The episode prioritizes the operational and exit-planning risks associated with MSPs lacking formal contracts. According to Amy , approximately half of MSP business owners operate without managed service agreements (MSAs), a decision that frequently results in reduced business valuation during sale negotiations. Both James and Amy emphasized that the absence of documented agreements is commonly flagged by buyers as a significant risk, often resulting in a devaluation of the acquired customer relationships. This exposes small and mid-sized providers to continuity risks, particularly where customer retention and service transferability are not contractually secured.

Further details outlined by Amy indicate that reluctance to implement contracts stems from concerns about client reactions, particularly in longstanding relationships. She observed that auto-renewal clauses and periodic, non-intrusive contract updates can streamline compliance and reduce friction. A personal account highlighted that, out of numerous customers, only one refused to sign an agreement, and this isolated case did not lead to client loss but necessitated risk pricing adjustments. James Kernan advised that contract clarity—covering terms, automated payments, and built-in annual price adjustments—should be positioned as a value to both parties, reinforcing operational stability and predictability.

Adjacent topics addressed contemporary service risks such as the proliferation of shadow AI applications and exposure to business email compromise. Amy reported discovering over 150 unmonitored AI-powered apps at client sites, emphasizing these as vectors for data exfiltration and compliance gaps. The Guards Cybersecurity Statistics report was cited, identifying business email compromise and social engineering as persistent attack methods, while underscoring that modern threat actors often bypass traditional privilege escalation in favor of capturing identity credentials and tokens. The operational focus for MSPs was advised to shift toward email, AI governance, and identity protection rather than legacy device vulnerabilities.

For MSPs and IT service providers, the main takeaways involve reassessment of contractual practices and a heightened approach to governance and risk management. Documented client agreements are necessary not only for valuation at exit but also for protection against operational disruptions and liability. Simultaneously, providers are urged to implement discovery and control mechanisms for AI use and to refresh security postures in line with current attack methods. The importance of establishing relationships with specialized advisors, attorneys, and alternative financing partners was also articulated, illustrating the multi-layered risk landscape that management teams must navigate for business resilience.

Show title: “How to Start a MSP”

1. How to Start a MSP- Resources: www.itspu.com

2.    New article from Third Tier: Taming Shadow IT before it tames you https://www.thirdtier.net/2026/06/21/taming-shadow-ai-before-it-tames-you/

3.    Guardz released a new cyber security statistics report: https://guardz.com/blog/security-awareness-statistics-msps-cant-ignore/

4.    Thoughts about whether an MSA is needed? Send them through the website: www.smbcommunitypodcast.com

5.    Anthropic Partner Program - https://www.anthropic.com/news/services-track-partner-hub

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.