In this article 5 sections
Prospects can’t tell MSPs apart
Every MSP promises security and great service. A prospect has no way to check either. So when two proposals look the same, price decides, and the MSP doing the work properly loses to the one cutting corners.
“One of the biggest issues we have, and I’m sure a lot of MSPs have, is trying to explain how we’re different from the next MSP and the next MSP and the next MSP.”
The managing director of an MSP in the West Midlands
Why prospects can’t tell
We looked at the claims on 2,776 UK MSP websites. Three in four can’t be checked. The average site makes 19 claims, and fewer than 5 of them are things a prospect could verify. “Proactive” appears on 40% of the sites, “fast response times” on 19%, and “peace of mind” on 10%.
The Proof Gap
The Proof Gap is the distance between what an MSP promises and what it can prove. Four concepts explain why the gap exists.
| Concept | Say it like this | Check it landed |
|---|---|---|
| 1. There are no trust signals | “Your solicitor has to meet a standard to use the title. Your IT provider doesn’t, and they have far more access to your business.” | “If your insurer or a client asked how you vetted your IT supplier, what would you show them?” |
| 2. The evidence is broken | “An MOT tells you the car was roadworthy on the day it was tested. It tells you nothing about this morning.” | “When was your provider’s certificate issued, and what did it cover?” |
| 3. Service is visible, security is invisible | “You’d know straight away if nobody answered the phone. You wouldn’t know if patching had stopped four months ago.” | “What could you check today, without having to ask them?” |
| 4. Your MSP is your most privileged user | “Nobody in your business has more access than your MSP. Not even you.” | “Who could reach your email, files and backups right now, and how would you know?” |
How to teach it
- Teach before you pitch. Mention yourself and Assurix last.
- One concept at a time. Pick the one that matches the prospect’s pain.
- Borrow what they know. MOTs, food hygiene ratings, chartered accountants.
- Let them say it. Ask the check question, then stop.
- Include yourself. Otherwise concept 3 sounds like an attack on their current MSP.
- Then show the proof. Show it after the problem, so it reads as the answer. Put your Trust Portal link in the proposal, so it is there when the prospect compares quotes.
Avoid scaremongering about fines or deadlines (the Cyber Security and Resilience Bill, which brings MSPs into scope, is still in Parliament), and implying the prospect’s current MSP is failing (nobody can tell).
The principle to leave them with: you shouldn’t have to take your IT provider’s word for it. You should be able to check.
The rival had certificates too
Keep your certificates. Most Assurix customers hold Cyber Essentials, CE Plus or ISO 27001, and many tenders still ask for them.
What a certificate shows, and what it doesn’t
A certificate shows that a process was in place on the day of the audit. It doesn’t show what has happened since, and it doesn’t cover the service a client gets.
| ISO 27001 or Cyber Essentials | The Assurix Trustmark | |
|---|---|---|
| What it proves | A process was in place on the day of the audit | The current status of 59 controls |
| How often it is checked | At each audit, usually once a year | Live-measured controls every six hours, the rest on a set cycle |
| What it covers | Security management (ISO 27001) or core technical controls (Cyber Essentials) | Security, plus how the service is run: 19 operational controls across responsiveness, proactive service, transparency, client experience, people and culture, and financial stability |
| What a prospect sees | A PDF or a badge | A link they can open and read, and a public Trustmark Directory listing showing current status |
| When something fails | Found at the next audit | 30 days to fix, then suspended publicly. |
A certificate proves a date. Assurix proves today.
This is concept 2 of the Proof Gap. With ISO 27001 the provider decides what gets audited, and basic Cyber Essentials is self-assessed.
When everyone holds the same certificates
When every finalist has ISO 27001, the prospect chooses on what it can check today.
The proof. Down to the last two for a 70-user deal, Sereno walked the prospect through its live results and won against a rival holding ISO 27001 and SOC 2. Not the cheapest quote.
What happens to the work you have already done
Evidence from your ISO 27001 or Cyber Essentials work is reused in Assurix where they overlap. In Launchpad, Rosie reads your existing policies, maps them to the controls and pre-fills what it can. ISO 27001 holders typically need less time to reach the Trustmark, and Cyber Essentials helps.
A link, not a promise
What changes with Assurix
You hand a prospect a link instead of another promise, for example trust.uk.assurix.com/downforce-technologies.
- It shows 59 controls, 40 for security aligned to NCSC CAF 4.0 and 19 for how the MSP runs its service, each marked Pass or Fail. Live measures such as SLA response, patching and supported operating systems are refreshed every six hours from the tools you already run, and other controls are checked on a set cycle.
- It explains itself. The “What is checked” page sets out every control in plain English.
- It can be taken away. An Assurix assessor, a person, signs off. If a failure isn’t fixed within 30 days, the Trustmark is suspended publicly on the Trustmark Directory at assurix.com/directory. Anyone can check it without logging in, suspensions included.
When they haven’t heard of Assurix
Assurix is a new name, and a badge nobody recognises can look like decoration. But the established names aren’t widely known either: only 17% of UK businesses are aware of Cyber Essentials, and 14% of micro businesses (Cyber Security Breaches Survey 2025/2026).
