Dave Bloom: Why Small MSPs Can Sustain High Margins by Limiting Tool Overhead

[00:00:00] Most MSPs treat regulated clients, like legal, financial and healthcare, as too risky, too complex or too expensive to serve well. A smaller group has figured out how to turn that compliance overhead into a moat and run margins the rest of the channel can't touch. Today, what it actually costs to deliver in a regulated environment, why client selections may matter more than any tool in your client stack, and what happens to that moat when the vendors start selling compliance right next to you.

[00:00:27] This is the Business of Tech. I'm Dave Sobel. Dave Solt, you're the Director of IT Operations at Trumbull Tech. Welcome to the Business of Tech. I appreciate it, Dave. Great to be here. I'm excited to have you. Excited to have you. Now, I want to talk, let's start with some regulated verticals, because I think that's a really interesting space, legal, financial, healthcare, an area that you've got some experience,

[00:00:53] and they carry real compliance overhead. Things like HIPAA and retention rules and strict access control and all the audit exposures. A lot of MSPs avoid them for exactly that reason. You leaned way in. Like, what made you decide that those clients were worth the complexity? They're worth the complexity because the level of enforcement from a compliance perspective is not all that difficult.

[00:01:20] So, what we've done a little bit different with Trumbull Tech is we've actually shied away from Microsoft Intune. But ultimately, the benefit from our perspective, especially with our target, right? So, our biggest target size is really the one to 50 seats, which most MSPs typically don't target. But we've been really successful in this space ultimately because our overhead is so low.

[00:01:49] And again, Microsoft Intune is phenomenal and has all of the levers and the bells and the whistles, and you can dive so far and so deep with regard to compliance. But the reality is our clients don't need all those levers. They don't need all those bells and whistles. And with Mirador, we've been able to enforce the basics. So, when I say basics is ultimately, hey, we've got BitLocker enabled from a Windows perspective.

[00:02:15] You know, we've got, you know, the Mac equivalent turned on from Mac OS. We can manage, you know, iOS devices. We can manage Android devices. We can set password complexity. Again, we can do patch management. We can do remote wipe. I can basically eliminate the USB devices in terms of, you know, data is going to disappear off onto a thumb drive.

[00:02:42] So, we can actually deliver that same level of compliance from a HIPAA perspective, from a PCI perspective, from a data perspective for all of our clients, whether it's financial, whether it's healthcare, without the overhead, right? With a, you know, Microsoft certified engineer, you know, babysitting Intune consoles. So, the great thing that we've found with Mirador is it just works, right?

[00:03:10] I mean, once I set those policies and once I enable device management, the MDM for these devices, we're good. So, having decided to go into a space where this was complexity, I would have thought you'd have to build something before you could take on the first one. Like, how did you approach having to build that offering before you went to market? So, it was a little bit of learning as you go.

[00:03:40] But the reality is what my business partner, Rebecca and I were looking to do in, you know, we, from the beginning, we've always been intentional in terms of our market, right? So, we chose the 1 to 30, 1 to 50 seats intentionally. And ultimately, the thought process behind that was, hey, it's just the two of us. We're getting started. We're rubbing two sticks together here to build this. We didn't have any VC funding behind it.

[00:04:09] You know, very passionate about what we do and being able to be servant leaders and enable and help our communities that we operate in. And that seat count was intentional, right? So, just based on us not taking on a client where, you know, hey, we're taking on 200 seats or 250 seats and we're not going to be able to be successful, right? Because it basically swamp us from a resource perspective.

[00:04:32] So, we were intentional in terms of we want to provide the most value and, you know, how can we do that? And, you know, ultimately, we chose to pick our client base for that reason, size-wise. And as we were kind of developing our technology stack, what we really wanted to do, again, intentional, right?

[00:05:02] So, we wanted to bring enterprise solutions down to that small business space that typically would not have the level of technology or compliance or even be aware of these offerings. So, again, the level of sophistication that we're able to bring to, you know, one to 30 seat businesses. So, think lawyers, think CPAs that may not have any, you know, can't afford a traditional MSP.

[00:05:32] You know, the $2,000, $3,000 every month is out of their price range where we're able to operate in a more efficient cost perspective. And again, we're still able to make our revenue numbers, you know, from a gross margin perspective. But the level of technology that we can bring into this space with this MDM product is amazing. All right. So, we have, there's actually a case study that's published by Huntress.

[00:06:02] We have a 25 seat CPA firm out of Florida. They're 100% remote and their owner has an IT background. Clicked on something, knew she shouldn't have clicked on it, closed the browser tab. And of course, at the end of the day, you know, those credentials are compromised and all of a sudden she's logging in from a VPN in Toronto, which is obviously not her.

