Operational Maturity vs. Service Uniformity: Insights from Joshua Liberman’s Transition

[00:00:00] Today's guest spent three decades building one of New Mexico's most respected IT service providers, navigating every technology shift along the way, and recently completed a sale to a family-owned acquirer while staying on to manage the transition. You'll hear what that experience reveals about MSP valuation and what the next wave of consolidation means. This is the Business of Tech.

[00:00:24] Joshua Liberman Liberman, you are the founder of NetSciences, now sold to QualIT and a veteran of three decades in MSP cybersecurity. Welcome to the Business of Tech. Dave Sobel, CEO, Business of Tech Thanks, Dave. It's good to be here.

[00:00:36] Well, I'm excited to talk to you. You founded NetSciences in 1996 and you ran it for 30 years before selling to QualIT in late 2025, so just last year. Take a quick moment, like what is three decades of building an MSP teach you about what matters in this business and what turned out to just be noise?

[00:00:56] Well, I actually founded it in 95, but we didn't really close a deal until 96, first day of 96, so I'm going to go with 96. What I learned is probably three things. We're not selling anything beyond trust. Everything else follows. The next thing I learned, probably in that correct chronological order, is that people are buying outcomes. They need a quarter-inch hole. They don't care how you drill it.

[00:01:26] And the last thing I learned, unfortunately, in that correct chronological order, was operational maturity is everything. And every time you hit the wall, whether it was years and years ago about running antivirus on your endpoints, or later when we started to argue over things like MFA, or even after that for us anyway, local admin, none of that is the thing you think it is.

[00:01:53] It's always operational maturity. They don't get what they don't understand, and if they won't make the effort to develop that understanding, you have a much harder road ahead. I'm sure the other thing that changed is your definition of success. And you talk about maturity there. You clearly, all organizations mature. You thought a lot about that. How did success as a definition change as the company matured?

[00:02:20] Well, at first, it never occurred to me that I wouldn't be doing all or most of the work, of course, like many sole practitioners. As I accumulated staff, I still had the attitude that I was the chief fill-in-the-blank. I had to do everything. And over time, I realized that success was finding a way that the business could run without me.

[00:02:44] I did get there, for sure. But what I didn't do, the last phase, was building a business capable of growing without me. Now, you brought up outcomes. I love talking about business outcomes. And one of the things you've been really vocal about is that cybersecurity needs to be treated as a business outcome and not just a technical checklist.

[00:03:05] I think it's an interesting reframe, and security is tough because that's one of those areas where it's often positioned as a risk management discussion versus a business outcome. Talk to me about how you reframe it into a business outcome conversation when you're talking to clients. Well, years ago, I used to answer the question, how are you going to save us money? Because that did come up a lot with SMBs. And I told them that that actually wasn't my focus.

[00:03:33] My focus was to save their future, was to make sure that their business succeeded and improved. But first, make sure it exists. And it was hard to get people to understand what that risk was. And as I moved away from using FUD or fear, uncertainty, and doubt to market, I realized that the next step forward was to explain to them that that security is your framework. That's what the frame you build your home on.

[00:04:02] Everything you do requires that to be there. It's the skeleton of your entire existence. And it has to be treated. You have to see everything through that lens. So every time you see the next new whiz-bang thing, or you hire the next employee, or you look into the next relationship, you need to realize that there is a very important underpinning and securities involved in every decision you make.

[00:04:27] Right down to the copier service people you use, the phone systems you integrate with, and who manages your website. We'll be right back after this message. This episode is brought to you by ControlMap. Drawing MSPs are using ControlMap to build recurring revenue by expanding their GRC services. Starting now, ControlMap is offering a free plan for MSPs looking to get started with providing compliance as a service.

[00:04:55] Create a free account and run an assessment. Track key items like policies, risks, and evidence in one place. It's a practical way to prove value to a client before deciding to expand your compliance offering. Try ControlMap for free today. Visit scalepad.com slash Dave to get started. That's scalepad.com slash Dave. And we're back.

[00:05:22] One of the things that I always thought was really interesting about NetSciences was in an industry that's totally obsessed with monthly recurring revenue as the primary metric of that business health, you ran NetSciences at a 50% to 60% MRR for over a decade. And you did that intentionally. Give me the case for why chasing 80% MRR is absolutely nuts for most MSP providers.

[00:05:52] Well, for me, it came down to two things. For one thing, we started in 1996 selling hardware. Before that, for six years, I had a sideline business called PC Services. And our focus was selling hardware, integrating it into a network. And if you think back in 95, especially in New Mexico, there wasn't a lot of internet connectivity yet. So we were talking about on-prem, local, managed, but still securely first networks.