Your prospects don’t need to know the Assurix name before they see the proof. Explain the Proof Gap first, and the proof lands as the answer to that problem.
When you show it, point at three things
- The live status. It shows the position now.
- “They cannot change a single result.” Read that line on the portal aloud. It answers “well, you would say that”.
- 40/40 and 19/19 met. Every control has to be met. It is not a pass mark.
Then send the link after the call, with the questions from the Premium MSP Differentiation Checklist.
More than 90 MSPs are working with Assurix. See them in the Trustmark Directory.
The proof. Little Big Tech’s prospect was a 22-user pharma company that had been burned by its previous MSP. It had three other MSPs lined up. It chose Little Big Tech and signed the day after one meeting, once Nick had explained Assurix, the standard and how Little Big Tech is held to it.
“One of the lowest friction sales processes we have ever had with a brand-new prospect.”
Nick Haley, Founder, Little Big Tech
When nobody is asking for proof
Clients rarely ask an MSP to prove its own security, and Assurix doesn’t depend on them starting.
Proof works at moments that already happen in every MSP: when a prospect is choosing a provider, and when a client is deciding whether to stay.
Moment 1: winning against the incumbent
A business usually changes MSP because something isn’t working, and the reasons fall into eight groups. Ask about each, then show the matching control and its current result.
| What isn’t working | Ask the prospect | What Assurix checks |
|---|---|---|
| Slow response | “Last time something urgent broke, how long before someone picked up?” | Escalation, live response and resolution SLAs |
| Recurring issues | “Anything that has been broken, or half-broken, for a while?” | Repeat problems |
| Poor communication | “When things go wrong, do you actually know who owns it?” | Reporting, live client satisfaction, last 90 days |
| Reactive, not proactive | “When did they last call you with an idea, not a problem?” | Catching problems first, Monitoring and alerting |
| No strategic advice | “When did they last talk to you about where the business is going?” | Linking technology to your goals, Quarterly reviews |
| Unexpected costs | “Any invoices in the last year that surprised you?” | Billing |
| Security or backup worry | “When did anyone last show you a successful restore test?” | Backups, Finding and fixing weaknesses, live critical patch compliance |
| Who has access | “Who at your provider can get into your systems, and how is that removed when they leave?” | Administrator accounts, The provider’s own management tools |
Live measures depend on the integrations you have connected, so check your own portal before you show it.
Moment 2: keeping clients at renewal
A client notices a slow response, not stopped patching, missed backups or who has admin access. So at renewal a cheaper MSP looks the same.
A real case of concept 3: a client moved MSPs, and the new MSP found patching hadn’t been done for four months and the backups the client was paying for weren’t working. Nothing had visibly broken, so nobody knew.
Your Assurix link shows that work: patching across all clients, SLA and CSAT (where a CSAT tool is connected), and your own security controls, checked by Assurix rather than reported by you.
Labyrinth’s own reporting showed patching at 95%. Assurix found the real figure was 47%, because of a setting in a vendor’s policy, and worked with the vendor to fix it. As Labyrinth’s Matthew Dunn put it: “If they never found any problems, they probably wouldn’t be looking hard enough.” A report you produce yourself is your word. A check by someone else is evidence.
Moment 3: when someone else does ask
Sometimes the question does come, just not from the client’s IT contact:
- a security questionnaire from a client’s insurer
- a questionnaire from a bigger customer of your client
- your own cyber insurance renewal form
Those answers come from the same evidence, held in one place.
Does it pay back?
Work it out on your own numbers.
| Your number | Where to find it |
|---|---|
| A: monthly fee per seat | Your price list |
| B: seats in a typical new client | Your last three wins |
| C: your gross margin on managed services | Your accounts |
| D: deals you lose on price in a year | Your pipeline, or a best guess |
- A × B × 12 is the yearly revenue from one typical client.
- Multiply by C to get what that client is worth to you each year.
- Compare it with the yearly cost of Assurix. We cover pricing on a demo call.
- Ask how many of your D deals the Trustmark needs to win back to cover it.
For some MSPs one client covers it. For a smaller MSP with smaller clients it may take more than one.
What else goes on the same sum
- Price you hold. If a prospect can check the difference, you don’t have to match the cheaper quote to win.
- Time you stop spending. Audit preparation and questionnaires drawn from one place rather than rebuilt each time.
- Risk you take out. You watch every client’s systems, but nobody checks yours, and one gap in your own tools can reach every client. The downside is real: after a ransomware attack in November 2023, the MSP CTS was in administration by April 2024, and sold for £1,050,000.
- Your own insurance. Trustmark holders can get up to 25% off professional indemnity and cyber insurance, with Hiscox, CFC and Beazley, subject to underwriting. It applies to your own premiums, not your clients’.
How to frame your price with it. With a prospect comparing quotes: “We are probably not the cheapest quote you have. We are the one whose delivery is independently checked.” Then: “Ask the others to show you the same.”
Can we afford it right now?
Two things help with cash flow:
- Monthly billing is available, so you don’t pay the year up front.
- You set the pace of the work, from 2 hours a week, so the time cost is spread too.
Or bring your four numbers to a demo and we’ll run the sum together. If it doesn’t add up for you, you’ll know, and so will we.
