"Show us your scorecard first" — what an honest MSP looks like from the inside

Here's a small test. Next time you're talking to an IT provider, ask them for their own security maturity score. Not yours. Theirs.

Watch the pause. That pause is the whole industry problem in one moment.

Most Managed Service Providers ask prospects to open up the whole environment — logins, network diagrams, backup configs, financial systems — and then sell security maturity back to that prospect without ever being asked to prove their own. It's an odd norm. If you're handing someone the keys to your entire business, "trust me" isn't a credential.

We do it the other way around. Before we ask you to share a single access token, we're happy to show you our own Essential Eight (soon Essentials) maturity score, our last backup restore-test result, and our incident-response tabletop notes. The plan is to publish this material openly, not hide behind an NDA.

Why this matters more than it sounds

An MSP's own security posture is the ceiling of yours. If they've got dormant admin accounts, unpatched laptops or a backup they've never actually restored, that becomes your problem the day they log into your environment.

We won't ask you to trust us. We'll ask you to check.

What we do about it

• We keep our own maturity assessment current and shareable — the same evidence pack we'd expect a client to produce.
• We test-restore our own backups on a schedule and log the result.
• We hand a prospective client the pack early, not late, and expect it to change the conversation. Usually it does.
• We treat "we can't share that" from other providers as a signal, not a policy.

There's a version of this industry where "trust me, we're the experts" is enough. It shouldn't be, and it isn't for us.