Silent Disqualification Risks Rise as UK Platforms and US Buyers Automate MSP Selection

[00:00:02] You're gonna have a quiet quarter at some point in the next 12 months, and you're gonna blame the market. There's a reasonable chance you were removed from consideration instead. And from where you're standing, those two look identical. This is the Business of Tech. I'm Dave Sobel. Three thresholds were written down in three different parts of the MSP business.

[00:00:26] Start with Channel Life, and start with a caveat because this one is a byline. Scott Fru, who founded and runs iAsset, a company that sells Channel lifecycle software, writes that Microsoft has cut its global distributor base from about 180 companies down to roughly 60. Two out of every three, gone. To stay in, a distributor now has to clear 30 million US dollars in cloud solution provider revenue over 12 months.

[00:00:56] In each region it's authorized for. A million if you're a direct bill partner. Fru calls what that leaves behind a lifecycle execution problem. With fewer parties in the middle and ownership shifting between them, tracking who owns which renewal and who is answerable for it gets harder for everyone downstream. Which is the diagnosis you would expect from a man whose product manages life cycles and the numbers are his. I could not confirm them anywhere else.

[00:01:25] Then, Managed Services Journal. Their reporting says regulated buyers are disqualifying managed service providers whose remote monitoring and management platform does not carry FIPS 140-3 validated cryptography. FIPS 140-3 is the US federal standard for validated cryptographic modules. It is not a claim a vendor makes but its own encryption. It's a certificate issued after testing. And a product either holds one or it doesn't.

[00:01:53] The publication is careful to say that having the validation does not, by itself, make a provider compliant with anything. The buyers are using its absence anyway to take providers out of consideration. And then, technology reseller out of the UK. A company called CompareIT has launched what it bills as the country's first AI-powered platform for comparing managed service providers.

[00:02:18] Businesses use it to search, compare and monitor more than 8,000 MSPs across up to 197 data points per provider. Giacom is behind it as a strategic supporter. And on the other side of the platform, CompareIT sells MSPs access to the leads it generates. 8,000 providers, 197 fields each. Three announcements. One of them sits in the supply chain, one sits in the tool stack, and one sits in a database in another country.

[00:02:47] In each case, somebody wrote down a number that separates the providers who qualify from the providers who don't, and then published it. Three parties who don't talk to each other, reaching for the same instrument in the same timeframe. It's not coincidence, and it isn't a conspiracy either. If you're listening to this and haven't hit follow yet, on Apple Podcasts, search Business of Tech. It takes five seconds, and you'll get the next episode automatically. Here's what I'm hearing from MSPs on backup.

[00:03:17] They want control. Control over storage. Control over costs. Control over what happens when something breaks. Comet Backup gives you that. Bring your own storage, white label it for your clients, and keep margins where they belong. With you. It's why Comet Backup keeps showing up when MSPs ask each other what actually works. See for yourself at CometBackup.com.

[00:03:43] A threshold is what a large party uses when it has too many small parties to talk to. That's the whole of it. And you can watch it work by following what happens to one of them after it gets set. Take the cryptography requirement. Kaseya is not arguing with it. In October, according to ITPro and ChannelPro, DattoRMM gets BIPS 140-3 validated cryptography and native Apple device management, and both arrive at no additional cost.

[00:04:11] Think about why a vendor gives that away. A platform whose partners are being disqualified by their buyers loses the partners. So the platform absorbs the requirement rather than letting anyone fail it. And once it's absorbed, clearing that bar costs a provider one account level setting. Which means clearing it distinguishes nobody. Only failing it does anything at all. A threshold never really gets negotiated. It gets absorbed.

[00:04:39] And absorption is what converts it from an advantage into a floor. Now the same logic running in the other direction, on the supply chain. CyberFox makes privileged access management, a password manager, and DNS filtering. All built for MSPs. This month it signed a North American distribution agreement with Ingram Micro. Putting those products on Ingram's platform in front of more than 165,000 channel partners and resellers. ChannelDive describes the deal as scaling beyond the MSP market.

[00:05:08] Look at the shape of that decision. Not recruit providers one at a time. Sign once with a party that already holds all of them. And the party holding them keeps getting thicker. TD Cynics, and this is TD Cynics describing its own platform, has expanded partner first with AI assistance, lifecycle analytics, quoting tools, and accounting integrations. Saying customers transacting regularly across its digital offerings are growing nearly 30% on average, outpacing the ones who aren't.

