Most businesses only find out their MSP is underperforming when something goes wrong. A ransomware incident. A system outage that takes three days to resolve. A renewal that comes in thirty percent higher than expected with no explanation. By that point, the damage is already done.
The problem is that MSP underperformance rarely looks dramatic from the outside. Your systems are mostly working. The helpdesk is responding. Invoices are being paid. But underneath that surface-level normality, the governance, the accountability and the strategic value that a good MSP relationship should provide are quietly absent.
Here are five signs that your MSP is underperforming – and why they are so easy to miss.
1. You receive reports, but they don’t tell you anything useful
Most MSPs produce monthly reports. Ticket volumes, resolution times, uptime percentages. The numbers look reasonable and the traffic lights are mostly green.
But ask yourself: does that report tell your leadership team anything they could act on? Does it identify your three most significant IT risks? Does it say whether your backup and recovery position has been tested? Does it flag any supplier or licensing changes that affect your commercial exposure?
If the answer is no, if the report exists to demonstrate activity rather than to inform decisions, that is a governance failure. A well-run MSP relationship produces reporting that a non-technical board member can read and respond to. If yours does not, you are flying blind on IT risk.
2. Your MSP sets the agenda for renewal conversations
Renewal time is when the power dynamic in an MSP relationship becomes most visible. If your MSP leads the renewal conversation, presents the pricing, explains what has changed and why, and you largely accept it with minor negotiation, you are not managing the relationship, you are being managed by it.
A well-governed MSP relationship means you know, before renewal begins, what the contract covers, what it does not cover, what your actual usage has been, and what the market rate for comparable services looks like. You go into the conversation with your own position, not theirs.
Most SMEs do not have this. They accept the renewal because they do not have the internal expertise to challenge it, and because switching feels like too much disruption. That is an expensive position to be in, year after year.
3. Security is treated as a product, not a posture
If your MSP’s response to questions about cyber security is to sell you something, an EDR tool, a security awareness platform, an additional monitoring tier, that is not the same as managing your security posture.
Good MSP security management means understanding your actual risk profile, advising on proportionate controls, and being honest when something is outside their capability or remit. It means telling you when Cyber Essentials is the right starting point rather than overselling an enterprise solution to a business of your size. It means having an honest conversation about what your backup and recovery position actually looks like in practice, not just on paper.
Security as a product means the solution precedes the problem. Security as a posture means the controls match the risk. Most SMEs are sold the former and told it is the latter.
4. Incidents are resolved but never reviewed
Every IT incident, a phishing attempt that reached a mailbox, a system failure, an access control problem, contains information. It tells you something about your controls, your processes or your supplier’s capability.
A well-run MSP relationship treats incidents as data. There is a post-incident review, however brief. The root cause is identified. Any process or control change is documented and implemented. You, as the client, are told what happened and what has changed.
In an underperforming relationship, incidents are closed when the immediate problem is fixed. The ticket is resolved. The outage is over. The phishing email has been deleted. But no one asks why it happened, whether it will happen again, or what it reveals about the broader security position.
If your MSP closes tickets but does not close the loop, you are accumulating risk with every incident that goes unreviewed.
5. You do not know what you are paying for
This is the most common sign, and the hardest one for business leaders to admit. You receive an invoice each month. You pay it. You could not, without going back through the contract and the correspondence, tell someone exactly what is included, what is charged additionally, and what is genuinely outside scope.
This is not unusual, and it is not necessarily your fault. MSP contracts are often complex, and the scope of what is and is not included shifts over time as your business changes, as technologies are added, and as verbal agreements accumulate. But it creates a position where you cannot assess value, cannot benchmark cost, and cannot have an informed conversation about whether the relationship is working.
A good MSP makes the scope visible. A good client governance process requires them to.
What to do about it
If two or more of these signs are familiar, it does not necessarily mean you need to change MSP. It means you need better oversight of the relationship you already have.
The right starting point is an independent review: someone who is not your MSP, does not have a commercial relationship with any supplier, and can look at the contract, the reporting, the security posture and the renewal history with fresh eyes and tell you honestly where you stand.
That is exactly what Northstar’s Board-Level IT & Cyber Risk Review provides. It is a one-off, independent assessment of your IT and cyber position, including your MSP relationship, written in plain English for business leaders, not a technical audience. If you would like to talk through what that looks like for your business, get in touch.