IT consulting and MSPs

The company shape

Managed service providers and boutique IT consulting firms serve a specific band: small and mid-market companies with 20 to 500 employees that either have no internal IT function or have a small team that needs augmentation. Typical firm shape: 12 to 90 employees, revenue between $2M and $25M, split between recurring monthly managed services (60% to 80% of revenue) and project work (implementations, migrations, security assessments, hardware refreshes). Gross margin on recurring services runs 40% to 55%; project margin runs 25% to 40%. The firm's economic health lives inside a single metric: monthly recurring revenue per technician.

The service stack has consolidated around a predictable set: managed endpoints (roughly $85 to $180 per seat per month depending on tier), Microsoft 365 administration, backup and disaster recovery, endpoint detection and response, patch management, help desk, and increasingly co-managed cybersecurity. Clients sign three-year agreements with a mid-term price adjustment clause. Client concentration risk is real: a firm with 40 clients and one that represents 22% of revenue is one lost renewal away from a bad quarter.

Delivery runs on a tiered structure. Tier 1 handles password resets, printer queues, and basic account issues. Tier 2 handles workstation deployment, application errors, and routine network troubleshooting. Tier 3 handles firewall configuration, cloud infrastructure, and escalated security incidents. A virtual CIO or account manager owns the strategic relationship with each client and runs quarterly business reviews. Firms without a real vCIO layer struggle to move up-market because the mid-market buyer expects a strategic conversation on top of the ticket resolution.

Above 50 technicians the firm looks different: a formal service delivery manager, a dedicated cybersecurity practice, a projects team separated from the managed services team, structured technical career ladders, and a NOC that runs on rotation. Below 20 technicians the firm runs on the founder's technical judgment, a shared PSA tool that everyone half-uses, and whatever process the operations manager has time to enforce. Regional consolidation is aggressive at the moment; private equity roll-ups have been buying $5M to $15M MSPs at 6x to 9x EBITDA for four years running, which changes competitive dynamics in most metros.

The buyer

The buyer for managed IT services depends on the client's size. At 20 to 100 employees, the buyer is the owner, the CFO, or an office manager who has inherited IT because nobody else volunteered. This buyer does not want to think about IT, wants a predictable monthly bill, and evaluates providers on responsiveness and business fluency more than on technical depth. Their pain is measured in downtime and in the hours their team wastes on tickets that should not exist.

At 100 to 500 employees, the buyer is usually an operations executive, a director of IT with a small internal team, or a CFO who has decided the IT function needs adult supervision. This buyer has a technology roadmap, an insurance carrier asking cybersecurity questions, and compliance obligations (SOC 2 for SaaS clients, HIPAA for healthcare, CMMC for defense contractors). This buyer evaluates providers on technical depth, on the vCIO's ability to translate technology into business terms, and on how the provider handles the client's specific compliance regime.

Buying committees are small but real. At the SMB end: owner plus office manager, occasionally an outside CPA. At the mid-market end: the operations executive or director of IT plus the CFO plus (increasingly) a general counsel who reviews the MSA and data processing terms. Insurance carriers have become a hidden third party. Cyber insurance underwriters now require specific controls (multi-factor authentication, endpoint detection and response, backup verification, incident response plan) and will decline coverage if the applicant cannot document them. The MSP that can produce those documents on demand becomes the incumbent renewal.

Discovery-phase buyers behave predictably. They start with three sources: a peer referral from another owner or CFO in their network, a Google search on "managed IT services [town]," and (for the mid-market end) a vendor short-list produced by their insurance broker or their compliance consultant. They evaluate three to five providers, request proposals from two to three, and select on a combination of vCIO fit, price, and gut trust in the sales conversation. The decision cycle runs 45 to 120 days depending on urgency.

Renewal buyers behave differently from acquisition buyers. Renewal is decided across three to six quarterly business reviews and the number of incidents in between. A renewal buyer with a strong QBR pattern and a manageable incident rate renews with almost no friction. A renewal buyer who has seen two significant incidents and a missed QBR is already talking to competitors before the renewal notice arrives. Retention lives inside the operational rhythm and the incident record.

Discovery landscape

MSP discovery in 2026 runs on four surfaces: Google local, peer referral, insurance broker or compliance consultant short-lists, and reputation platforms. The buyer starts on Google, verifies with a peer, and closes with a proposal cycle.

Google local dominates the top-of-funnel. "Managed IT services [town]," "IT support [town]," "cybersecurity for small business [town]" are the queries that produce inbound. The Local Pack, Google Business Profile, and the top three organic results together account for roughly 70% of clickthrough. Firms with weak local SEO fingerprints (no GBP category depth, sparse reviews, no location pages for the metros they actually serve) leak these queries to competitors and to national aggregators like Compare Camp and Clutch.

