The MSP Zone

Starting a managed service provider (MSP) business today requires a fresh mindset and strategic insights that many overlook. In this episode, Charles Weaver shares the essential frameworks and foundational principles you need to build a successful MSP from scratch. Whether you're a seasoned IT professional or just stepping into the managed services arena, this episode is your guide to navigating the complexities of the industry. Charles reflects on a recent conversation where a budding entrepreneur sought advice on launching an MSP without any technology or established customers. Drawing on his 25 years of experience, he outlines the key questions to ask before selecting your tech stack and the importance of defining your target customer profile. You’ll discover: The critical first steps to establish your MSP’s identity and market focus. Why understanding your ideal customer profile (ICP) can shape your services and technology choices. The three foundational pillars of a successful MSP practice, including certification, solid contracts, and appropriate insurance. Without these insights, launching an MSP can lead to costly mistakes and missed opportunities. Failing to ask the right questions at the outset could hinder your growth trajectory and impact service delivery. This episode not only equips you with the knowledge to avoid pitfalls but also empowers you to seize the moment in a rapidly evolving marketplace. Perfect for aspiring MSP founders and current tech professionals looking to pivot into managed services, this episode is packed with actionable advice and industry secrets. Tune in now to redefine your approach to starting an MSP and set the stage for long-term success.

AI is already inside your customers' environments, often before anyone decides who owns it or how it's controlled. In this episode of the MSP Zone, Charles Weaver talks with Ignacio Lopez, a former KPMG auditor, JP Morgan risk manager and Kaseya VSA manager. They cover where the MSP's role begins and ends. You’ll learn: Why the client owns the AI policy, while the MSP sets up, enforces and documents the controls Why "please don't hallucinate" is a request and not a control How to turn AI governance into a recurring service by starting small Why strong cyber hygiene has to come first Selling licenses is only the start. This episode shows what else you can offer.

Using the ConnectWise Cloud Backup shutdown as a case study, Charles Weaver examines a recurring issue for MSPs: they may be held accountable for risks in systems they do not directly control. He considers what this means for MSPs, vendors, and customers as security requirements and oversight continue to increase. The discussion focuses on how MSPs should respond when a supplier’s access is misused, why customers expect answers from the MSP, and how responsibility should be addressed when operational control is shared. The episode is relevant to MSPs that manage backup, EDR, password management, and other integrated services. It presents a framework for assessing vendor-related risk through questions such as: Where does risk begin when a supplier is compromised? Who is responsible when the MSP does not control the underlying system? When does operational efficiency create concentration risk? What information and support should vendors provide to MSP partners? How should contracts, liability, and evidence be managed across the service chain? Charles also outlines five tests MSPs can use to evaluate their technology stack: the control test, concentration test, substitutability test, contract test, and failure test. These tests help determine whether vendor relationships support resilience and clarify how an MSP would respond to a service failure. The episode also considers supplier access, industry consolidation, and the operational impact of relying on a limited number of platforms. It is intended for MSP owners, security leaders, and others responsible for managing customer risk and vendor relationships.

Most MSPs do not have a sales problem - they have a profitability problem. Charles Weaver lays out why growing top-line revenue can quietly destroy margin, and what to do before your business scales itself into a cliff. He breaks down the hidden cost of accepting more responsibility without charging for it, why modern clients now expect security, compliance, reporting, executive advice, and AI guidance, and how those demands reshape the real economics of managed services. If your pricing model still revolves around seats and devices, this conversation will challenge you to rethink what you're actually selling. You'll discover: Why revenue growth can mask rising delivery costs, service obligations, and risk How the client expectation gap turns every "small ask" into unpaid work Why security and compliance are not just tool markups, but ongoing services How AI creates a rare opportunity to reset pricing and redefine scope Why per-user pricing is only a starting point, not a real risk model Charles also explains why mature MSPs need to move toward risk-based pricing, how to quantify complexity and accountability, and why annual price reassessment is no longer optional. He makes the case that if a service creates liability, expertise, or ongoing support, it should be in your service catalog and priced accordingly. This is essential listening for MSP owners, operators, and leaders who want growth that actually improves the bottom line - not just the revenue chart. If you've ever wondered why a "great" client is quietly eroding profitability, this episode gives you the framework to find out.

MSPs are no longer just managing technology. They are well positioned to close the CISO gap for small and mid-sized businesses. The underlying problem is not a lack of tools, but a lack of security leadership. MSPs already have the trust, visibility, and operational context needed to help clients turn technical findings into business decisions. In this episode, Charles explains why many organizations remain exposed, why adding more products will not solve the problem, and how MSPs can define a practical security leadership role. You’ll learn: Why the CISO gap is a leadership problem, not a product problem How MSPs can translate technical exposure into business risk What a partial CISO operating model looks like in practice Why cyber insurance, compliance, and legal obligations all depend on the same leadership layer How to set boundaries, define authority, and protect both the MSP and the customer in writing Charles also explains the guardrails that matter: contract language, risk allocation, and the distinction between recommending corrective action and accepting a customer’s risk. Using examples such as cyber insurance questionnaires, MFA gaps, backups, encryption, and EDR, he shows how MSPs can frame security issues in terms business owners understand. MSPs that remain focused only on tickets and tools risk becoming less relevant while the client’s underlying exposure goes unresolved. Those that develop a credible security leadership capability become more valuable to every client they serve.