Quick Summary
If your IT provider keeps the lights on but never has a planning conversation with you, you are paying for maintenance and getting no direction. This article covers 5 warning signs that your MSP is holding your business back: reactive-only support, no forward planning, opaque billing, slow response times, and no proactive security. It includes a comparison of reactive and proactive MSPs, a red flag checklist for evaluating your current provider, and a step-by-step guide to switching providers without disruption.
Table of Contents
- Sign 1: Your MSP Only Reacts and Never Plans
- Sign 2: Nobody Is Talking to You About What Comes Next
- Sign 3: Your Bills Are Unpredictable and Full of Surprises
- Sign 4: Response Times Are Slow and Escalation Is Unclear
- Sign 5: Your Security Is a Checkbox Exercise, Not a Strategy
- Reactive MSP vs Proactive MSP: The Comparison
- Red Flag Checklist: Evaluate Your Current IT Provider
- How to Switch MSPs Without Disrupting Your Business
- Questions to Ask Before Hiring a New MSP
- Frequently Asked Questions
Sign 1: Your MSP Only Reacts and Never Plans
You know the pattern. Something breaks. You call the helpdesk. A ticket is created. Someone looks at it eventually. It gets fixed. You pay for the time. Repeat.
This is the break-fix mentality. Providers who work this way can be good at keeping existing systems running, but they never step back to ask: "Why did this break? Could we have prevented it? Is there a better way to do this entirely?"
What Good Looks Like
| Reactive MSP (Red Flag) | Proactive MSP (Green Flag) |
|---|---|
| Waits for you to report problems | Monitors your systems 24/7 and alerts you before issues affect users |
| Fixes the same problem multiple times | Identifies root causes and implements permanent solutions |
| No quarterly business reviews | Quarterly reviews covering performance, upcoming projects, and recommendations |
| Treats each ticket as isolated | Tracks patterns across tickets to identify systemic issues |
| "If it ain't broke, don't fix it" | "Let us make sure it never breaks" |
The Cost of Reactive IT
| Metric | Reactive MSP | Proactive MSP |
|---|---|---|
| Downtime per incident | Longer: problems are found when users report them | Shorter: many issues are prevented or caught early |
| Downtime cost per hour | Set by your revenue and wage costs | The same per hour, but with fewer and shorter incidents |
| Annual downtime cost | Higher | Lower |
| Staff productivity lost | High: constant fire-fighting | Low: systems work reliably |
| IT team morale | Low: always stressed | High: focused on improvement, not crisis |
The Bottom Line
If your MSP has never brought you a quarterly report showing trends, improvements, and recommendations, they are running your IT as a helpdesk, not a business function. You deserve a partner, not a repair service.
Sign 2: Nobody Is Talking to You About What Comes Next
Your provider keeps today's systems running, but has never raised what is coming: hardware reaching end of life, software going out of support, licence changes, a business system you have outgrown, or staff quietly pasting company data into free online tools.
A good managed IT provider keeps a forward view of your environment and tells you about it before it becomes urgent.
What Is Really Going On
| What Your MSP Says | What It May Actually Mean |
|---|---|
| "Everything is fine" | Nobody has reviewed your environment against what is coming |
| "We will look into it" (and never follow up) | Nobody owns your IT roadmap |
| "That is not our area" (about accounting, ERP or line-of-business systems) | They support the devices but not how the business runs on them |
| "Keep using it until it breaks" | No lifecycle planning, so replacement will be rushed and expensive |
| "Staff can use whatever tools they like" | No policy on data handling, privacy, or acceptable use of new tools, including AI |
What a Forward-Looking Provider Covers
| Area | Reactive Provider | Forward-Looking Provider |
|---|---|---|
| Hardware lifecycle | Replaces devices when they fail | Tracks age and warranty, and budgets replacements a year ahead |
| Operating systems and software | Discovers end of support when something stops working | Flags end-of-support dates early (Windows 10 support ended in October 2025) and plans upgrades |
| Licences | Renews whatever was there last year | Reviews licence counts and tiers against actual use |
| Business systems | "Not our area" | Understands how your accounting, ERP and line-of-business systems depend on IT, and coordinates with those vendors |
| New tools | Ignores them, or lets staff sign up freely | Sets a sensible usage policy, controls data access, and checks licensing and privacy implications |
The Cost of Standing Still
| Scenario | Impact |
|---|---|
| Unsupported operating systems still in use | Security gaps that no patch will fix, plus a rushed replacement project |
| Ageing hardware failing without warning | Downtime and unplanned capital spend |
| The business outgrows its accounting or ERP system | Manual workarounds, spreadsheets, and double handling across teams |
| Staff using unapproved tools with company data | Privacy and confidentiality risk you cannot see |
Bottom Line: If your IT provider has not given you a written view of what needs to change in the next 12 to 24 months, nobody is planning your IT. You do not need hype about new technology. You need a provider who tells you what is ageing, what is at risk, and what it will cost to fix.
