The Structural Problem
Your MSP might be great. Their advice still can't be.
This is not an attack on managed service providers. Good MSPs are worth every dollar for what they are: operators. The problem is structural, not personal: strategic advice from a party that profits from your spend is a sales channel wearing a consulting hat, no matter how honest the people are.
When your advisor profits from your spend, they are not your advisor. They are your vendor. The fix is not firing your MSP; it is separating the advice from the delivery, the way boards separate audit from management everywhere else.
Every risk finding is a sales opportunity
When the party assessing your security also sells the remediation, every gap found is revenue. That does not make the findings wrong; it makes them untestable. You cannot distinguish the real risks from the profitable ones.
The roadmap optimises for the seller
MSP-authored technology roadmaps reliably feature the products the MSP resells and the projects the MSP delivers. One client of our principals summarised years of supplier-shaped strategy: every initiative took two years and a million dollars.
Nobody benchmarks their own pricing
Your MSP will never open a renewal by tabling market data that shows you are overpaying. The information asymmetry is the margin. It closes only when someone independent brings the benchmark.
Performance is self-reported
The provider writes the report card on the provider. ACSC and AICD board guidance is explicit that assurance should come from independent testing, precisely because self-assessment structurally understates problems.
What separation looks like
Keep your MSP doing what they are good at. Add an independent layer for the questions money shouldn't answer: is the pricing market-rate, is the security real, does the roadmap serve the business. We sell no technology and take nothing from any provider, so our findings have no revenue behind them, including the finding that your MSP is good value. One of our principals' reviews concluded exactly that, and the board renewed with evidence instead of hope.
Good MSPs welcome this. It is the conflicted ones that resist it, which is itself information.
2x value identified, or you don't pay.
The 4-Week Commercial IT Health Check is fixed fee, non-disruptive, and guaranteed in writing: if we don't identify value worth at least twice our fee, we refund it.