There are about 3,000 managed service providers in the UK. Most of them will sell you the same deck. “24/7 support, proactive monitoring, cloud-first approach.” It is almost useless for choosing one.
Here are the questions that actually separate them.
1. “What is your first-touch resolution rate, and how do you measure it?”
If the answer is above 80 percent and the measurement is clear, you are probably talking to an engineering shop. If it is hand-waved, you are talking to a ticket-churn factory that passes tickets around to pad the numbers.
For context, we sit around 83 percent. The industry average is closer to 60 percent.
2. “Who picks up the phone at 3am?”
Follow-up: is it the same person who picks up at 3pm? A lot of “24/7” MSPs use offshore call centres after hours who can read a script but cannot actually fix anything. Ask to meet the on-call engineers.
3. “What is your patching SLA?”
Critical vulnerabilities should be patched within 72 hours. Not “we have a patching policy”. An actual SLA, with an actual consequence. If they cannot tell you, they do not have one.
Ask to see last month’s patch compliance report for an existing client, with the name blanked out. A provider that patches properly has that report to hand, because it is how they know they are doing it. A provider that has to go and make one is telling you something.
4. “How do you handle shadow IT and unmanaged endpoints?”
The honest answer is that you will always have some. The question is whether they have a process for finding it and bringing it in. Discovery tooling, a quarterly audit, a policy for BYOD. If the answer is “we just manage what you tell us about”, run.
5. “Walk me through a recent incident.”
Good MSPs love telling this story. They will show you the runbook, the timeline, the post-incident review. Bad MSPs will give you a vague success story from 2022. Ask for specifics.
6. “How is cybersecurity handled, and is it separate?”
Some MSPs charge extra for “advanced security”. Fine, to a point. But if MFA, conditional access, endpoint EDR, and email security are extras, you are not buying managed IT, you are buying help desk. Basic security belongs in the base package.
A useful follow-up: “are you Cyber Essentials certified yourselves, and will you get us there?” A provider that has not been through the scheme for its own business is going to learn it on yours.
7. “Can I see your contract?”
Not the glossy proposal. The actual contract. Check for auto-renewal clauses (industry standard is 60 to 90 days notice), exit costs (should be none), data return terms, and SLA credits (they should exist). If they will not send the contract until you sign, walk away.
8. “How many clients does your account manager handle?”
40 is a lot. 60 is too many. Beyond 60 and you are a line on a spreadsheet.
9. “What does your onboarding look like, week by week?”
A structured answer with named deliverables is good. “We will have you live in two weeks” is not an onboarding, it is a sales promise. Our onboardings take six to eight weeks and nobody has ever complained about the detail.
10. “What do you not do?”
Every good MSP has a list of things they do not do. It might be ERP, it might be bespoke dev, it might be mainframe support. If they claim to do everything, they are cheating you somewhere.
Reading the price
Managed IT is usually priced per user or per device per month, and the number on the proposal is only comparable once you know what is inside it.
Ask for the price with everything included that you would actually need: endpoint protection, email security, backup of Microsoft 365, MFA and device management. A £30 per user quote that needs £25 of security add-ons is a £55 quote. Then ask what is charged on top: out-of-hours work, projects, on-site visits, hardware. A fair contract has a short list here, and each item has a price on it in advance.
Ask what happens to the price when you shrink. Some contracts hold you to the seat count on the day you signed for the full term. The better ones let the count move within a band each month.
Finally, ask what you are buying at the top of the range. A “premium” tier that is the same service with a faster response time is fine. A premium tier that is the only one with security in it means the base tier should not exist.
How to run the comparison
Three providers is the right number. Fewer and you have no reference point; more and the evaluation becomes the job.
Give each the same written brief: how many people and sites, what you run, what hurts today, and what you need the provider to take on. Ask each for a proposal and a contract together, and for a half-hour call with the engineer who would lead your onboarding, not the salesperson. The difference between the sales call and the engineer call is the most useful data point in the whole process.
Ask each for two client references in your size range, and actually call them. The questions to ask a reference are simple: how long did onboarding really take, what happened the last time something broke, and what would you change about the relationship.
Score the three against the ten questions above, not against the price. Then look at the price. If the cheapest is also the one with the vague patching answer and the contract they would not send, the saving is not a saving.
What a good first 90 days looks like
The onboarding tells you whether you chose well before you have paid three invoices.
Weeks one and two: discovery. Every device, user, licence, circuit and cloud service inventoried, documented, and put into the provider’s management tooling. Passwords into a vault. Anything unsupported or unpatched flagged with a plan and a price.
Weeks three to six: stabilisation. Monitoring and endpoint protection deployed everywhere, MFA enforced, backups tested with a real restore, the biggest risks from discovery closed. This is where the previous provider’s shortcuts surface, and a good MSP tells you about them in writing rather than quietly absorbing them.
Weeks seven to twelve: the service proper. Ticket volumes settle, the monthly report starts to say something, and the first quarterly review sets the roadmap. If you get to day 90 without a written asset list, a tested restore and a roadmap, the onboarding did not happen, whatever the sales deck said.
The honest tell
Good MSPs talk about boring things. Patching, documentation, process, runbooks, escalation paths. Bad MSPs talk about buzzwords and tools. Anyone selling AIOps without talking about patch SLAs first is selling you a dashboard, not an outcome.
If you are currently evaluating, we would love to be one of the three people you compare. Bring the hard questions. We will answer them.