The Mega MSPs Are Coming
They’ll be fearsome competitors for smaller peers, but not unbeatable. Plus: SaaS Alerts thinks beyond Microsoft 365 and Pax8 adds payments to its budding IT management stack.
With 11 locations in four states, according to its website, The Purple Guys is a pretty big MSP. Ntiva, which has offices in 12 states and the District of Columbia, is even bigger.
So when Ntiva bought The Purple Guys a couple of months ago, the result was what John Holland, managing director of M&A advisory Corporate Finance Associates, calls a “mega MSP” with over 800 people serving more than 2,000 clients across the U.S.
More such giants with unprecedented scale and capacities will appear in the next few years, for reasons I’ll get into in a moment. First, though, some backstory:
Private equity firms lured by the appeal of high-margin MRR and zero percent interest rates have been snapping up MSPs in growing numbers for the better part of a decade now. Their buying became frenzied, though, in 2020 when the pandemic fueled surging demand for remote IT support.
“It was a land grab,” says Abraham Garver (pictured), managing director and MSP team leader at FOCUS Investment Banking.
Though interest rates are much higher lately, the frenzy’s ongoing. “Wherever these private equity executives get their training or go to seminars and learn about what’s hot today, they’ve all been brainwashed into going after MSPs,” Holland says. “Many of them, I think, have no idea what an MSP is. They just understand that there’s recurring revenues.”
Their enthusiasm has contributed to the rise of multi-MSP “platforms” with regional and national reach. Garver says there are about 100 such entities in the U.S. right now, including companies we’ve written about here like Evergreen Services Group and New Charter Technologies. Garver estimates the latter is doing about $170 million, but both are generating plenty of revenue.
“The numbers are exceptional,” he says. “Evergreen’s exceptional and New Charter’s exceptional.”
There’s plenty of variation, but PE firms typically hold acquisitions for four to five years. Which means a lot of the investors who got into the market in 2020 are going to be looking to exit soon. They’ll have no trouble finding buyers with deep pools of investment capital.
Very deep. Take, for example, The Riverside Company, which raised $1.872 billion a year ago. Factor in some debt, and you’re looking at a fund with more like $2.5 billion at its disposal. Investors typically make 10 purchases with a fund like that, each worth about 10% of the total. So theoretically speaking, Riverside’s looking for deals that make sense at about $250 million apiece.
Hard to find if you’re buying an MSP. Easier to find if you’re buying an MSP platform. Or better yet, rolling up several, like Ntiva and The Purple Guys. The land grab era of managed services, in other words, is drawing to a close.
“It’s now a platform grab,” Garver says.
One platform sure to be grabbed along the way is Logically, which Riverside has owned since 2018. Today, the company has about 350 people serving clients in 11 countries and all 50 states. In a year or two, when it raises a big new pile of money to drive the next step in its evolution, Logically will be significantly bigger, according to CEO Joshua Skeens.
“Logically 2.0 will probably be 3-5x the amount of employees that we have today,” he says.
It’ll operate in cities too small for a football franchise too. “You can walk around the streets of most NFL cities and bump into an MSP on every corner,” Skeens observes. “I would like to get into some geographies where we’re not densely populated but that are good and upcoming regions and localities.”
Skeens has more ambitious plans in mind than simply adding more customers in more places, though. “I believe there’s an opportunity in the market to become something different,” he says.
Skeens declined to get too deep into specifics for competitive reasons, but did volunteer an intriguing hint.
“Why couldn’t a platform MSP go buy an HR company, and now you could do shared services back into all these clients that still need HR?” he asks. “Why couldn’t you go buy a payroll company? These companies need payroll, so why couldn’t you provide shared services back from a payroll perspective?”
Competitive advantage
Food for thought if you’re not doing eight figures worth of EBITDA today, and aren’t part of a platform.
“The big will get bigger and the small will get smaller,” predicts Garver about the years ahead.
Holland isn’t quite as sure, but does see advantages for mega MSPs. “My observation of the really large private equity-backed MSPs is that they are incredibly efficient,” he says, thanks in part to the depth and quality of their leaders.
“They recruit very seasoned, experienced CEOs and heads of sales,” Holland says.
Not to mention heads of marketing. How many MSPs have a CMO, as Logically has since February, for example? And how many will have the resources to match Logically 2.0’s lead gen, advertising, and PR budget?
“We’ll have dollars to spend on marketing, brand power, brand management,” Skeens (pictured) observes.
The massive economies of scale mega MSPs enjoy, meanwhile, will help them charge less than smaller peers and still make money. “In theory, prices will go down,” and with them margins, Holland notes.
None of this spells doom for sub-mega MSPs, of course. As we reported just weeks ago, independent MSPs in the industry’s top quartile—not all of which are big—outperform MSPs from all four quartiles backed by private equity at present, and there’s every reason to think the same will be true going forward.
MSPs with vertical or subject matter expertise of some kind will be positioned for success too, as will those based outside the kind of second-tier cities Logically 2.0 plans to target. And there will always be SMBs who simply prefer doing business with IT providers small enough to drop by the office with a box of donuts now and again for no reason other than saying hello.
“Not every customer will be for you as a large player because you probably can’t do that at scale,” Skeens observes.
