Is an MSP’s reliance on one security software vendor a problem?
It can be, and it is worth looking at closely. Relying on one vendor makes the MSP simple to run, but it also ties the business to that vendor’s pricing, terms and reliability. Ask how deeply it is built into every client’s setup, what the contract says, and how hard and costly it would be to switch.
Start by finding out how far the vendor reaches. Is the software on every client machine, or only some? Does the MSP also depend on that vendor’s tools for monitoring, reporting and billing? The more places it appears, the harder it is to replace. Ask for a list of clients by what they use.
Next, read the reseller or partner agreement. Look at how long it runs, whether it passes to a new owner, who sets the price and how much notice either side must give before changes. If the agreement needs the vendor’s approval for a transfer, raise it with the seller early. Have your lawyer read it.
Finally, test the exit. Ask the technical team how they would move clients to another product and how long that would take. Ask what happened the last time the vendor had an outage or a security problem, and how the MSP told its clients. Compare the setup against a recognized baseline of security controls for small organizations, and ask whether any clients have asked about alternatives. Write down the answers and compare them with the cost of staying put, since a single vendor may still be a sensible choice if the terms are fair and the exit plan is realistic. The question is whether the risk is understood and managed, not whether the vendor is single.
Key takeaways
- Map how many clients and internal tools depend on the one vendor.
- Read the partner agreement for transfer and pricing terms.
- Ask how the MSP would switch products and what happened in past vendor problems.
Related reading
15 pages on the same subject, grouped by topic.
Due diligence
- Expert answerHow do I check a managed IT provider’s reliance on one software vendor?
- Expert answerHow can I verify a bookkeeping practice’s reliance on one accounting software?
- Expert answerWhat should I ask about a managed IT provider’s past security incidents?
- Expert answerHow do I check an HVAC service company’s reliance on one building owner?
- Expert answerHow should I review a property management firm’s maintenance vendor relationships?
- Expert answerHow do I check a security consultancy’s sub-contractors before buying?
Buying
- Expert answerHow do I check the data security habits of a payroll service I am buying?
- Expert answerHow do I judge a photography studio’s reliance on wedding season bookings?
- Expert answerWhat should I check before buying a security services company?
- Expert answerWhat software and design tools should I confirm come with an engineering firm?
- Expert answerHow do I check a software reseller’s relationships with its vendors before buying?
- Expert answerHow can I tell if a cybersecurity consultancy relies on one star consultant?
Selling
Sources
This answer is checked against primary sources. Links were last confirmed on the dates shown.
- 01Canadian Centre for Cyber SecurityGovernmentBaseline cyber security controls for small and medium organizations
- 02Business Development Bank of CanadaGovernmentHow to conduct due diligence when buying a business
Deavo is an advertising and listings platform, not a brokerage, law firm or valuation firm. This page is general information, not legal, tax, accounting or valuation advice, and rules differ by province. Confirm anything you rely on with a qualified professional before you act on it.