[00:05:39] That is the company's own number about its own product. But the direction is what matters. The middle layer is absorbing the tracking of renewal and ownership. So nobody decided to exclude anybody. A threshold is just what scale reaches for instead of a conversation. And every one of these is held by a party that got bigger by not having the conversation. And not one of those decisions produces a phone call.

[00:06:08] You do not lose these. You are never told. An industry has grown up around the fields that decide it. Two examples landed in the last week. Both companies announcing their own products, so take each for what it is. The first is a product called Scouts from a company called Rythmz, currently in open beta. What it sells in MSP is dated, outside-in evidence about a prospect's environment.

[00:06:32] Assembled before the first sales meeting, plus a read-only review of that prospect's Microsoft 365 tenant afterward. It lists at $279 a month. Self-announced launch, no independent coverage, so weigh the product accordingly. The price is the part that matters. Somebody can buy the outside-in view of your prospect for $279 a month. Somebody can buy the view of you for the same.

[00:06:59] The second is Cention and Spectra, who announced a partnership this month pairing Cention's automated endpoint hardening with Spectra's certification and warranty service. The two companies position it as a way for an MSP to prove its security controls to an insurer or a regulated buyer. Again, that is the two of them describing their own arrangement. But look at what is being sold. Not the hardening. The attestation.

[00:07:25] Proof of your own eligibility, purchasable from a third party because asserting it yourself no longer clears anything. That's a category now, with vendors and prices in it. Categories like that become somebody's job, or they stay nobody's. Not every light quarter is a disqualification. But a disqualification looks exactly like one, and that's the problem. The only way to tell them apart is to go check the fields yourself. So here's the choice.

[00:07:55] Give the fields an owner. One person who knows what tier you sit in with every distributor you buy through, which of your platforms carry which validations and when those expire, and what the public record returns about your business when a machine scores it. And who reruns that check every quarter the way a buyer would. Or leave it where it is right now, which is nowhere, and learn you were taken out of the market the only way a silent disqualification ever tells you.

[00:08:23] A quarter that came in light, with no losses in it to explain why. All of which you can go check on Monday, which is the part that makes it awkward. This episode is supported by Halo. There's a moment many MSPs eventually reach. The PSA they started with worked well early on, but as the business grows, workflows get harder to manage, automation becomes complicated, and the systems start shaping how the company operates.

[00:08:52] Halo PSA is designed for service providers who want more control over how their operations run, from ticketing and service delivery to billing and workflow automation. That's one reason Halo PSA often comes up when MSPs start evaluating their next PSA platform. You can learn more at usehalo.com Why do we care? Because the provider who wins the next regulated deal will not be the one who sold it better.

[00:09:21] It'll be the one who happened to be eligible when the list got cut, and eligibility is now checkable before anybody makes a call. The separator has moved in front of the pitch. Find out which list you're on and which list you've already fallen off of, and you will know exactly who you are still competing against. The provider who wins this doesn't win by being lucky. They win it because somebody in that shop made eligibility a deliberate thing. Once.

[00:09:49] And now they get shortlisted in rooms they never walked into. So what to consider? Ask your RMM vendor the certificate number, not the marketing sentence. There's a difference between a vendor saying it uses FIPS validated cryptography, a vendor handing you the certificate number for the cryptographic model inside the product run, findable on NIST's validated modules list, which stays active for five years, and a procurement offer knows which one they asked for. Get that in writing before October.

[00:10:18] Because once the requirement ships free inside the major platforms, being unable to produce a number stops being a gap and becomes the only signal left. Find out whether your distributor is one of the 60. Call whoever holds your cloud solution provider agreement and ask directly where they land after the cut and what revenue threshold now applies to your volume. This is a competitive question, not an administrative one. If your distributor is on the way out,

[00:10:46] the provider quoting against you next quarter gets continuity while you get a migration. And neither of you chose that. Go look yourself up. If you sell to buyers with UK exposure, search the comparison platform for your own business and read what comes back. Searching is free and takes no account, and providers get listed by claiming a profile. So finding nothing at all is also an answer. The useful part is not your score. It's the shape of the set you were ranked inside,

[00:11:13] because the providers listed beside you are who the buyer believes your competitors are, and that is frequently not who you believe they are. If this trend continues, by the middle of next year, the opening section of a regulated RFP will be a list of validation certificate numbers rather than an inscription of your service, and the short list will be assembled before anyone reads a word you wrote. This is the business of tech.

[00:11:42] What would you fix in your business with the right playbook? Small Biz Thoughts members get a library of templates and operational resources, recorded member calls, and classes through IT Service Provider University. Operational education built specifically for independent MSPs. Start at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage.

[00:12:10] The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode. Proud member of the MSP Radio Network.