Most organisations only think hard about their IT managed services provider when something has already gone wrong: an outage that took too long to fix, a security gap nobody flagged, a renewal that quietly doubled in price. By then the relationship is usually well established and hard to unpick. It's worth working out what "good" actually looks like before you sign, not after.
Reactive is not the same as managed
A lot of providers describe themselves as "managed services" while operating almost entirely reactively: tickets come in, tickets get resolved, and that's the extent of the relationship. That's a service desk, not management. Genuine management means monitoring infrastructure before it fails, patching on a defined cadence rather than when someone remembers, and planning capacity ahead of the point where it becomes an emergency. The difference shows up as an absence, not a presence: fewer outages, fewer surprises, fewer late-night calls, because the problems were caught before they became incidents.
Signs a provider is actually paying attention
Ticket resolution time is the easiest thing to measure and, on its own, the least useful. It tells you how fast a provider reacts, not whether they're preventing problems in the first place. A provider that's genuinely on top of your environment will bring you things you didn't ask for: a heads-up that a licence is about to lapse, a recommendation to patch something before it becomes a vulnerability, a conversation about whether your current setup still fits where the business is heading. If every interaction is initiated by you, that's worth noticing.
The relationship test
Ask who you'll actually be speaking to day-to-day, and press for a specific answer. A provider built around a rotating queue of whoever's free will always be slower and less context-aware than one where a small, consistent team knows your environment: your quirks, your history, the one legacy system everyone's a little afraid to touch. That continuity matters more than almost any other factor in how the relationship actually feels once you're a few months in.
What good looks like in a contract
- SLAs tied to business impact, not just severity labels. A "critical" ticket should mean something specific to your operations, not a generic tier in a template.
- Reporting that goes beyond ticket counts. Patch compliance, security posture, capacity trends, not just how many tickets were closed this month.
- A genuine security posture, not a checkbox. Ongoing monitoring and response, not an annual review that gets filed away.
- Transparent pricing with no ambiguity at renewal. Understand exactly what triggers a cost increase before you sign, not when the renewal notice arrives.
- An actual exit and transition plan. A good provider should be able to tell you, upfront, how a handover to someone else would work if it ever came to that. If they can't, that tells you something about how locked in you'd be.
Before you sign
Ask a prospective provider to walk you through what they'd have caught, proactively, in your current environment, not what they'd fix once you called. Their answer tells you more about how they actually operate than any pitch deck will.
If you're evaluating providers or wondering whether your current one is genuinely managing your environment or just responding to it, we're glad to give you an honest outside view.