Be chosen on proof
Every MSP promises security and great service, and buyers can't check either. This guide covers why that happens, what certificates do and don't show, and how MSPs use proof a buyer can open to win against cheaper quotes.
Buyers can't tell MSPs apart
"every man and his dog can do IT. ... So the differentiator, annoyingly, usually is cost."
Every MSP promises security and great service. A buyer has no way to check either. So when two proposals look the same, price decides, and the MSP doing the work properly loses to the one cutting corners.
How common it is
Across 210 MSPs we have spoken to, 101 said they can't tell themselves apart from the MSP down the road. 77 said they lose deals to whoever quotes cheapest. In their own words:
"We've no proof of what each one's capable of."
"everyone speaks a bit, but who's actually walking the walk"
"there's a massive thing around us losing out on deals to MSPs who are just racing to the bottom"
Why buyers can't tell
Most of what an MSP says about itself can't be checked by the person reading it. We looked at the claims on 2,776 UK MSP websites. Three in four can't be checked. The average site makes 19 claims, and fewer than 5 of them are things a buyer could verify. "Proactive" appears on 40% of the sites, "fast response times" on 19%, and "peace of mind" on 10%.
The homepages read the same too. Across 2,300 UK MSP homepages, 72% use at least one of the ten most common stock phrases.
A buyer facing that can only compare what they can see, and the easiest thing to see is the price.
Where certificates fit
Cyber Essentials, CE Plus and ISO 27001 help, and most Assurix customers hold at least one. But a certificate proves a process on the day of the audit. It doesn't show what has happened since, and it doesn't show the service a client actually gets. Often the incumbent you are trying to replace holds the same certificates.
What changes with Assurix
You hand a prospect a Trust Portal link instead of another promise.
- It shows 59 controls, 40 for security aligned to NCSC CAF 4.0 and 19 for how the MSP runs its service, each marked Pass or Fail.
- It stays current. Live-measured controls are checked every six hours from the tools you already run, and the rest on a set cycle.
- It explains itself. The "What is checked" page sets out every control in plain English, so a buyer who has never heard of Assurix can follow it.
- It can be taken away. If a failure isn't fixed within 30 days, the Trustmark is suspended publicly on the Trustmark Directory. That is why a buyer can believe it.
"None of my competitors basically can say that they're consistently compliant. And that's a unique selling point."
The Proof Gap
The Proof Gap is the distance between what an MSP promises and what it can prove. Most MSPs promise their clients are secure and well run. Very few can prove it. Four concepts explain why the gap exists.
| Concept | What it means | Say it like this | Check it landed |
|---|---|---|---|
| 1. There are no trust signals | Anyone can call themselves an MSP. Accountants, lawyers and IFAs have to meet a standard. MSPs don't, yet: the Cyber Security and Resilience Bill brings them into scope. | "Your accountant has to meet a standard before they can call themselves one. Your IT provider doesn't, and they have far more access to your business." | "If your insurer or a client asked how you vetted your IT supplier, what would you show them?" |
| 2. The evidence is broken | Certificates describe one moment, over a scope the provider chose. Controls can slip for most of the year and be pulled together before the audit. | "An MOT tells you the car was roadworthy on the day it was tested. It tells you nothing about this morning." | "When was your provider's certificate issued, and what did it cover?" |
| 3. Service is visible, security is invisible | Clients see tickets, the helpdesk and SLA reports. They can't see MFA, patching, backups or access controls. | "You'd know straight away if nobody answered the phone. You wouldn't know if patching had stopped four months ago." | "What could you check today, without having to ask them?" |
| 4. Your MSP is your most privileged user | The MSP holds admin access to email, devices, data and accounts. If its standards slip, the client inherits the weakness. | "Nobody in your business has more access than your MSP. Not even you." | "Who could reach your email, files and backups right now, and how would you know?" |
How to teach it
- Teach before you pitch. Explain the concept first. Mention yourself and Assurix last.
- One concept at a time. Pick the one that matches the buyer's pain. You rarely need all four.
- Borrow what they know. MOTs, food hygiene ratings, accountants. Let the analogy do the work.
- Let them say it. Ask the check question, then stop. Don't answer it for them.
- Include yourself. The concepts apply to you too. Saying so is what makes you credible, and without it concept 3 sounds like an attack on their current MSP.
