Managed service providers (MSPs) are an integral part of the enterprise ecosystem, as they deliver several tangible benefits to customers. Beyond cost savings, these benefits include increased productivity through fast resolution of IT issues, and focus – meaning, the customer can focus on its core business objectives rather than managing its IT assets.
To illustrate the degree to which enterprises depend on MSPs, consider enterprises’ increasing investment in them: according to Statista, the overall IT outsourcing market – including the services MSPs manage for their customers – was valued at $378 billion in 2018, and is forecasted to reach $413 billion by 2021.
MSPs’ influence on enterprises is clear, but there is a notable potential downside to working with MSPs that many customers don’t discover until it’s too late: the phenomenon of the customer’s organizational intellectual property (IP) being “taken hostage” by the MSP once the contract is signed. And this is a slippery slope that could endanger the very future of the enterprise’s business.
A case of scattered IP
To protect its organizational IP, an enterprise needs to clearly understand where the IP sits and how it adds value. For most enterprises, IP consists of two types of asset: technical and knowledge. A technical asset is some kind of technology, such as legacy software – which is often dispersed across an enterprise in a disorganized fashion. A knowledge asset usually refers to an employee – but unfortunately, in many cases that employee is the only keeper of that knowledge, and oftentimes they’re further along in their career and may even be preparing for retirement. If and when that employee leaves, they take the invaluable IP with them.
As companies scale over time, they realize they need to inject fresh talent and modernize/manage their IT infrastructure, so they turn to MSPs for the latter.
Warning signs of an uneven customer/MSP relationship
It doesn’t take long for an enterprise customer to start receiving signals from its MSP that the enterprise’s IP has disappeared into a dreaded “black box.” The discovery is usually made once a customer requests that they take something back from the MSP to manage themselves, or the customer makes a change to their internal processes – and the requests are met with silence, delays, or pushback.
Within as little as a month post-engagement, the customer will start seeing these hints. After six to nine months, the customer will realize that the MSP isn’t adhering to the agreed-upon timeline, and after a year, it hits home that the customer is locked into a one-way “partnership” – where its IP is no longer under its control. Of course, by then it’s too late.
Avoiding the IP Hostage Scenario
While it may sound like enterprises are often thrust into an impossible situation with their MSP, the scenario is entirely avoidable – the customer just needs to know the questions to ask of their potential MSP during the evaluation process.
First, enterprises should understand the type of MSP they’re considering. For example, is the MSP a services provider that makes its money by selling more services, or is the MSP a product vendor that offers services? The distinction may seem subtle, but it’s significant – as it will dictate the entire customer/MSP relationship. At the outset, the enterprise should ask for a map to deployment (how will the MSP get started in supporting the enterprise and against what timeline), but also a map to reduce or stop engagement. MSPs may provide a clear view of how to get started, but if there is not an equally clear view for stopping service, that could be a warning sign.
Next, the customer should gain a full understanding of the MSP’s business model and product roadmap – because if those key elements don’t align with the customer’s business, the partnership will be fraught with friction. For example, some MSPs build their businesses via acquisition. Are the software tools/services they're offering easily unified, or do they require intensive custom-coding and configuring? If the MSP is planning to build, buy, or partner for more tools, how will they fit with existing platforms? Ultimately, will these new tools require more "servicing" to reap the benefits, or will they be seamless additions to a platform that the enterprise already has access to change?
Envisioning a harmonious enterprise/MSP partnership
The enterprise’s ideal scenario is identifying an MSP that can deliver the best of both worlds: assurance that the MSP is managing the customer's assets as intended while allowing the customer full flexibility to regain control over any of its assets. Considering enterprises’ dependence on MSPs, it’s natural for the enterprise to feel that they should make concessions to fit with their MSP. But the customer should never forget that they’re paying the MSP, not the reverse – and enterprises have every right to demand that their organizational IP remains theirs.
NetOps teams, like Spider Man, have great powers and great responsibilities. Increasingly, they are adopting a Zero Trust approach to network operations to help fight their battles.
Senior stakeholders who want to hold on to their CISOs must ensure that they have sufficient incentives and, more importantly, support to cope with the burden of risk that they are carrying.
The most alarming takeaway from Cisco’s new Cybersecurity Readiness Index report is that even after decades of having the importance of cybersecurity driven home, cyber threats are still taken too lightly.
