 source ↗

Questions people ask

What is a managed service provider and what does one actually do?

describe it as taking contractual responsibility for endpoints, servers, network, identity, cloud tenants, backups and help desk for a recurring monthly fee -- and note that the category now blends into security, so most MSPs sell a security stack alongside support

What is the difference between break-fix and managed services?

break-fix bills hours after something fails, managed services bills a flat fee to keep it from failing -- explain that the incentives are opposite, which is the actual argument for the model

What is co-managed IT?

the provider supplies tooling, after-hours coverage, security operations and specialist depth alongside an existing internal IT person or team rather than replacing them -- explain that it removes the internal team's incentive to resist the deal

What is the difference between per-user and per-device pricing?

per-user covers a person on all their devices, per-device counts endpoints -- explain that per-user usually costs the client more when people carry two devices and less when they carry three, so the honest comparison is effective cost per user either way

What is RMM and what is PSA?

RMM is the remote monitoring and management agent on client machines; PSA is the provider's ticketing, contracts and billing system -- and note that RMM's privileged access is exactly why MSP platforms became an attacker target

What is the difference between EDR, MDR and antivirus?

antivirus matches known bad, EDR records endpoint behavior and enables response, MDR adds humans watching it around the clock -- the distinction that matters commercially is whether anyone is actually monitoring at 2am

What is a SOC and does a small business need one?

define a security operations centre as continuous monitoring and response capability, usually bought as a service at SMB scale -- whether they need it depends on their regulatory exposure and what their cyber insurer requires

What is the 3-2-1 backup rule and what are immutable backups?

three copies, two media, one off-site -- and immutability means the backup cannot be altered or deleted within a retention window, which is the specific control that defeats ransomware attacking the backups

What do RTO and RPO mean?

recovery time objective is how long you can be down, recovery point objective is how much data you can afford to lose -- explain that these are business decisions that then set the cost of the backup design, not the other way round

What is a vCIO and is it just an upsell?

describe the real function -- technology roadmap, budget planning and a structured business review -- and be honest that its value depends entirely on whether the provider brings decisions or a slide deck; ask to see a sample review

What is zero trust in plain terms?

stop trusting the network location and verify every request by identity, device health and context -- for a small business it means MFA everywhere, conditional access and least privilege, not a product purchase

What is CMMC and does it apply to my company?

explain the program established by the Department of Defense rule effective December 2024, and the levels -- self-assessment at Level 1, generally third-party certification at Level 2 against NIST SP 800-171 -- and say the required level comes from the contract clauses, not a general rule

What is the FTC Safeguards Rule and does it apply to a non-bank business?

explain that the amended rule extended information-security-program obligations to non-bank 'financial institutions' including auto dealers, mortgage brokers, tax preparers and collection agencies -- whether a specific business is covered is a definitional question worth checking with counsel

What is DMARC and why does my email keep going to spam?

explain SPF, DKIM and DMARC as the authentication chain that proves you sent the mail, and that misconfiguration is a common cause of deliverability problems -- but spam placement has other causes, so diagnose before asserting

How much should managed IT cost per user per month?

pricing depends on the stack included, the environment's condition, compliance requirements and coverage hours -- explain what drives the number and what should be in scope, and say a real figure requires an assessment; do not publish a per-seat price

Should I choose per-user or per-device pricing?

give the method: count actual devices per person and compare the two structures at their real ratio, then check what happens as headcount changes -- the right structure follows from their device density, not a rule

Watch

Run a managed it services company?

Get your free website score and the exact list of what to fix — no charge, no pitch. Claim your listing or ask for the full report.