Avoid scaremongering about fines or deadlines (the Bill is still in Parliament), rubbishing ISO 27001 or Cyber Essentials (they are a good foundation), and implying the buyer's current MSP is failing (you don't know that, and the point is that nobody can tell).
A real case for concept 3: a client moved MSPs, and the new one found patching hadn't been done for four months and the backups the client was paying for weren't working. Nothing had visibly broken, so nobody knew.
The principle to leave them with: you shouldn't have to take your IT provider's word for it. You should be able to check.
How MSPs use it in a sale
- Teach the Proof Gap first: pick the concept above that matches the buyer's pain, and let them reach the conclusion before you mention Assurix. The Proof Gap framework runs Frame, Teach, Discover, Prove, Price, and the next two steps are its Prove stage.
- Then show the Trust Portal, so the buyer has something to check rather than something to take on trust.
- Put the link in the proposal, so it is there when the buyer compares quotes.
"The rival had certificates too" and "A link, not a promise", below, show how this played out for Sereno and Little Big Tech.
What it means for you. The next time a prospect is choosing between you and a cheaper quote, they have evidence to weigh against the price, not just two sets of adjectives.
The rival had certificates too
"I'm not convinced it's going to help us in the marketplace above having ISO 27001, 9001, 14001, ... plus Cyber Essentials Plus."
Keep them. Most Assurix customers hold Cyber Essentials, CE Plus or ISO 27001, and many tenders still ask for them. Assurix builds on them rather than replacing them.
The question is what they prove to a buyer, and what they don't.
What a certificate shows, and what it doesn't
A certificate proves a date. It shows that a process was in place on the day of the audit. MSPs say it themselves:
"CyberEssentials is just a snapshot in time, isn't it? ... It shows you were compliant on the 3rd of March."
"it's just an audit on a day. So it just means on the particular day of audit, you passed."
It also doesn't cover the service a client actually gets: how fast tickets are answered, whether patching is done across every client, how satisfied clients are.
"They're not tracking our service desk, our tickets, our SLAs and all of that stuff."
| A certificate | The Assurix Trustmark | |
|---|---|---|
| What it proves | A process was in place on the day of the audit | The current status of 59 controls |
| How often it is checked | At each audit, usually once a year | Live-measured controls every six hours, the rest on a set cycle |
| What it covers | Security management (ISO 27001) or core technical controls (Cyber Essentials) | Security, plus how the service is run: 19 operational controls across legal and compliance, risk management, business continuity, customer management, service delivery (including SLA and CSAT) and continuous improvement |
| What a buyer sees | A certificate or a badge | A Trust Portal they can open and read, and a public Trustmark Directory listing showing current status |
| When something fails | Found at the next audit | 30 days to fix, then suspended publicly |
A certificate proves a date. Assurix proves today.
In Proof Gap terms, this is concept 2: the evidence is broken. A certificate describes one moment, over a scope the provider chose. With ISO 27001 the provider decides what gets audited, and basic Cyber Essentials is self-assessed. The way to explain it to a buyer: "An MOT tells you the car was roadworthy on the day it was tested. It tells you nothing about this morning." None of that makes the certificates worthless. They are a good foundation. They just can't answer the buyer's real question, which is what is true today.
When everyone holds the same certificates
The MSP you are up against often holds the same certificates you do, and so does the incumbent you are trying to replace. When every finalist has ISO 27001, ISO 27001 stops being the reason to choose. What the buyer can check today becomes the reason.
The proof. Sereno got down to the last two for a 70-user deal. The rival held ISO 27001 and SOC 2. Sereno won by walking the prospect through its Trust Portal.
What happens to the work you have already done
- It counts. Evidence from your ISO 27001 or Cyber Essentials work is reused in Assurix where they overlap, so you don't start again.
- Rosie reads it. In Launchpad, Rosie reads your existing policies, maps them to the controls and pre-fills what it can.
- One place. Your evidence, policies and documents sit together, so the next audit or questionnaire draws on the same source.
ISO 27001 holders typically need less time to reach the Trustmark, and Cyber Essentials helps.
What it means for you. Your certificates get you onto the shortlist. The Trust Portal is what tells a buyer why you, not the MSP next to you with the same badges.
A link, not a promise
"if I got to a customer and say, I'm Assurix, they're going to go, oh, the hell is Assurix?"
It is a fair worry. Assurix is a new name, and a badge nobody recognises can look like decoration. But buyers don't recognise the established names much either: only 17% of UK businesses are aware of Cyber Essentials, and 14% of micro businesses (Cyber Security Breaches Survey 2025/2026).
