In this article 7 sections
Service is visible, security is not
Noel Bradford hosts this episode of The Small Business Cyber Security Guy with his co-hosts and guest Mit Patel, founder and CEO of Assurix. The show speaks to small business owners. Its question for small business owners: if your MSP says everything is fine, what can they prove?
Mit’s starting point is that a customer feels it when a ticket goes unanswered or a new user isn’t set up. Security is different. The customer doesn’t always know whether patching is happening, whether MFA is enforced, or whether the tools installed to protect them are working. When three providers say similar things, the business can’t tell them apart, and the decision comes down to price.
What proof means
Mit says the MSP should be able to show the work is being done. Patching claims need patching evidence. SLA claims need service data. Security claims need live evidence from the tools. “A statement isn’t evidence. A proposal isn’t evidence.” A policy only counts when it connects to real activity.
He doesn’t expect businesses to become technical. The provider has to explain and prove it clearly.
Mit calls Cyber Essentials a good thing. Its limit is that it shows what was in place at assessment, not next week or three months later.
How Assurix works
Mit describes two sides. The security controls align to the NCSC Cyber Assessment Framework: governance, managing security risk, protecting against attack, detecting events and minimising impact. Operational maturity covers SLA delivery, onboarding, offboarding, escalation and complaints. Assurix integrates with the tools MSPs already use, such as remote management, patching and service platforms, so the evidence is live rather than self-reported. Live-measured controls update every six hours. If an MSP fails a required control, it has 30 days to fix it, or the Trustmark is suspended.
For a good MSP, he says, independent evidence moves the conversation from price alone towards outcomes, controls and trust.
Low prices and the proactive gap
On cheaper providers, Mit says: “Most providers don’t set out to do things badly.” If the price is too low, there may not be enough margin, time or resource to manage everything properly. The hosts run the numbers: a 10-user business paying £150 a month, with engineering time at around £50 an hour, buys 3 hours before the provider makes no margin. At a normal margin it is closer to an hour and a half.
Mit splits MSP work into incidents, change requests and proactive maintenance. In smaller or lower-margin MSPs, proactive work is the easiest to under-resource, because customers notice the other two first. His questions for a business choosing an MSP: who does proactive maintenance, is it a dedicated role, how much time is allocated, and what evidence shows it is happening?
Insurance and operational maturity
Insurers are becoming stricter about evidence, Mit says, and the market is moving towards continuous assurance. Evidence that controls were in place and working can matter during underwriting and during a claim.
On operational maturity, he lists complaints visible at board level, fair onboarding and offboarding, escalation and SLA delivery. He heard of an MSP trying to charge £18,000 to offboard a 20-user customer. He says that is not fair or proportionate. Customers switch, in his experience, over service issues, poor advice, poor value for money, confusing bills or an incident.
Questions for businesses choosing an MSP
The panel ends with questions a business should ask. Graham asks for the last 90 days of patching, backup and monitoring evidence. Corinne asks whether MFA is enforced everywhere, and to see the exceptions. Lucy asks what offboarding involves, what it costs and where it is written down. Mit’s question is what proof the MSP can show that it does what it says.
His advice to MSPs losing to cheaper quotes is to show evidence and educate customers on why it matters. “It’s about making good work visible.”
Common questions
Why can’t small businesses tell MSPs apart?
Many SMEs rely on their provider for advice. When several MSPs say similar things, the business can’t see the difference, so the choice falls to price.
What counts as proof of MSP security?
Evidence from the work itself: patching data, service data against SLAs, and live evidence from security tools, shown over time. Statements, proposals and unconnected policies don’t count.
What happens when an Assurix MSP fails a control?
It has 30 days to fix it. If it doesn’t, the Trustmark is suspended.
What should an MSP do if it keeps losing to cheaper quotes?
Show evidence and explain why it matters. Making good work visible gives the customer a better basis for trust than price.
What is the Assurix Trustmark?
The live trustmark for MSPs. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live-measured controls are checked every six hours and the rest on a set cycle. An Assurix assessor signs off. A failure left unfixed for 30 days suspends the Trustmark publicly.
