Where managed services is heading
Managed services is splitting in two: low-margin generalists selling reactive tickets, and specialist partners selling operational resilience.
Insights and thoughts Andrew Wood
Managed services is splitting in two. On one side are low-margin generalists selling reactive tickets, and on the other are specialist partners selling operational resilience. Four shifts are driving it.
First, the unit of measure is changing. Clients don’t want a ticket closed in 15 minutes; they’d rather the underlying fault was engineered out so the ticket never existed. If your growth plan still means hiring another first-line analyst for every few hundred endpoints, you’re scaling overhead rather than capability. Event-driven remediation and AI triage across platforms like Copilot Studio, Gemini and ServiceNow are turning the service desk inside out, which is why experience level agreements, built around system stability and the absence of disruption, are replacing pure response SLAs.
Second, the generalist model is being squeezed out. Selling the standard Microsoft 365, endpoint protection, firewall and backup bundle to any business with 20 to 200 staff has become a commodity race to the bottom. At the same time, supply chain liability, tightened Cyber Essentials Plus baselines, FCA operational resilience rules and incoming UK cyber legislation are pushing enterprise-grade governance down into the mid-market. Pricing power now sits with providers who deeply understand a sector, such as financial services, legal or healthcare, or a complex domain like identity governance and zero trust networking. If you can’t speak your client’s regulatory language, you’re competing on price.
Third, security can’t be an optional upsell any more. Selling baseline support at one price and charging extra for detection and response made sense five years ago. Given current cyber insurance underwriting criteria and the speed at which attackers are exploiting perimeter kit and stolen session tokens, running an estate without continuous monitoring and strict identity hygiene is impossible to defend. Every credible MSP has to operate partly as a security provider by default.
Fourth, co-managed IT is where the real growth sits. Mid-market IT directors are caught between boardroom pressure to deploy AI safely, tough compliance audits, cloud sprawl and sheer tool fatigue. The providers winning multi-year contracts aren’t trying to replace those internal leaders. They supply the heavy engineering platform underneath them: the 24/7 SOC, the automated patching engine, the monitoring fabric and the third-line architectural escalation, and make the internal team look good to its board.
Providers who keep billing for reactive tickets will soon find the market makes that decision for them.