So your prospects don't need to know the Assurix name before they see the proof. Explain the Proof Gap first: the distance between what an MSP promises and what it can prove. Anyone can call themselves an MSP, certificates only show one day, and a client can't see whether patching, backups or admin access are being looked after. Once the buyer accepts that, they already know promises and certificates can't be checked. The Trust Portal then lands as the answer to that problem, not as one more badge. A logo asks a buyer to trust whoever issued it. A Trust Portal shows them the evidence and lets them judge it.
What the buyer actually sees
The Trust Portal is a link you share with a prospect, a client or anyone else, for example trust.uk.assurix.com/downforce-technologies. It shows:
- Every control and its result. 59 controls, 40 for security aligned to NCSC CAF 4.0 and 19 for how the service is run, each Pass or Fail.
- What each control means. The "What is checked" page explains every control in plain English, so a buyer with no technical background can follow it.
- The service, not just security. SLA, patching and CSAT (where a CSAT tool is connected), checked by Assurix rather than reported by you.
Why a buyer can believe it
- Live-measured controls are checked every six hours from the tools you already run, and the rest on a set cycle.
- An Assurix assessor, a person, signs off.
- If a failure isn't fixed within 30 days, the Trustmark is suspended publicly on the Trustmark Directory at assurix.com/directory. Anyone can check it without logging in, suspensions included.
When you show it, point at three things
- The live status. It shows the position now, not a certificate date.
- "They cannot change a single result." Read that line on the portal aloud. It answers "well, you would say that".
- 40/40 and 19/19 met. Every control has to be met. It is not a pass mark.
Then send the link after the call, with the questions to ask any other provider they are talking to.
That last point is what a badge can't do. A badge can't be taken away. This can.
Recognition you can borrow now
- Insurers. Partner insurers Hiscox, CFC and Beazley recognise the Trustmark. Holders get up to 25% off their own professional indemnity and cyber insurance, subject to underwriting.
- Other MSPs. 90+ MSPs have signed up to Assurix. The Trustmark Directory lists those that hold the Trustmark and those on the journey to becoming an Assurix Trusted MSP.
The proof. Little Big Tech's prospect was a 22-user pharma company that had been burned by its previous MSP. It had three other MSPs lined up and had never heard of Assurix. It chose Little Big Tech and signed the day after one meeting.
"One of the lowest friction sales processes we have ever had with a brand-new prospect."
How to use it in a sale. Explain the problem first: every provider makes the same promises, and the buyer can't check any of them. Then show the Trust Portal. The order matters. Shown first, it is a badge. Shown after the problem, it is the answer.
What it means for you. Recognition of the name builds over time. The link works now, because it explains itself.
"Nobody's asking us for proof"
"most people aren't asking us to prove stuff"
"the challenge for us to convince our customers about Assurix is a bit too big for us right now."
That's right. Clients rarely ask an MSP to prove its own security, and Assurix doesn't depend on them starting. You don't need to educate your clients about Assurix either.
Proof doesn't create demand. It does its work at moments that already happen in every MSP: when a prospect is choosing a provider, and when a client is deciding whether to stay.
Moment 1: winning against the incumbent
A business usually looks for a new MSP because something about its current one isn't working. At that point it is comparing providers who all make the same promises. A Trust Portal it can open is something a cheaper quote doesn't come with.
The reasons usually fall into eight groups. Each one maps to something Assurix holds you to, so you can ask about it and then show the control on your Trust Portal.
| What isn't working | Ask the prospect | What Assurix checks |
|---|---|---|
| Slow response | "Last time something urgent broke, how long before someone picked up?" | Escalation process, live response and resolution SLAs |
| Recurring issues | "Anything that has been broken, or half-broken, for a while?" | Recurring issue tracking |
| Poor communication | "When things go wrong, do you actually know who owns it?" | Service reporting, live client satisfaction, last 90 days |
| Reactive, not proactive | "When did they last call you with an idea, not a problem?" | Proactive ticket creation, alerting systems |
| No strategic advice | "When did they last talk to you about where the business is going?" | Business enablement, QBRs |
| Unexpected costs | "Any invoices in the last year that surprised you?" | Clear billing and invoices |
| Security or backup worry | "When did anyone last show you a successful restore test?" | Backups, vulnerability management, live critical patch compliance |
| Who has access | "Who at your provider can get into your systems, and how is that removed when they leave?" | Privileged user management, PSA, RMM and tools setup |
Live measures depend on the integrations you have connected, so check your own portal before you show it.