[00:06:27] So, within five minutes, Huntress was able to shut that down, have us alerted. Her password was rotated, account was locked out. We were able to do a full forensic audit through Office 365 and confirm that there was no data that was compromised, you know, with regard to TIN numbers, social security numbers, any type of PII. But again, you could see this threat actor going through that environment file by file looking for something that, you know, again, they could monetize.

[00:06:57] So, for us to be able to bring that level of sophistication down to small business is amazing. And again, that's my background from an enterprise perspective, being able to bring these tools to small business has been really, really rewarding, right? So, again, we'll do proof point from a back perspective in terms of email defense. You know, we also have partnered with Huntress for their security awareness training.

[00:07:26] So, again, we're able to bring enterprise grade products down to small business. And, you know, again, the reality is everybody's a, everybody's a target, right? You could be Bailey's, you could be Fortune 500, you could be, you know, multimillion dollar firm. It doesn't matter. Again, you could be working as a, you know, an electrician, sole proprietor. Everybody's a threat, right? Anybody that has any type of data is a target and they're going to monetize this.

[00:07:54] So, what I've found that we've been able to do has been really rewarding in terms of being able to bring, I would say, you know, it's not a silver bullet, right? There's not a single solution. There's not anything that, you know, I can promise that, hey, you sign up with Trumbull Tech, you're, you know, we're going to protect you 100%. There is no 100%. But what I can say is that we're constantly looking at the tools that are on the market.

[00:08:22] And again, our goal is to give you at least a fighting chance and to give you, you know, again, a cost effective solution that's going to protect most and at least have a, you know, a path to recovery if something does happen. If that makes sense. We'll be right back after this message.

[00:08:42] OpenText's 2026 threat report found infection rate for small businesses jumped 28% last year and 39% for midsize businesses. Your clients are the fastest growing target segment. The good news? Layering endpoint protection with security awareness training delivers measurably fewer infections. Open Tech's cyber security gives you both.

[00:09:09] Visit cybersecurity.opentext.com. And we're back. So let's talk about the margins before I get more into that, that case study. So you're running at 55 to 60% gross margin, which is well above average. Like walk me through the mechanics of that. Is that a pricing decision? Is that a tooling decision? Is that staffing? Like how have you combined that to achieve that level of gross margin? So it's a combination of all of it, right?

[00:09:37] So, you know, our, our backgrounds and, you know, previous experience with, with, within the MSP space, you know, we partner with ConnectWise from day one. So again, we've, we've leveraged all, all of SLI's best practices. We've built our entire book of business and charter accounts, uh, structure that based on, you know, SLI best practices.

[00:10:01] Um, and with regard to pricing, you know, we factored in all of our tool selection, all of the agents, um, everything that we're doing from an operations perspective. Um, you know, our insurance, our investment with ConnectWise tools, all that went into it along with, uh, ultimately, you know, when we, we started this, it was, you know, I was doing most of the, you know, ticketing and the, the operations aspect of it.

[00:10:29] But we factored in, you know, a salary of 80,000 to a hundred thousand dollars for an engineer. So we built that in from day one with regard to how we're going to price this. So the fact that we don't have any physical office space, there's no real estate. Um, there's no, you know, no tangible, um, physical assets for, for the business again, has been a competitive advantage.

[00:10:56] I would say allows us to ultimately offer these services much less than a traditional MSP. And at the same time, the other thing that we've done with our model is we've flipped it on its head, right? So if you look at the one to 30, do they need unlimited? And the answer is probably not. All right. So we factored basically everything you need, nothing that you don't is kind of our, our business model, right?

[00:11:22] So if you look at our, our offerings for our concierge service, um, straight up tooling. So again, we'll give you the tools, we'll give you the protection, but if you need help, you're going to pay basically on an hourly basis. Uh, for our concierge secure and secure plus we've bundled two hours and four hours. That's really the biggest difference. So ultimately it basically gives that small business the ability to baseline their IT costs. Right. So, Hey, I know I'm going to need help.

[00:11:50] I don't know what the issue is going to be, but if, you know, my outlook's not working or pay, I need, need help with X, Y, and Z. Hey, I've got time. I know I can call you. Um, I know you're gonna be able to support me. And again, the other thing that we do a little bit differently too, is we allow that time to roll over. Talk to me a little bit about the way you've thought about scaling. Cause it's one of the things about Trumbull Tech is it's a small team, right? So that means that you have the ability to, you know, have personal interactions with everybody.

