In this article 6 sections
Ask most MSP owners if their own house is in order and they will say yes without pausing. They run security for a living. The awkward part is that confidence and evidence are two different things, and the gap between them is where the risk sits. You watch every client’s systems, and nobody checks yours.
Why do secure-feeling MSPs still have gaps?
Because nothing going wrong is not the same as everything being right. You patch, you run MFA, you take backups. But when did you last check that every one of those is true across your own business today, not the day you set it up?
Drift is quiet. A backup job fails and nobody notices for three weeks. MFA gets switched off for one director who found it annoying. A leaver keeps their admin login for a month. None of it announces itself.
What does more confident than secure look like?
It looks like an established MSP with 15 years of good service and no major incident, who takes that record as proof. A clean record can mean strong controls, or it can mean you have been lucky and nobody has tested you. From the outside those two look identical.
When Start Tech went through the Assurix Trustmark, they were not a struggling MSP. They were experienced and confident. The process still surfaced gaps they did not know were there.
“I feel confident that we are much more secure going through the Assurix process.”
Ian Groves, MD, Start Tech
How do you close the gap between feeling secure and proving it?
You make the invisible visible. Every claim you make about your security should have evidence behind it that a sceptical third party could check. For backups, that means this week’s success rate.
The checks that catch most MSPs out:
- MFA coverage across every admin and user account.
- Patch compliance measured this month.
- Backup success verified by a restore test.
- Leaver offboarding done within a day, evidenced, every time.
- Access reviews that happen on the calendar.
What is the difference between an audit and live proof?
A certificate proves a date. Assurix proves today. The Assurix Trustmark checks live-measured controls every six hours and the rest on a set cycle, so the evidence stays current.
Leave a failed control unfixed for 30 days and the Trustmark is suspended publicly. That enforcement is the point.
For the practical version of building that evidence base, see our playbook on building an evidence library for MSP sales.
What is the fastest way to test your own confidence?
Pick five controls you are sure about and try to produce current evidence for each in under two minutes. Use this week’s data. Many owners stall on one before they reach five. The ones you stall on are the ones an insurer’s renewal form or a bigger customer’s questionnaire will stall you on too.
Do it once a quarter and the exercise stops being uncomfortable, because the list of things you can prove keeps growing while the list of assumptions shrinks.
Frequently asked questions
How do I know if my MSP has a security blind spot?
If you cannot produce current evidence for a control in under two minutes, that is your blind spot. Confidence fills the space where evidence should be.
Does a clean incident record mean we are secure?
It means nothing has gone wrong yet. It does not tell you whether that is down to strong controls or good luck.
What is the Assurix Trustmark?
The live trustmark for MSPs. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live-measured controls are checked every six hours, the rest on a set cycle, and an Assurix assessor signs off. The result sits on a Trust Portal anyone can open. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly.