Moment 2: keeping clients at renewal
Service is visible. Security is invisible. A client notices a slow response, not stopped patching, missed backups or who has admin access. So the security work they pay for goes unseen, and at renewal a cheaper MSP looks the same.
"oh, I haven't called you for two months. So what am I paying for?"
"80% of the value of what a client gets from us is in the protection and the proactivity. And that's very hard to visualize."
This is concept 3 of the Proof Gap: service is visible, security is invisible. A real case shows why it matters. A client moved MSPs, and the new MSP found patching hadn't been done for four months and the backups the client was paying for weren't working. Nothing had visibly broken, so nobody knew. The question that makes a client see it: "What could you check today, without having to ask your provider?"
The Trust Portal shows that work: patching across all clients, SLA and CSAT (where a CSAT tool is connected), and your own security controls, checked by Assurix rather than reported by you.
Why checked by someone else matters: Labyrinth's own reporting showed patching at 95%. Assurix found the real figure was 47%, because of a setting in a vendor's policy, and worked with the vendor to fix it. As Labyrinth's Matthew Dunn put it: "If they never found any problems, they probably wouldn't be looking hard enough." A report you produce yourself is your word. A check by someone else is evidence.
"I think it'd be really good from a customer retention point of view."
Moment 3: when someone else does ask
Sometimes the question does come, just not from the client's IT contact:
- a security questionnaire from a client's insurer
- a questionnaire from a bigger customer of your client
- your own cyber insurance renewal form
Those answers come from the same evidence, held in one place.
What it means for you. You don't need clients to ask, and you don't need them to know the Assurix name. You need to be the provider that can show the evidence when the choice is being made: at the replacement bid and at renewal.
Does it pay back?
"spending the money isn't the issue. It's seeing the benefit of time. It is the return."
There are two different questions here, and they need different answers. One is "will it pay back?". The other is "can we afford it right now?". This section takes them in turn.
Will it pay back? Work it out on your numbers, not ours
We could quote you a return. It would be our number about your business. A better test is your own figures:
| Your number | Where to find it |
|---|---|
| A: monthly fee per seat | Your price list |
| B: seats in a typical new client | Your last three wins |
| C: your gross margin on managed services | Your accounts |
| D: deals you lose on price in a year | Your pipeline, or a best guess |
- A × B × 12 is the yearly revenue from one typical client.
- Multiply by C to get what that client is worth to you each year.
- Compare it with the yearly cost of Assurix for an MSP your size. We'll give you that figure on a call.
- Ask how many of your D deals the Trust Portal needs to win back to cover it.
For some MSPs one client covers it. For a smaller MSP with smaller clients it may take more than one. It is better to know that before you start than after.
What else goes on the same sum
- Clients you keep. A client who can see the security work they pay for is harder to move on price at renewal. See "Nobody's asking us for proof", above.
- Price you hold. If a buyer can check the difference, you don't have to match the cheaper quote to win.
- Time you stop spending. Audit preparation and questionnaires drawn from one place rather than rebuilt each time.
- Risk you take out. You watch every client's systems, but nobody checks yours, and one gap in your own tools can reach every client. Assurix puts the quick wins that cut the most risk first, then catches drift between audits, so every hour you put in takes risk out of the business. The downside is real: after a ransomware attack in November 2023, the MSP CTS was in administration by April 2024, and sold for £1,050,000.
- Your own insurance. Trustmark holders get up to 25% off their own professional indemnity and cyber insurance with Hiscox, CFC and Beazley, subject to underwriting. It applies to your own premiums, not your clients'.
The insurance saving is a supporting point, not the reason to buy. The case stands or falls on the deals you win and keep.
How MSPs frame their own price with it. The Proof Gap ends on price. With a buyer comparing quotes: "We are probably not the cheapest quote you have. We are the one that will prove, every day, that we are delivering what we promised." Then: "Ask the others to show you the same." That is the line that stops the cheaper quote deciding.
Can we afford it right now?
That is a cash question, not a value one, and a bigger return doesn't answer it. Two things can help:
- Monthly billing is available, so you don't pay the year up front.
- You set the pace of the work, from 2 hours a week, so the time cost is spread too.
What it means for you. Bring your four numbers to a call with us and we'll run the sum together. If it doesn't add up for you, you'll know, and so will we.