Minority Owned BusinessWomen Owned
Blue Tree Technology®

Tough questions about MSPs (skeptical)

If Nothing Ever Breaks, What Are We Paying Our MSP For?

Next review due:

It's a fair question. A good managed IT provider is paid mostly to prevent problems and keep the business ready for the ones that still happen: patching, monitoring, backups that are checked, security alerts that someone reviews, and accounts that are added and removed correctly. When that work is done well, it tends to look like nothing is happening. But "quiet" isn't proof on its own. You should be able to see evidence that the routine work happened, and if your provider can't show you any, your question is justified.

Published · Blue Tree Technology®

Why good IT support can look like doing nothing

Most of a managed service agreement covers work your team never sees. Updates get installed outside business hours. Endpoint protection blocks or isolates something before anyone notices. A backup job fails one night, gets fixed and runs again. A departing employee's access is removed the day they leave. None of that becomes a ticket from your staff, so a ticket count can make it look like nothing was done.

People in the industry joke about this: when everything breaks, clients ask why they pay for IT, and when nothing breaks, they ask the same thing. The joke is popular because it's true. Ticket volume is a poor way to measure prevention.

Quiet is not the same as proven

A quiet month can also mean nobody is watching. Monitoring alerts can pile up unread, backups can fail without anyone knowing, and a device can drop off the management tools and stop getting patches. From the outside, a provider doing careful work and a provider doing very little can look the same until something goes wrong.

So the useful question isn't "Did anything break?" It's "What evidence shows the agreed work was done?"

What evidence to ask for

You don't need a technical background to ask for these:

  • Patch status: which devices are current, which aren't, and why.
  • Backup results and restore tests: not just "backups succeeded," but when someone last restored a real file or system to prove it works.
  • Security alert handling: what was flagged, who reviewed it and what was done.
  • Device and account inventory: whether it matches the people and computers you actually have, including former employees.
  • Open risks: what's still not done and what it would take to fix.
  • Project and recommendation history: what was recommended, approved, deferred or declined.

What you get with Blue Tree Technology®. Every client has a dedicated account manager who meets with you often. Those meetings aren't only about tickets. They're about how your business is growing and how we can deepen our partnership with you. Behind the scenes, we monitor your systems quietly for security issues, so most of what we do never turns into a call or an email to you. If you want to see that work, ask your account manager. We're glad to walk you through it.

How to read a report without being an IT expert

Look for exceptions, not just green checkmarks. A report where everything is always perfect deserves the same healthy skepticism as one that never arrives. Ask your provider to walk you through one item from start to finish, such as a security alert or a failed backup: when it happened, who noticed and how it was resolved. That one walkthrough will tell you more than a dashboard.

Also compare the report with the agreement. If the agreement says backups are tested, ask for the most recent test. If it says alerts are monitored, ask what happens after hours. Our article on 24/7 monitoring versus 24/7 response explains why those aren't the same thing.

When the question means it's time for a change

Sometimes the question points to a real problem: reports that never come, answers that stay vague, or recommendations that are repeated every quarter and never acted on. In that case, look at when it's time to replace your IT provider and how to switch without losing control of your accounts.

Other times, the work is being done and the reporting just needs to be clearer. That's worth asking for directly before deciding anything.

FAQ

Should we ask for a credit if nothing broke?

A managed agreement usually prices ongoing prevention and availability, not individual repairs. Look at what the agreement says was supposed to happen, then ask for evidence that it did. If it didn't happen, that's a conversation worth having.

How often should we see a report?

Often enough to make decisions. Many firms review a summary every month and have a fuller conversation every quarter. The right rhythm depends on your size and risk.

Isn't a low ticket count a good sign?

It can be, especially if it went down after onboarding. Pair it with evidence of patching, backups and alert handling before you assume all is well.

Still have a question?

Ask Little Sprout, the assistant on our website, for general information. To talk through what proof of work you should expect for your business, schedule a free 15-minute discovery call.

Back to the Knowledge Hub

More in this topic

Discuss your business technology needs

Review your priorities with Blue Tree Technology®.

Schedule a discovery call