In this article 5 sections
From building Netstar to building Assurix
Chris Tate sits down with Mit Patel to trace the line from running an MSP to founding a new company in the UK channel. Mit built Netstar UK from 2002, grew it to about £8M in revenue and about 60 staff, and went through a private equity exit in 2021. Assurix came out of what he saw on the way through.
Why the trust signals stopped working
Every MSP claims the same things. Badges that once meant something can now be bought cheaply and never maintained. Mit says he watched strong, well-run MSPs lose work to weaker ones because a prospect could not tell the difference from the outside. Promises had replaced proof, and nobody was checking.
The mission: raise the bar for security and accountability across the MSP community, and help the good MSPs win.
What Assurix actually is
Assurix is the live trustmark for MSPs. It answers one question: can this MSP prove how it runs security and governance today?
It works in two parts. First, a GRC platform built for MSPs. It turns expectations into practical questions (who owns this, how is it checked, where is the evidence, when was it last reviewed) and pulls evidence from the tools MSPs already use, such as Microsoft 365 Secure Score, RMM patch status and backup success. The security pillar’s 40 controls are aligned to the NCSC Cyber Assessment Framework 4.0, alongside 19 operational controls built for MSPs.
Second, the part clients see: the Assurix Trustmark. It is 59 controls, and both pillars must pass. It is independently assessed, with an Assurix assessor signing off, so the proof does not come from the MSP’s own marketing. Live-measured controls are checked every six hours and the rest on a set cycle. If a control fails, the MSP has 30 days to fix it. If it is not fixed, the Trustmark is publicly suspended, and the suspension shows on the Trustmark Directory. A public suspension is why a prospect can believe it.
Why a trustmark, and why now
Clients are more aware of supply chain risk. Insurers are raising the bar. Regulation is moving towards accountability. MSPs will produce more evidence either way. A trustmark puts that work to commercial use.
For a well-run MSP, this is differentiation that holds up to scrutiny. For the market, it is a way for clients to choose on something real.
For an MSP that already does the right things, most of the work is evidence. The controls are things a well-run provider does anyway: patching, backups, access management, clean onboarding and offboarding. What changes is that the evidence is current and independently checked, so the MSP can show it to a prospect, an insurer or an acquirer at any time.
Common questions
What is Assurix’s mission?
To raise the bar for security and accountability across the MSP community and help the good MSPs win, by giving them a way to prove how they run rather than only claim it.
Why did Mit Patel build Assurix?
He watched strong, well-run MSPs lose work to weaker ones because prospects could not tell them apart. Promises had replaced proof and nobody was checking. Assurix closes that gap.
Is the Trustmark the same as ISO 27001 or Cyber Essentials?
No. It is its own standard, run by Assurix. Assurix also lets MSPs track frameworks like CE+ and ISO 27001 separately in the platform, but the Trustmark is distinct, with live-measured controls checked every six hours and the rest on a set cycle.
What happens if a control fails?
The MSP has 30 days to fix it. If it is not fixed, the Trustmark is publicly suspended, and the suspension shows on the Trustmark Directory. A public suspension is why a prospect can believe it.
What is the Assurix Trustmark?
The live trustmark for MSPs. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live-measured controls are checked every six hours and the rest on a set cycle. An Assurix assessor signs off. A failure left unfixed for 30 days suspends the Trustmark publicly.