Sign 3: Your Bills Are Unpredictable and Full of Surprises
You signed up for managed IT services to get predictable, budgetable IT costs. Instead, your monthly invoice looks like a mystery box:
- Base managed service fee: $X
- After-hours callout: $Y (you did not authorise)
- Project work: $Z (scope was unclear)
- Software licences: $A (price went up, nobody told you)
- Travel charges: $B (for a remote fix)
- "Additional services": $C (no detail provided)
This is not managed IT. This is a billing maze.
Transparent Billing vs Opaque Billing
| Billing Practice | Opaque MSP (Red Flag) | Transparent MSP (Green Flag) |
|---|---|---|
| Monthly invoice | One line item: "Managed IT Services: $8,500" or a maze of unexplained charges | Detailed breakdown by category: monitoring, helpdesk, projects, licences, with usage metrics |
| Price changes | You discover them when the invoice arrives | You are notified 30 days in advance with a clear explanation |
| Out-of-scope work | Billed at hourly rates you did not agree to | Scoped and quoted before work begins, with change-order process |
| Software licences | Marked up without disclosure | Pass-through pricing or disclosed markup percentage |
| After-hours charges | Applied without prior notification | Pre-agreed rates with notification when after-hours work is required |
The Hidden Cost Model
Some MSPs make their margin on unpredictability. Here is how it works:
| Tactic | How It Works | Cost to You |
|---|---|---|
| Scope creep billing | "That is not included in your managed service agreement" | Unbudgeted charges every quarter |
| After-hours premiums | Urgent work billed at premium hourly rates | A large bill for each incident |
| Travel charges | On-site visits billed with travel time | Charges for issues that could have been resolved remotely |
| Software markups | Licences resold above list price without disclosure | A hidden monthly cost on every licence |
| Project padding | Estimates inflated to create margin buffer | Paying more than the work actually cost |
What You Should Expect
| Billing Element | What You Should See |
|---|---|
| Fixed monthly fee | Predictable base cost for defined services |
| Usage metrics | Number of tickets resolved, uptime percentage, patch deployment rate |
| Quarterly cost review | Discussion of whether your plan still matches your needs |
| No surprise charges | All additional work scoped and approved before billing |
| Annual cost trend | Costs should decrease or stay flat as your systems stabilise |
Bottom Line: Managed IT should make your budget predictable, not more chaotic. If you cannot predict next month's IT cost within 5 per cent, your MSP is not managing your IT. They are managing your uncertainty.
Sign 4: Response Times Are Slow and Escalation Is Unclear
When something breaks at 9 AM on a Monday, how long before someone is looking at it? When the server goes down at 3 PM on a Friday, who do you call? When the CEO cannot access email before a board meeting, what happens?
If you do not have clear answers to these questions, your MSP has a response time problem.
Response Time Expectations
| Severity Level | What It Means | Expected Response | What You Probably Get |
|---|---|---|---|
| Critical (P1) | System down, business stopped, revenue impact | 15-30 minutes | 1-4 hours (if you are lucky) |
| High (P2) | Major feature broken, work-around exists | 1-2 hours | 4-8 hours |
| Medium (P3) | Minor issue, affects small number of users | 4-8 hours | 1-3 business days |
| Low (P4) | Cosmetic issue, feature request | 1-2 business days | 1-2 weeks (or never) |
The Escalation Gap
Many MSPs have an escalation policy on paper that looks like this:
- Level 1 helpdesk attempts resolution
- If unresolved after 2 hours, escalate to Level 2 engineer
- If unresolved after 4 hours, escalate to Level 3 / senior engineer
- If unresolved after 8 hours, escalate to practice lead / CTO
The problem? Nobody follows it. Tickets sit in Level 1 queues for days. Level 2 engineers are too busy on other clients. Level 3 is only available for "real emergencies." And the CTO does not even know the escalation policy exists.
