Recently we ended our business relationship with a Managed Service Provider (MSP) that we had used for eight years. I’m hoping my experience (and lessons learned) will benefit you by making sure you don’t fall into the same trap that my predecessor did.
Three months ago I took over the IT Director position for a small company. I am essentially a one-man IT shop with the MSP providing the day-to-day activities. The person who held my posisition was the IT Director, but in title only as he was more involved in the day-to-day operations of the business.
After reviewing past invoices, tickets, etc… it was clear that the MSP had taken advantage of my predecessor who didn’t have a technical background.
I saw things like 5.5 hours billable time to upgrade two aging PC’s to IE7, $35 for a 7′ CAT5 patch cable, recommendations for upgrades and other services that weren’t necessary – but done with the OK of my predecessor because he was told they were necessary. Seeing how they were a reseller for Brand-X widgets, a large number of these widgets were installed throughout the facility even though there was little justification for doing so – other than the strong recommendation of the MSP.
In short, they found a cash cow in my predecessor. For what was paid out to the MSP last year, we could have had two full-time employees under the previous director.
The only agreement between us and the MSP was a pricing agreement for their services, so long as a minimum amount of time was invoiced by the MSP each month. When I came on board, the MSP had full control of the network – the domain administrator password, all of the firewalls, anti-virus consoles, etc… etc… No contract. No service level agreement. In other words, the MSP had us by the balls. As they managed our firewalls, I found numerous security issues (I found nearly 60 open TCP ports – most of which were RDP ports to just about every PC in the company so folks can work from home), amongst other things. Overall, network security was weak.
Shortly after my arrival I cut back on the MSP’s billable hours significantly since they were doing mostly preventative service work that could have been easily automated using any number of tools out there. I also changed all the passwords and gave them accounts specific to their duties.
Of course they weren’t too happy about this as they saw their revenue from us cut by about 80%.
Some additional research of our MSP found that the previous 3 tax filing years they couldn’t pay their taxes in time and had state tax warrants filed against them (red flag: cash flow problems). A friend of a friend was their office manager and provided some insight into their financial problems.
They hire people as “3rd level engineers” with 1-2 years experience, pay them $25-30k a year, expect them to bill a minimum of 30 hours a week (red flag: pressure to bill).
One of the things they sell is regular preventative services. The problem with that is that they use a checklist they say is “proprietary and confidential”. So in other words – I don’t really know what I’m paying for and don’t know what their tech is doing with my network.
They want me to put the trust of my network, servers and data into the hands of an inexperience, underpaid person who’s under pressure to bill me for more hours – and they won’t tell me what this person does all day long in my facility because it’s “proprietary”.
They promised us discounts for anything we bought through them – they couldn’t come close to vendors I’ve used elsewhere for purchasing. Plus any purchase from them over $1,000 requires 50% down (red flag: little working capital).
Deciding it’s time to sever the relationship with this company was a no-brainer… and in fact they decided to take the pre-emptive strike and do it with only 8 days notice (instead of the customary 30) because the company’s owner knew I was onto him.
The biggest lesson learned here is to have a contract or service level agreement. The SLA isn’t just enough – it has to be YOUR SLA, not theirs. It’s your network, your data. You control it – not the MSP. Because we didn’t have a contract or SLA with this company, we were completely at their whim. When I tried to address this with the company’s owner – his response was we could get the lawyers involved and double my hourly billing rate.
Another lesson learned is to interview the prospective tech who will be working on your account as though he was your employee. Again it comes down to knowing what it is you are paying for. Don’t simply accept whoever it is that walks in your door wearing the MSP’s polo shirt. Is this person actually experienced? Do they hold relevant certifications?
Is the MSP accredited or a member of the Better Business Bureau or some other recognized body that holds its members accountable?
Have you looked at the numbers and made a determination if hiring an employee is more cost effective? Their hourly rate was nearly 4 times that of a full-time employee’s wage. In other words, they came in for 8 hours a week (minimum), in addition to billing for various projects and support needs. Previous management could have hired a full-time person for the same amount of money.
There are advantages to using a MSP. Primarily they handle your IT for you – this is most beneficial for small companies who can’t justify a full-time IT person. You have access to a broader skill set and specialists with more narrowly defined expertise.
But proceed with caution – anyone with a website and some IT experience can hire a few people, get a d/b/a at the County Clerk’s office and form a company that you will put your full faith and trust into. Hiring a bad MSP can be worse than hiring a bad employee.