[00:06:20] So we were always interested in building systems, selling systems, desktop servers, portables, and integrating them. But on top of that, I realized for a long time that my way in the door for a lot of our businesses was placing a firewall when they first got on the internet or setting up remote access once that existed or resolving ongoing problems that weren't that tough. They were just configuration issues or hardware quality issues. All of those things led to selling hardware.

[00:06:50] But the second thing was we did a lot of project work because another foot in the door was to go in there and scope out what it would take to make a leap. And early on, it was getting on the internet. Later, it was moving some things into the cloud. Then it was remote work. Then it was fill in the blank. So I always liked the idea. For me, the idea was split 60-2020.

[00:07:13] We always wanted, from roughly 2010 on, I want it to be 60% MRR, 20% hardware, 20% project. And there were plenty of years where we hit those numbers. But we did finish up at a very high MRR number, but not because I was better at pushing MRR. It was because I backed off of new client acquisition.

[00:07:36] I had about a three-year sell-the-business experience, and I did slow down new client acquisition at that time. And that altered those numbers. And if I remember right, in 2025, we were crowding 80% MRR. In 2024, it was more like 70% and so forth. So it did get up there. But in my mind, that's more of an indication of slowing growth than it is of improved process.

[00:08:03] I didn't want to be an 80% or 90% MRR company, but it did develop that way over time.

[00:08:30] Well, I want to make a very important point. I was a long way from a titan industry. It took me two decades to see seven figures of revenue, and that was pretty much on peak. What I did was develop the best little boutique in New Mexico when it came to IT, and that was by being very selective about our clientele.

[00:08:55] It is much easier to grow when you're willing to, to borrow Carl's phrase, pick up every nickel. It is much easier to grow when you're willing to engage with folks, whether or not there is a personal or a business cultural alignment between you. As long as you're willing to work for anybody, you can grow, grow, grow. But then you also have the problems that that heterogeneity brings, and suddenly you're supporting three or four firewalls.

[00:09:25] You have people that aren't running the security stack you're supposed to be. They should all be running. And you're adding a tremendous risk. And I've always been a big fan of swimming, whether it's pools or oceans. But in my MSP, it's a pool. And risk is the pool. And I was really focused on making sure nobody peed in the pool. So that meant it kind of narrowed my choices. And that was what led to that. We'll be right back after this message.

[00:09:58] Are you and your clients tired of the time-consuming ticket tennis of coordinating meetings and help desk calls? Wouldn't it be better to automate this process with a tool that connects directly to ConnectWise Manage or Autotask? TimeZest offers scheduling automation that gives you complete control of your schedule and eliminates the hassle of calendar ping pong. As the only service designed specifically for MSPs, it integrates into your workflow

[00:10:25] and makes scheduling appointments easy on you and your clients. Plus, you can try TimeZest for free. Visit TimeZest.com slash MSPRadio and use the code MSPRadio to get 10% off your first year of TimeZest. And we're back. You made a specific set of choices about the kind of business you want to run and then went off and did that.

[00:10:53] Is that a fair kind of assessment of the way you thought about it? It is. When you said 80-20-20, it reminded me that, of course, everybody's heard of the Pareto principle and the 80-20 rule. And I remember initially thinking, well, I want to go 80-20-20, which was that 80-20 rule plus 20% profitability. Because at that point, my goals included making pretty good money, paying people really well with really good benefits and enjoying it.

[00:11:19] So getting to that 80-20-20, the 20% profitability, and that is, of course, bottom line, true EBITDA, you know, no ad backs, none of that junk, just true 80-20-20. That kind of forced me to make good decisions about how to mechanize, systematize, automate, homogenize our process, our services, and it's delivered. So it all rolled up really well.

[00:11:48] I mean, I don't think I could have hit 20% if I didn't have that homogeneity, if I didn't insist that everybody engage with the same minimum, which was a very high bar support stack. I used to have a T-shirt that said, you must be this tall to take the ride. Now, I'm only 5'7". It was a little ironic. But I did tell people who wanted to start whittling away, negotiating away their security posture with us. I always tell them, no, we don't do that. That's just not an option.

[00:12:16] But we did lose a lot of business over the years that way. Now, that interesting boutique set of choices also positions you in the way that I want to talk about our next topic. And I was thinking a lot about the MSP market and the M&A conversation that's been out there. There's private equity roll-ups. There's mid-market acquirers. There's family-owned operators like QualIT that are entering the space. You just went through the acquisition process. You had a plan to do that.