[00:12:18] Have you thought about what, how much of a scaling limit limiter that might be? How much of this applies if you wanted to double, triple the business or is that not even in the business plan? How are you thinking about the, the growth and scaling question? So the growth and scale, I mean, it's, it's built in. It allows that personal relationship, right? And I would say, I think that makes our MSP a little bit sticky. So from a client interactive perspective, you know, we know all of our clients, we know them by name.

[00:12:47] You know, we know their kids, we know their, their pets, um, that level of relationship is, is allowed. Um, whereas, you know, your traditional MSP, you're typically dealing with offshoring or, you know, you don't, you don't know who you're interacting with. Right. With, with, with the small team. And as we grow and scale, the goal is to maintain that. So, um, I don't foresee any challenge, right?

[00:13:13] So our goal is getting out of the referral and ultimately building a, you know, proper sales and, um, growth model. So we're going through that level of maturity and, and growth and trying to build a, an actual model that we can, we can scale. So we have the model. So what we need to do is we focus on the, on the sales and, um, in that aspect of it. Um, and we've made some staffing changes to allow that to happen. So it's, that's a work in progress.

[00:13:41] Um, but again, from a tooling perspective, from a personnel perspective, we have all the right resources and we have the capacity. So again, if we 2x, 4x, we, there's no immediate change that needs to happen right now. Right. We, we have the capacity on, on the bench in-house that we can continue to accommodate, uh, probably 4x.

[00:14:08] As we get to, you know, 4x beyond, um, you know, ultimately as we add another engineer, another two engineers, uh, again, it's, it's a math problem, right? But again, it would also be, be primary technician would own that account, right? So again, that I think is where the magic happens with regard to, uh, building that lasting relationship, right?

[00:14:34] So again, you know, client X calls in, they know they're going to talk to Aaron. They know they're going to talk to Tom. They know they're going to talk to Bob. They have their primary relationship. They have somebody that knows, knows their business, knows where they last left off. So they're not getting a random technician that's coming in regurgitating ticket notes. And again, we've already had this conversation, you know, we don't need to start from, from zero. So that, that is ultimately our goal.

[00:15:02] Um, you know, as we, we scale, this is, is really focusing on the client. Um, you know, the relationship and being part of their business, right? We, we sell trust at the end of the day is what we do. And our goal is to be that, that trusted advisor. And we want to maintain that relationship. And if there's anything we can do to enable the business that's even beyond technology, we're happy to do that. You know, if there's a referral that we can make, if there's a connection that we can make, you know, we're, we're happy to do that.

[00:15:30] So we really look at ourselves as a part of the, you know, part of the business, um, for our clients. Uh, and again, I think that's the differentiator is the fact that we're not just here to turn it off and back on again. We really want to be able to provide that value for, for our customers. We'll be right back after this message. This episode is brought to you by Control Map. Drawing MSPs are using Control Map to build recurring revenue by expanding their GRC services.

[00:15:59] Starting now, Control Map is offering a free plan for MSPs looking to get started with providing compliance as a service. Create a free account and run an assessment. Track key items like policies, risks, and evidence in one place. It's a practical way to prove value to a client before deciding to expand your compliance offering. Try Control Map for free today. Visit scalepad.com slash Dave to get started. That's scalepad.com slash Dave.

[00:16:30] And we're back. Now, our own community analysis has compliance running as one of the most active topics in discussion right now. And the tone is always negative. Like one thread that we were tracking is, is a HIPAA regulated shop trying to hold that policy line on AI while the executives push to turn it on. You're living in that space. Like what do you actually let a regulated client run today and what's still a hard no?

[00:16:59] So, Dave, that's a good question. And, you know, where we kind of take our default stance is, you know, we've seen other MSPs in terms of locking down everything and, you know, putting hard, hard limits in. We don't do that. And I'll say strictly for the fact that, you know, just from a compliance perspective, from an admin perspective, right? All of our clients, they have admin access to the laptops. We don't restrict that.

[00:17:29] We don't get keep. And we do that intentionally. Just again, given the size of where we're at, you know, if we started going down that line of locking everything down, the level of tickets coming in, requests coming in just to, I need to do X, Y, and Z. I need to install, you know, extension in Chrome or I need to install an application. It would swamp us, right, from a support perspective. And that's not a business that I want to be in in terms of gatekeeping, right?

[00:17:58] That's, I don't think, beneficial. And I think that creating that friction is detrimental to any type of business model. You know, again, it's risk and reward, right? So if we're going to gatekeep our clients from doing their day-to-day, we're building in friction and we're setting up a relationship to fail is how I would view that. So we don't kind of get into that space.