What Good Looks Like
| Response Metric | Struggling MSP | Well-Run MSP |
|---|---|---|
| Average first response (P1) | 2-4 hours | 15-30 minutes |
| Average resolution time (P1) | 8-24 hours | 2-4 hours |
| Escalation clarity | "We will escalate if needed" | Documented escalation matrix with named contacts and SLAs |
| After-hours coverage | "Call the emergency number" (which may go to voicemail) | 24/7 monitoring with an on-call engineer roster |
| Proactive alerting | None: waits for you to report | Automated monitoring alerts the team before you notice |
The Real Cost of Slow Response
| Scenario | Downtime | Revenue Impact | Reputational Impact |
|---|---|---|---|
| Email server down for 4 hours | 100 staff unable to communicate | Lost productivity for every affected staff member | Clients think you are unresponsive |
| ERP system down for 8 hours | Orders cannot be processed | Delayed revenue and overtime to catch up | Customers switch to competitors |
| Website down for 2 hours | Online orders blocked | Lost sales | Google ranking drops |
| Ransomware detected, response delayed 24 hours | Data encrypted, systems locked | Recovery, downtime and possibly legal and notification costs | Headlines, customer loss, regulatory notification |
Bottom Line: Response time is not just a technical metric, it is a revenue metric. Every hour of delayed response is an hour of lost productivity, lost sales, and lost customer confidence. If your MSP will not commit to response times in writing, they are not accountable for your uptime.
Sign 5: Your Security Is a Checkbox Exercise, Not a Strategy
Your MSP says they "handle cybersecurity." But what does that actually mean?
- They install antivirus software and assume it is working.
- They run a vulnerability scan once a year (if you are lucky).
- They tell you "you are compliant" without showing you evidence.
- They have never discussed the Essential Eight framework with you.
- They cannot tell you what maturity level you are at.
- They have never tested your incident response plan.
This is checkbox security: doing the minimum visible activity to claim you "have security" while leaving real vulnerabilities exposed.
Checkbox Security vs Real Security
| Security Activity | Checkbox MSP (Red Flag) | Security-First MSP (Green Flag) |
|---|---|---|
| Antivirus | "Installed on all devices", never checks if it is detecting anything | Monitors detection rates, updates signatures, tests with simulated threats |
| Patching | "We patch monthly", no measurement of patching speed or coverage | Patches extreme-risk vulnerabilities within 48 hours, reports on patching metrics |
| MFA | "Enabled on email", not tested on other systems | MFA on all systems, with phishing-resistant authentication for admin accounts |
| Backups | "Running daily", never tested restore | Quarterly restore tests with documented results, immutable backup storage |
| Vulnerability scanning | Annual scan, report filed and forgotten | Monthly automated scans with remediation tracking and trend analysis |
| Essential Eight | "We are compliant", no maturity assessment conducted | Formal maturity assessment with evidence pack, uplift roadmap, and quarterly monitoring |
| Incident response | "We have a plan", never tested | Tested runbook with tabletop exercises, documented lessons learned, and continuous improvement |
The Essential Eight Gap
Here is the uncomfortable truth: the ACSC Essential Eight is Australia's baseline cybersecurity framework, and many MSPs cannot tell you where you stand against it.
| Essential Eight Strategy | What Checkbox MSPs Do | What Security-First MSPs Do |
|---|---|---|
| Application Control | No application whitelisting deployed | Assess, plan, and deploy application control with Maturity Level 2+ target |
| Patch Applications | Monthly patch cycle | Automated patching with 48-hour turnaround for extreme-risk vulnerabilities |
| Macro Settings | Default Office settings | Block internet macros, allow only digitally signed macros in trusted locations |
| User Application Hardening | Basic browser security | Advanced web content filtering with URL categorisation and threat intelligence |
| Restrict Admin Privileges | Shared admin accounts | Dedicated admin accounts with PAWs and session monitoring |
| Patch Operating Systems | Monthly Windows Update | Automated OS patching with vulnerability scanning verification |
| Multi-Factor Authentication | MFA on email only | Phishing-resistant MFA on all systems, hardware tokens for admin |
| Regular Backups | Daily backups to local drive | Geographically separate, immutable backups with quarterly restore testing |
The Ransomware Reality
| Fact | What It Means for You |
|---|---|
| Ransomware remains one of the most damaging threats to Australian businesses, according to the ACSC | If you think it will not happen to you, you are exactly the kind of target attackers look for |
| Businesses without verified backups are far more likely to pay a ransom | A tested restore is the difference between recovering and negotiating |
| The ransom is only part of the cost | Recovery, downtime, notification, and reputational damage often cost more |
| ASD received over 84,700 cybercrime reports in 2024-25, about one every six minutes, and the average self-reported cost per report was $56,600 for a small business (ASD Annual Cyber Threat Report 2024-25) | Your exposure is real whether or not your security has changed |
Bottom Line: If your MSP cannot show you your Essential Eight maturity level, your last vulnerability scan results, your last backup restore test, and your incident response runbook, they are not managing your cybersecurity. They are managing your confidence. And confidence does not stop ransomware.
