What are the different types of managed services models?

Although this model exists and has its place in the market, I would never advise an MSP to setup break-fix agreements with customers unless you enjoy sparring with them over their invoices every month. Break-fix is an ideal way to keep clients accountable who do not want to meet best practices and standards. You can use a break fix agreement to protect your organization from losing time/resources working on old, outdated, and unsupported hardware/software. With a proper agreement, you can charge client T&M every time you fix that 10 year old, Windows 2008 server you’ve asked them to replace.

In my experience I have seen IT groups and MSPs work on the security and protection side of the break so tht there is not need for the fix. Browser security has been the most effective place to start, because every endpoint has a browser and every browser has a user browsing. 1 our or 2000 sites will sail through the security stack with malware.

A monitoring-only model, while cost-effective, carries risks. It relies heavily on the company’s internal resources to act on the insights provided by the monitoring service. This can lead to delays in response times if the company lacks adequate resources or expertise. It may result in misinterpretation of data if the company does not have sufficient knowledge in the area being monitored. The model also assumes that the company has the capacity to handle all incidents, which may not always be the case. It places a significant portion of risk on the company, as they are ultimately responsible for any actions taken based on the monitoring data.

When outsourcing, most MSPs are geographically focused or have a specialization in a vertical. Either way, you can have IT operations outsourced to you group. My suggestion is to understand the security posture that is being provided with your services.

In a partial outsourcing model, strategic planning is crucial. It’s important to clearly define the scope of what processes are to be outsourced to avoid confusion and ensure smooth operations. Vendor selection is another key consideration; it’s essential to choose a vendor with expertise in the outsourced area and assess their reliability, reputation, and financial stability. Costs, both direct and indirect (like transition expenses and potential efficiency losses), need careful analysis. While outsourcing can mitigate some risks, the company retains ultimate responsibility, necessitating a robust risk management strategy.

A full outsourcing model, while beneficial in many ways, comes with its own set of costs. These include not only the fees paid to the vendor for their services but also the costs associated with transitioning processes and systems over to the vendor. While outsourcing can help mitigate certain risks by placing them in the hands of specialists, it’s important to note that risk is not fully transferable. The company still retains ultimate responsibility for its operations. Any failures or shortcomings on the part of the vendor could have significant repercussions for the company. Outsourcing can provide cost savings and efficiency gains, it also requires careful management to ensure that costs are controlled and risks are properly managed.

Most MSPs that offer the full outsourcing model have clients to back up their successes. These relationships have come together over years of service and create valuable insights for your business. The current threat environment is so volatile that you can not run a business with out at least a 2nd set of eyes on your security posture for vetting and testing. The best is to have specialists and tools hat are managed by practitioners that will provide the protections and data.

In our recent threat report, we identified a doctor's office website that had been hacked with malware to deliver malware to the visitors. Managed Service Providers will look where you do not think to look when it comes to security. Ask them to push their own limits to understand your protection and provide data to confirm.

In my experience, I’ve been fortunate to avoid the break-fix model, which inherently carries significant risk due to its reactive nature. This model often leads to higher costs, more downtime, and unpredictable IT expenses. If a company operates under this model, it’s crucial to have a clear roadmap for transitioning out of it. This could involve moving towards proactive models like managed services or adopting predictive technologies for issue detection. The transition should be planned and executed carefully to minimize disruption and ensure continuity of services. The key is to be proactive, not just reactive.