[00:12:42] What should MSP owners understand about the different kinds of buyers and what they're actually looking for out there in the market? Wow, that's a good question. So QualIT, to be clear, they're over 20 years in the business. This was their first significant acquisition. I believe they had done a little one-person, very small shop, and very little MRR process years ago. But they're not new.

[00:13:11] They are one of the three types that I see out there that are binding this piece. There's the peer acquisitions, I call it. That's where somebody your size or even a little smaller, frequently a little larger, maybe two or three times the size, comes along, and they wholly acquire. There's the roll-up where multiple larger, usually, players come together and form a larger organization. It's not a direct sale. It is a new integrated organization.

[00:13:37] I think that is probably the hardest thing to execute well, but very powerful if that happens. And then there's, of course, the PE acquisition. And PE is a little bit broader than some people think. I had met someone who was a sort of a buy-and-hold PE, and he was PE in the purest sense of the word because it was a family office.

[00:14:01] Somebody with a couple of billion dollars, they want to invest and grow that actually buys and holds and integrates companies. That didn't work out in my case, but that was a more interesting model. And if there was a good way to be involved in PE, that would have been the good way. But I never considered PE, and as a matter of fact, the first deal, quote-unquote, in early 23 that happened for me.

[00:14:27] It was a handshake at a meal with two other people who had, sorry, three others who had formed a roll-up that was 25 times. The size of my revenue was quite a leap, but they wanted me, and they wanted the business, and the numbers were good. And unfortunately, they were backed by private equity, and once they stepped in, the numbers changed.

[00:14:49] As a matter of fact, they fell by 67%, and I spent more than an hour in a miserable Zoom conversation with somebody trying to explain to me why that's what I wanted. So that wasn't good, and that was the closest I got to PE. Many PE firms reached out to me. Most of them I was able to deflect with a quick paragraph about our size. Because they were really interested in larger businesses. Some of them pursued me. Some of them I met.

[00:15:17] But until this peer thing started happening, I was in limbo. So when it did finally catch, I'll throw a little pitch for ASCII in here. In February of 24, sorry, 25, ASCII brought up their peer-to-peer sales. So you could actually sell the MSP to other ASCII members. And I had worked for about five years to lean on them to get that to happen.

[00:15:43] So it did happen, and it was very straightforward. I listed, and the first day I got six responses. In the next week, I got six more responses. And at that point, I had to call them and say, how do I shut this down? And they said, oh, I don't know if we thought about that. So they figured it out. But I knew 10 of those 12 responding people. I knew eight of them well enough to have their cell number. Talked seriously with six. Met four and received three offers.

[00:16:12] So that was all very good, and it was a very great, actually, experience. But it submitted in my mind the idea that I wanted to sell to a peer, a larger peer, because they didn't want it to be a tremendous risk for them, but a peer. And that's where I went. Gotcha. Now, what's interesting, I want to take some of the lessons you stayed on through this year to support the transition. What have you learned about how knowledge transfer works or doesn't when you're exiting a smaller MSP?

[00:16:44] This is a loaded question and a tough one to answer. Let me be careful. So I have learned that it is a significant challenge to let go of the reins. I did expect that, saw it coming, read books about it, talked to people about it, contemplated it, meditated upon it, even had a burden or two in its honor.

[00:17:09] So I did and have experienced those challenges. Mostly, it's been as good or better an experience than I'd hoped for. But what is challenging is I had hoped that they were going to adopt more of our methods and even tools. And I believed that that was the plan. I don't know. It's way too early to say what's going to shake out.

[00:17:35] But it does feel more like we're going to be them than they're going to be part of us. And that's how it is. I mean, that's fully within their purview. Ultimately, what matters, as we talked about before, are outcomes. I will say that they are every bit as dedicated to marketing and growth as I was not. So that alone bodes well.

[00:18:01] A lot of the peers in my industry that I've talked to since this, because I've been doing this victory lap tour this year, going around and talking with people about what this was like. One of the things that I can't say for sure is that they have focused really strongly on growth. Now, whether that's going to translate to growth in New Mexico as well as their home markets, which are Utah plus several other states, it's too early to tell.

[00:18:32] But the experience itself, it's been good. A lot of the people I talked to asked me, well, won't you feel bad if they grow this to twice the size? And I said, no, man. If you build a 2,400 square foot house, you have exactly what you want. And somebody buys it and they put a second floor on it and it's really nice. Did that make you feel bad? Yeah, I'm happy. They like the house and they made it better for them. I made it as good as I could for me.