Reactive MSP vs Proactive MSP: The Comparison
If any of the 5 signs above resonate with you, it helps to see what a different approach looks like.
| Aspect | Reactive MSP | Proactive MSP |
|---|---|---|
| Support model | Waits for tickets | Monitoring catches issues before they affect users |
| Planning | No roadmap | 12 to 24 month view of hardware, software, licences, and risks |
| Billing | Opaque, surprise charges common | Fixed monthly fee with a detailed breakdown and usage metrics |
| Response times | Vague, no written targets | Written response targets by severity, with named escalation contacts |
| Security posture | Checkbox: antivirus and patches | Essential Eight maturity tracking, tested backups, incident response testing |
| Engagement | Annual contract renewal | Quarterly business reviews with recommendations and cost review |
| Reporting | Monthly uptime percentage | Uptime, security status, ticket trends, and cost trends |
| Onboarding | Unclear, discovery drags on | Documented onboarding with an environment assessment |
| Contract | Long lock-in, difficult exit | Clear term, documented exit and handover process |
| Cost trajectory | Rises with every incident | Stable or falling as systems stabilise |
Red Flag Checklist: Evaluate Your Current IT Provider
Score your current MSP against these 16 red flags. Each "yes" is a concern.
Reactive vs Proactive
- Does your MSP wait for you to report problems instead of detecting them first?
- Has your MSP never conducted a quarterly business review with recommendations?
- Do the same problems keep happening without permanent fixes?
Forward Planning
- Has your MSP never given you a 12 to 24 month view of hardware, software, and licence changes?
- Did end-of-support dates (such as Windows 10) catch you by surprise?
- Does your MSP have no view on how staff use new online tools with company data?
Billing Transparency
- Are you unable to predict next month's IT cost within 5 per cent?
- Have you been charged for work you did not authorise or were not informed about?
- Does your MSP resell software licences without disclosing their markup?
Response and Escalation
- Has a critical issue taken more than 2 hours to get a first response?
- Are you unsure who to call and what happens at each escalation level?
- Does your MSP lack a documented SLA with committed response times?
Security Posture
- Is your MSP unable to tell you your Essential Eight maturity level right now?
- Has your MSP never conducted a vulnerability scan, or cannot show you the last results?
- Has your MSP never tested your backup restore capability?
- Has your MSP never discussed your incident response plan with you?
Scoring Your Assessment
| Score | What It Means | Recommended Action |
|---|---|---|
| 0-3 red flags | Your MSP is performing well | Continue the engagement and review it annually |
| 4-7 red flags | Significant concerns | Request a formal performance review with your MSP, set improvement targets |
| 8-12 red flags | Your MSP is holding you back | Begin evaluating alternative providers while maintaining current engagement |
| 13-16 red flags | Urgent change needed | Engage a new MSP and plan a structured transition |
How to Switch MSPs Without Disrupting Your Business
If you have decided your current MSP is not meeting your needs, here is how to make the change without risking downtime or data loss.