[00:18:24] I mean, at some point we may as we mature and, you know, there's an actual need. But right now we're able to manage our clients' needs and basically enable them to be successful, but at the same time keep guardrails in place for, you know, providing that protection for them.

[00:18:43] You know, with regard to HIPAA, with regard to AI, the reality is our client base, just given the size, there has not been a ton of interest with regard to AI. I think there's really what we're seeing from our clients is a wait and see.

[00:19:04] You know, I think folks are exploring, whether it's Copilot, whether it's ChatGPT, Claude, you know, there, I think folks are looking at these tools. I think there's an exploration in it, but I don't see a large rush in terms of adopting these frontier models.

[00:19:24] And then, you know, from a security perspective, data sovereignty and data security, you know, I don't see any of our clients, you know, typing in meeting notes or, you know, pumping in any type of business trade secrets into these models where, you know, that would become, you know, a potential security risk.

[00:19:49] I think the hesitation allows for us to kind of come with these are the things that you can do, right? So whether it's a QuickBooks automation, whether it's a, you know, chat bot for their website, whether it's, you know, some type of integration to 8x8 from a VoIP perspective with regard to call assistant.

[00:20:13] We're looking at kind of building out a catalog of fixed bid projects, if that makes any sense in terms of these 10 things that you can do with AI, right? Oh, I never thought about that, right? Because again, I don't think most of our client base is even exploring it. So if we come with the solution and, you know, hey, these are the things that you can do and we can rinse and repeat and make this very efficient.

[00:20:38] I think that's kind of how we're looking at this AI space, you know, initially. You know, again, what all this looks like in 18 months to be determined. This stuff is moving so quickly and, you know, obviously the economics behind AI with regard to frontier models or, you know, are we going to look at doing, you know, open claw or some type of model locally on trend? We'll see.

[00:21:06] You know, I don't think the, I think the economics are changing pretty quickly with regard to this. So, you know, again, I think we need to explore the space and, you know, present this as a business opportunity for our clients. But at the same time, this could be very, very fluid in the next, you know, two to three years is kind of how I would approach it.

[00:21:32] As we wrap up our time, we've got one last question that I kind of want to argue a little bit against the model. And I want to get your take on this. Like the conventional wisdom is to specialize. Pick one vertical, go deep, own it. You're running legal, financial, healthcare simultaneously. Three different compliance regimes, three different client cultures. Like make the case that vertical focus is overrated. You know, you can go down the SLI, you know, rabbit hole.

[00:22:01] And, you know, I don't think there's a one size fits all. Right. So, you know, I think it's a good best practice in a good North Star. But the reality is, you know, every business is going to be a little bit different. And I don't, I don't necessarily agree that you need to be vertical focused. Right. I mean, yes, I think we can do a great job with CPAs. I think we can do a great job with, with legal.

[00:22:26] I don't think that prohibits us from doing, you know, the healthcare clinic or some type of healthcare, you know, boutique that operates in a slightly different regulation. And the reason I say that is ultimately because we've built a flexible tool stack, right? So the reality is if we're going into a financial client, if we're going into a healthcare client, it doesn't necessarily matter, right? We have the same tooling.

[00:22:55] We have the same technology stack that's being applied to all of it. So there's no change from our perspective, right? We're not bending over backwards or we're not flexing ourselves to be something that we're not just to accommodate a different vertical.

[00:23:12] So we can operate with the same efficiency if it's a bakery, if it's a long haul trucker, if it's a CAD firm, if it's a law firm, if it's a finance firm. So there may be certain things that we turn on, such as Mirador, with regard to finance that we may not need to do for trucking. But the reality is the cost of all those tools have been factored into our monthly contracts.

[00:23:41] And it's essentially the same for all of it. Dave Bloom is the director of IT operations at Trumbull Tech, a people-powered MSP based in Charleston, South Carolina, serving small businesses in regulated verticals, legal, financial services, and healthcare. He brings roughly 20 years in IT, including running a 50-person global infrastructure team at Gardner, and in a prior MSP role, scaling a healthcare-focused practice from $4 million to $15 million in 18 months.

[00:24:08] Dave, if people are interested in reaching out and continuing the conversation, what's the best way for them to do so? Dave at Trumbull.tech. Want to go deeper than the news? The Small Biz Thoughts community is where MSP owners and operators work on the business, not just in it. Member meetings, a deep resource library, and courses through IT Service Provider University. Everything you need to run the practice you actually want.

[00:24:35] Join us at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode.

[00:25:06] Part of the MSP Radio Network.