[00:19:01] Well, and you brought up ASCII. You're a founding member of the NSITSP. You're a member of Small Biz Thoughts community. Like, give me a little sense. You're super active in a lot of these communities. What does real professional advocacy for IT service providers look like in your mind? And I would sort of say for the average MSP owner who's thinking about that, like, why is doing that important? Why does it matter? Well, I did a lot of it, right? I probably went overboard.

[00:19:29] I meet MSPs that have been to one or two shows in five or 10 years. And then there's me where I'm going to be to one or two shows every month for 20 years. I went a little overboard. I'm a member of ASCII, as you said, and all those other communities. And we skipped Tech Tribe and many others. I like the networking in the human sense of this. I like connecting people. I like learning from them, particularly like learning from others' mistakes. I've found it to be significantly less expensive than learning from my own.

[00:19:58] But I really do like sharing information, attitude, how we deal with stress, struggles, and all these things.

[00:20:07] So I think every time an organization, even including ASCII, advertises themselves, they forget the absolute superpower of these groups, whether they're peer groups or member groups like ASCII or online communities like yours, is that we learn from each other constantly. And I'm not asking how to secure a SharePoint site.

[00:20:35] We learn about much deeper, more powerful business concepts. And we learn from experience and, you know, from others' triumphs and failures. And that is so much more valuable than all the other little details that we share. And I guess you could say we're learning about outcomes, not tools. And that's so important. It's the coolest thing we can do.

[00:21:02] Now, the other thing I think is super interesting, you've been watching AI adoption from a really kind of unusual angle. You're a post-exit operator observing what your peers and community members and things like ASCII, Small Biz Thoughts, and Tech Tribe are doing. What's the gap between the AI story MSPs tell and what's actually happening at the delivery layer? Well, there's, once again, three big ones.

[00:21:29] Just the last thing I did last year was to try to meet with everyone or to meet with everyone and to ask them, how are you using AI? How is your staff using AI? And almost without exception, there were two or three exceptions. The answer was, no, we're not. We're not doing anything. We're not doing that. And some people had an opinion. Some didn't. But they all said, no, we're not doing that. Reality was, yes, they were. They just didn't know. And unfortunately, that's the worst case scenario.

[00:21:58] I hope I can get away with this analogy. But if you interviewed, you know, 100 parents of 16 to 17-year-old children and asked them if they're having sex, and they all said, no, absolutely not. I would wager that a lot of them were wrong. And that's a bad, risky position to be in. And to some extent, it's the same with the AI tools out there. That's one observation. People are using them, or their staff are, and they don't realize.

[00:22:25] The second is, they're using them just willy-nilly. They went out and they bought a set of snap-on, you know, metric tools and didn't even bother to check that they needed an SAE. They went out and they bought power tools, but they don't know how to use hand tools. They're just grasping at all these different shining objects, straw things, but they don't have a plan. And that's a lot about it.

[00:22:49] There's just a tremendous amount of analogy that can be made as to how we developed the computer revolution in the 80s and 90s, or the internet changes in the 90s and the audience, or the cloud in the audience and the teens. A lot of these businesses just knew it was cool and knew, so they started doing it, but there wasn't a plan. After they got over denying that anybody was doing it.

[00:23:13] But the final thing is, unfortunately, like so many other technologies, nuclear power comes to mind. The first use of this incredibly powerful technology has been weaponization. We did not have a nuclear power command before we had nuclear weapons. And unfortunately, the folks who best mastered the tool of AI and the power and the complexity and thus the planning and the,

[00:23:42] the, we're searching for a word, but the integration of all these capabilities are the people who've weaponized AI. It has become a phenomenal benefit to the bad actors out there. And unfortunately, we're behind. And my biggest takeaway from day one with AI is let's get out in front of it as a threat before we get completely behind it as an opportunity.

[00:24:12] Well, I think opportunity is exactly the right place to end this. So Josh, if people are interested in continuing the conversation, what's the best way for them to reach out? I still work at Joshua at Netsciences.com. That works just fine. I'm not comfortable sharing it. That's probably the easiest answer. Awesome. Well, I know people will reach out. Really appreciate you joining me today. Yeah, thanks, Dave. It was fun to be here. Want more from the Business of Tech?

[00:24:39] Join Business of Tech Plus for ad-free episodes, early interviews, extended cuts, subscriber-only shows, and exclusive member perks and analysis. Sign up at businessof.tech slash plus. And follow this show in your podcast app. And if you're on YouTube, hit subscribe and the bell so you never miss a story. Reviews and comments help spread the word too. Interested in advertising? Head to mspradio.com slash engage.

[00:25:08] The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Produced by Picture This Video. Part of the MSP Radio Network. I'll see you on the next episode. Take care. Bye.