Peer referrals close at the highest rate. A local CPA firm calling to say "we use [MSP] and they are responsive and fair" converts around 60% of the time. Insurance brokers and cyber insurance underwriters generate a growing share of referrals as insurers formalize the vendor lists they trust. Compliance consultants (HIPAA compliance advisors, CMMC assessors, SOC 2 auditors) act as a second referral channel that reaches the mid-market end.

Reputation platforms carry more weight than most MSPs realize. Google reviews are the primary signal. Clutch and G2 Crowd matter for the mid-market end where the buyer expects vendor comparison research. Cyber insurance underwriter directories are opaque but real. The MSP that shows up on the underwriter's approved-vendor list has a structural advantage over one that does not.

AEO and GEO are early but rising. Owners and CFOs increasingly ask ChatGPT and Claude questions like "what should I look for in a managed IT provider," "what does managed IT cost for a 50-person company," "how do I evaluate MSP contracts." MSPs cited in those answers become known to the researching buyer before the search happens. Substantive content on the questions buyers actually ask, structured for AI answer engines, is the single largest content strategy opportunity in the vertical right now.

LinkedIn matters for the mid-market end and for the vCIO's personal authority. A vCIO who publishes on cybersecurity, cloud migration, or vendor management gets pulled into RFPs by name. LinkedIn does not drive high volume at the SMB end because owners at that size do not spend time researching IT on LinkedIn.

What does not drive meaningful inbound: paid search at scale, gated whitepapers, generic email nurture sequences, YouTube video content aimed at end-users, or industry conference sponsorships without a speaking slot. The buyer does not engage with these formats.

What breaks most often

1. The site sells to technicians instead of to buyers

The homepage lists SonicWall, Datto, ConnectWise, SentinelOne, and Microsoft 365 badges. The service pages describe endpoint detection and response, immutable backup, and zero-trust architecture. Meanwhile the buyer is an owner or CFO who does not know what any of those words mean and wants to know whether the phones will keep working. Rewriting the site in the buyer's language, with technical detail available underneath for the technical evaluator, lifts inbound conversion.

2. Weak local presence outside the primary metro

The firm serves five metros but the site has one location page. Google returns competitor firms in the other four metros because the firm has no local signals there. Building a real location page for each served metro (address if any, service area map, local case studies, local Google Business Profile, local reviews, local Q&A) unlocks organic inbound in the underserved markets.

3. Reviews live at 4.2 stars with 47 reviews and last activity six months ago

The firm has a strong reputation but no systematic review generation process. Meanwhile competitors have 4.9 stars with 180 reviews and a new review every week. Google's Local Pack algorithm rewards recency and volume. Systematic review requests at every quarterly business review, at ticket closure for positive interactions, and at project close-out fix the gap inside six months.

4. The vCIO layer does not exist or is invisible

The firm delivers competent ticket resolution and monthly reporting, but there is no strategic conversation happening with the mid-market client. The client feels like a support customer rather than a strategic partner and leaves at renewal. A real vCIO layer with quarterly business reviews, an annual technology roadmap, and a budget conversation retains mid-market clients through the pressures that would otherwise churn them.

5. Cybersecurity is a line item instead of a positioning

Insurance underwriters, compliance regimes, and buyer awareness have all shifted. The MSP that sells "managed IT" competes on price with 300 other providers. The MSP that positions as "cybersecurity-first managed IT" (with real EDR, MDR, tabletop exercises, insurance readiness, and an incident response retainer) competes in a smaller, higher-margin category. Repositioning the practice is a marketing project as much as a services project.

6. Client concentration risk hidden in a healthy P&L

The firm's largest client represents 22% of revenue. Renewal is 14 months away and the client just hired a new CFO. The firm's marketing budget is 1.1% of revenue because the pipeline feels healthy. Meanwhile the concentration risk is the single most important operational metric to manage, and marketing investment is the primary hedge. Concentration risk over 15% for any one client should trigger a defined pipeline development plan.

7. No case studies published

Real client wins happen every quarter (migration completed, ransomware event contained, compliance audit passed) and none of them make it onto the site. Meanwhile the buyer researching the firm has nothing substantive to read. Anonymized case studies (with client permission or with sufficient anonymization) built into a real content library close the trust gap for the researching buyer.

The Ranking Surfaces Playbook applied

The Playbook applies to MSPs and IT consulting firms with heavy weight on local, reputation, and answer-engine surfaces, and lower weight on the surfaces that produce big-brand awareness without local intent.