No need to act hastily if you’re an MSP who would rather sell to a large player than compete with them either. “It’s a great time for the owner of an MSP to sell the business,” Holland says. “It’ll be a great time next year too.” Assuming you’re not eager for an exit right away, waiting a bit makes perfect sense.
“What a great investment of time and effort, because the valuation of that business will just keep growing as the owner secures a better book of business, secures more accounts that have recurring revenues, builds up the team, and cranks up that adjusted EBITDA,” Holland says.
SaaS Alerts goes Workspace and beyond
SaaS Alerts, as I’ve written in this space a few times before, is a pure-play cloud security vendor. There are others, but fewer than you’d think given that global spending will rise 14% this year (versus 8% for IT overall), according to Gartner, and that cloud security is now the top security spending category, according to new research from Thales.
That SaaS Alerts has just added support for Google Workspace to Respond, the automated remediation part of its platform, is less surprising given that a) the productivity suite has over 3 billion global users, b) SaaS Alerts logged over 360 million events in Workspace, including 4 million critical alerts, in 2023 and, c) a large and growing portion of MSPs have at least a little Workspace in the environments they support.
“We’re definitely seeing more and more Google Workspace out there, and MSPs that are trying to service it,” says SaaS Alerts CEO Jim Lippie (pictured).
Like the original Microsoft 365 version of the system, Respond for Google Workspace lets users define rules for taking automatic action under pre-defined conditions, such as a successful login from an unapproved location. Microsoft Respond veterans can reuse existing rules versus start from scratch if they want or tap into a library of templates.
Thing is, though, M365 and Workspace only scratch the surface of what SMBs are doing with SaaS. Indeed, the average SMB uses 217 SaaS applications, according to Productiv’s 2024 State of SaaS Growth report. According to Lippie, very few of them are rigorously secured at present.
“We believe that this is the next frontier,” he says. “There’s no more on-prem servers to monitor and manage. It’s all about the applications and it’s all about protecting the users and the data around those applications.”
As a result, SaaS Alerts, which already monitors 17 apps, plans to add a lot more to the list starting soon.
“In the third and fourth quarter, you’re going to see actually a big pickup in the additional applications that we are monitoring on behalf of our MSP partners,” Lippie says.
The upshot for those partners won’t just be safer end users, he continues, but more MRR and profit. SaaS Alerts charges per user rather than per application, so MSPs pay the same monthly sum no matter how many apps they monitor. Say they offer to secure Salesforce and Slack on top of Microsoft 365 and Workspace for their clients, at $200 monthly each.
“That’s an incremental $400 a month the MSP can generate without any incremental cost to them,” Lippie says. “We see this as a massive opportunity.”
The trick is getting MSPs to recognize it. Most appreciate the importance of securing a customer’s productivity suites, Lippie says. “I don’t believe that MSPs have thought further down the line in terms of other applications.”
Fixing that, through outreach and evangelism, will presumably be as big a priority for SaaS Alerts in the second half of the year as adding integrations with cloud apps.
When You Think AI, Think Storage
I’ve got a post about AI’s implications for infrastructure spending coming in a few weeks. In the meantime, enjoy the interview in this week’s edition of the podcast I co-host about AI’s storage implications specifically.
Two follow-ups on recent posts
1. Remember that IT management stack I recently said Pax8 is building and seems likely to integrate? It got another key component this week. FlexPoint, a payments platform for MSPs akin to Kaseya’s ConnectBooster unit, is the newest member of the Pax8 ecosystem. Ingram Micro bought a PSA vendor, Harmony Business Systems, three years ago to add PSA functionality to its cloud platform. Pax8 just might be assembling a more comprehensive set of business tools for MSPs without actually buying anyone.
2. Sometimes my timing is good. Other times less so. I wrote at length about the cyberinsurance landscape in last Friday’s post. Three business days later, Sophos published an extensive research study on the topic. Two highlights:
Per my post, stricter underwriting standards have SMBs belatedly deploying security solutions they should have put in place years ago. 97% of insured businesses surveyed by Sophos, in fact, invested in security over the last year specifically for insurance-related reasons. 76% say that spending helped them qualify for coverage, 67% say it got them better pricing, and 30% say it got them better terms.
An all-but-unanimous 99% of insured businesses that filed a claim in the last year following a ransomware incident say the payout failed to cover all of their recovery costs, perhaps because average recovery costs have soared 50% to $2.73 million.
Had enough security, AI, and M&A coverage?
Let me know what other topics you’d like me to discuss! I’m open to suggestion at rich@channelholic.com.
Also worth noting
Looks like the PC market turnaround that OEMs and distributors have been promising for a while has finally arrived, especially in SMB, according to Canalys.
Auvik has a new president and chief sales officer.
NinjaOne has introduced a global partner program.
Leveraging technology acquired with CyGlass last year, WatchGuard has added network detection and response to its ThreatSync+ family.
Bitdefender’s portfolio for MSPs is now available at pay-as-you-go rates via Arrow Electronics.
Keeper Security has added remote browser isolation to Keeper Connection Manager.
Adlumin’s ransomware security solution now guards against exfiltration as well as encryption.
High Wire Networks is going all-in on managed security.
Zyxel has a new all-in-one router for small businesses and teleworkers.