Step 1: Document Your Current Environment (Week 1)
Before you notify your current MSP, gather:
- Inventory of all systems, applications, and licences they manage
- Current service agreement and SLA terms
- Outstanding tickets and unresolved issues
- Access credentials and administrative accounts they control
- Data backup locations and restore procedures
Step 2: Engage Your New MSP (Weeks 1-2)
- Conduct a scoping call to communicate your environment size, pain points, and expectations
- Agree on onboarding timeline, responsibilities, and success criteria
- Establish the transition plan with your new MSP's input
Step 3: Notify Your Current MSP (Week 2)
- Review your contract for notice period requirements (typically 30-90 days)
- Provide written notice per the contract terms
- Request cooperation during the transition period
Step 4: Execute the Transition (Weeks 3-6)
| Transition Activity | Responsible Party | Timeline |
|---|---|---|
| Knowledge transfer from old MSP | Old MSP (per contract) | Weeks 3-4 |
| Access handover and credential rotation | New MSP | Week 4 |
| System documentation review and validation | New MSP | Week 4-5 |
| Monitoring and alerting setup | New MSP | Week 5 |
| Backup verification and restore test | New MSP | Week 5 |
| Helpdesk transition and user communication | New MSP | Week 5-6 |
| Final service review and sign-off | Both MSPs + you | Week 6 |
Step 5: Stabilise and Optimise (Weeks 7-12)
- Your new MSP runs your environment under the new agreement
- An environment assessment identifies risks and optimisation opportunities
- Quick fixes are prioritised and scheduled
- The first quarterly business review sets the direction for the next 12 months
Common Transition Risks and How to Avoid Them
| Risk | Impact | Mitigation |
|---|---|---|
| Old MSP is uncooperative during transition | Knowledge gaps, missing documentation | New MSP conducts independent assessment; do not rely solely on old MSP's handover |
| Credentials not properly rotated | Security risk if old MSP retains access | Rotate all passwords, API keys, and administrative credentials immediately upon handover |
| Monitoring gap during transition | Blind spot where neither MSP is monitoring | New MSP sets up monitoring before old MSP hands over |
| User confusion about new helpdesk process | Frustration, lost productivity | Communicate new support procedures, contacts, and SLAs to all staff before go-live |
| Licence and contract gaps | Service disruption if licences lapse | Audit all software licences and service contracts during transition planning |
Questions to Ask Before Hiring a New MSP
Do not repeat the same mistake. Ask these questions before you sign:
Planning Questions
- "What risks and quick wins would you expect to find in our environment in the first month?"
- "How do you conduct quarterly business reviews? Can you show me a sample report?"
- "How do you plan hardware, software, and licence changes over the next 12 to 24 months?"
Security Questions
- "Can you assess our Essential Eight maturity level within the first month?"
- "What is your incident response process? Can I see your runbook?"
- "How often do you test backup restores? What was the result of the last test?"
Billing Questions
- "What is included in the fixed monthly fee? What would be charged extra?"
- "How do you handle price changes? How much notice do you give?"
- "Do you resell software licences? What is your markup?"
Response Questions
- "What are your committed response times for each severity level?"
- "What happens if you miss an SLA?"
- "Who do I call at 3 AM on a Sunday? What is the escalation path?"
Contract Questions
- "What is the minimum contract term? Can I go month-to-month after onboarding?"
- "What is the offboarding process if I decide to leave?"
- "Do you own the documentation and configurations you create, or do I?"
Bottom Line: The right MSP will welcome these questions, answer them clearly, and back up their answers with evidence and documentation. The wrong MSP will give you vague answers, avoid specifics, or push back on the questions themselves. That pushback is your answer.
Frequently Asked Questions
How do I know if it is time to change MSPs?
If you scored 8 or more red flags on the checklist above, it is time to start evaluating alternatives. In particular, if your MSP has never given you a forward plan, cannot tell you your Essential Eight maturity level, and sends unpredictable bills, they are not delivering the value you need.
Will switching MSPs cause downtime?
A well-managed transition should cause no downtime. The key is overlap: your new MSP should be monitoring and managing your environment before your old MSP hands over. A typical transition takes 4-6 weeks with proper planning and cooperation from both parties.
Can I keep some services with my old MSP and move others?
Technically yes, but it is not recommended. Splitting services between two MSPs creates accountability gaps. When something breaks, each provider can blame the other. It is cleaner and more effective to have a single accountable partner.
How much notice do I need to give my current MSP?
Most MSP contracts require 30-90 days written notice. Check your service agreement for the specific notice period and any early termination fees. If you are near a contract renewal date, you may be able to transition without penalty.
What should I expect during the first 90 days with a new MSP?
In the first 30 days, expect environment assessment, monitoring setup, and a security baseline. Days 30-60 should bring quick fixes and cost optimisation recommendations. Days 60-90 should deliver your first quarterly business review with an IT roadmap. If none of this happens, your new MSP may be the same as the old one.
Is a proactive MSP more expensive than a break-fix provider?
The monthly fee is usually higher than paying for break-fix work as it happens. Over a year, though, the total is often similar or lower, and far more predictable, because monitoring, patching, and preventive work reduce emergency callouts, downtime, and after-hours charges.
Ready to Evaluate Your IT Provider?
If several of these signs sound familiar, start with the checklist above and put the questions to your current provider. If you want to compare their answers against another option, see our managed IT services or get in touch.