Tier one: the surfaces that produce recurring revenue this quarter

LSO is the flagship surface. Google Business Profile fully populated with categories, services, service areas, real photos of the team and office, quarterly Posts, active Q&A. One profile per served metro, each with its own address, service area, and photography. Systematic review generation across every account and every closed project. Local Pack ranking in the top three for the primary category queries in each served metro.

SEO for local commercial intent queries. "Managed IT services [town]," "IT support [town]," "cybersecurity for small business [town]," "HIPAA compliance IT [town]," "CMMC managed IT [town]." Each metro deserves a real location page with local content, local case studies, local FAQ, and internal linking to the service pages. Service pages written in buyer language, with technical detail available underneath for the technical evaluator.

AEO and GEO for the research queries. Long-form pieces on the questions owners and CFOs actually ask before engaging an MSP. Direct-answer TL;DRs, FAQPage schema, spec tables comparing service tiers or contract structures. Cited AI answers put the firm's name in front of the buyer during the research phase.

Tier two: the surfaces that compound

E-E-A-T through the vCIO layer. Named vCIOs with real bios, LinkedIn presence, published content, certifications displayed with linkable sources. The vCIO's authority is the trust signal the mid-market buyer needs.

Reputation platforms. Google, Clutch for the mid-market end, G2 Crowd for the software-heavy positioning, cyber insurance underwriter directories, and (increasingly) LinkedIn recommendations on the vCIOs and the firm principals.

Content library covering the buyer's whole lifecycle. Pre-engagement research pieces, comparison guides, contract structure explainers, incident response playbooks, and (once the relationship exists) quarterly business review templates and technology roadmap frameworks that the client can share internally.

Tier three: worth doing, lower ROI

CWV within reason. Mobile fast enough that a Google Local Pack tap opens the site cleanly.

VxSO minor but present. Real team photos, real office photos, ImageObject schema.

VSO low. Voice search for MSP services is minimal. Speakable schema on FAQ as AEO free-rider.

Tier four: not a fit

ASO, GLOBO, Web3. MSPs do not have consumer apps, do not compete internationally, and Web3 identity is not relevant. Skip.

KGO limited applicability. A regional MSP does not have Knowledge Panel notability. Focus on named vCIO and principal E-E-A-T instead.

AAO not yet meaningful. Deploy llms.txt v2 as first-mover; do not expect near-term revenue.

The combination that produces net-new MRR: local ranking across served metros, systematic review generation, buyer-language service pages, and long-form content structured for AI answer engines that positions the vCIO layer.

First 30 / 60 / 90 days

Days 1 to 30: audit and positioning

Full audit of the Google Business Profile for every served metro. Categories, services, service areas, photos, Posts, Q&A, review count, review recency, review response rate. Note the delta between the flagship metro and the underserved ones.

Review the site through buyer eyes. Homepage messaging, service pages, case studies, About page, contact form. Is the language buyer-facing or technician-facing. Are the served metros represented. Do the case studies prove the practice.

Reputation audit across Google, Clutch, G2 Crowd, LinkedIn recommendations, and cyber insurance underwriter directories where visible.

Client concentration and pipeline review. Which clients represent more than 10% of revenue. What is the renewal calendar for the top ten clients. What percentage of new MRR is coming from referral versus digital versus outbound. What is the target mix.

Deliverable at day 30: a positioning statement, a served-metro map with priority order, a review generation plan, a site rebuild scope, and a matter-source tracking system so the firm learns which surfaces are producing which inbound.

Days 31 to 60: local presence and content

Google Business Profile fully populated for every served metro. Categories corrected, services listed, service areas drawn, photos uploaded, Q&A pre-seeded, first Post published. Review generation live: every closed ticket with positive resolution, every quarterly business review, every project close-out includes a review request.

Location pages built for each served metro, with local content, local case studies where available, local FAQ, and internal linking to the service pages.

First three long-form content pieces published on the buyer-facing research queries. Each 2,500 to 4,000 words with direct-answer TL;DR and FAQPage schema. Named vCIO or principal attribution via Author schema.

Deliverable at day 60: GBP profiles current across all metros, review generation running, location pages live, three long-form pieces published.

Days 61 to 90: measure and iterate

Inbound source analysis. Which metros are producing which inbound. Which content pieces are attracting which buyer size. Which review requests are converting to actual reviews.

vCIO enablement. LinkedIn presence, headshots, bio rewrites, initial content plan for the vCIO layer. The vCIOs need to become named authorities.

Client renewal risk review. Which clients are approaching renewal in the next 12 months. Which ones show incident patterns that predict churn. Structured retention play on the high-risk accounts before the renewal notice arrives.

Deliverable at day 90: a working local presence across all served metros, a review generation engine that runs itself, published content authored by named vCIOs, a defensible retention posture on high-risk accounts, and a clear roadmap for months four through twelve.