Signs Your IT Provider Has Stopped Paying Attention

Support tickets are not the same as IT management

An IT provider can appear busy while doing very little proactive work. Tickets get answered, passwords get reset and laptops get fixed, so there is no obvious failure. Meanwhile, patches are missed, documentation becomes outdated, security alerts accumulate and nobody can explain whether the environment is actually improving.

That distinction matters. A managed IT service should not be measured only by how quickly someone responds when a user reports a problem. The provider should also be paying attention to what is happening between incidents and dealing with issues before they become incidents.

This does not mean every MSP needs to recommend a project every month. Constantly selling new work is not the same as being proactive. The useful question is whether someone is actively operating the environment, reviewing its condition and taking sensible action when something needs attention.

The warning signs are usually operational

One of the clearest signs is repeated problems with no permanent fix. If the same printer, server, VPN connection or application keeps failing and the response is always to close the latest ticket, the provider may be treating symptoms rather than investigating the underlying cause.

Another sign is that nobody can give you a current picture of your environment. Your provider should know which systems are supported, which devices are approaching replacement, which servers need attention and which important services depend on particular infrastructure.

Watch for these patterns:

• Patching is reported but failed updates are not followed up.
• Backup alerts are generated but nobody investigates recurring failures.
• Old user accounts remain active without a clear reason.
• Security alerts are forwarded without meaningful investigation.
• Documentation describes systems that have already changed.
• Monitoring produces large numbers of alerts with little evidence of tuning.
• Recurring incidents are closed without identifying the underlying cause.
• You only hear from the provider when a ticket or invoice exists.

None of these proves that an MSP is doing a poor job. There can be legitimate explanations. The problem is when several of them persist without anyone taking ownership of the underlying issue.

A proper managed IT service should have an operating rhythm around monitoring, maintenance, security, documentation and review, not just a ticket queue.

Look at the security controls you already own

Most businesses already have security products. They may have Microsoft 365, endpoint protection, EDR, a firewall, MFA and backup software. Buying another security product is often easier than making sure the existing ones are properly configured and monitored.

That makes security operations a useful test of whether your provider is paying attention.

Ask when your endpoint security platform was last reviewed. Are all supported devices reporting? Are there unexplained exclusions? Are servers covered where appropriate? When an alert appears, who investigates it and what happens afterwards?

Do the same with identity. Review administrator accounts, MFA enforcement, inactive users and privileged access. If your organisation uses Microsoft Entra ID, someone should understand how authentication policies and access controls are configured rather than simply assuming that "MFA is enabled" means the identity environment is secure.

Backup is another obvious area. A green dashboard does not tell you whether the right systems are being protected or whether failed jobs are being resolved. Your data protection arrangements should have clear ownership for monitoring, retention and recovery testing.

The key issue is accountability. You should be able to ask what was checked, what was found and what was done about it.

What people get wrong about a disengaged MSP

The biggest mistake is assuming that a provider is proactive because it sends regular reports. A report can contain pages of information without demonstrating that anyone made useful decisions from it.

Another mistake is expecting an MSP to constantly make changes. Excessive change can be a sign of poor management too. A stable environment may not need major alterations, but it should still be monitored, patched, reviewed and documented.

Some businesses also judge providers entirely by ticket response time. Fast ticket handling is valuable, but it tells you little about whether the provider is managing the infrastructure properly. An MSP can close every ticket quickly while leaving an important security or reliability problem untouched.

There is also a tendency to blame the provider for every IT problem. That is not reasonable. Technology fails, vendors introduce bugs and business requirements change. A good provider will not prevent every problem. What you should expect is evidence that problems are investigated, risks are communicated and recurring issues are addressed.

Finally, do not confuse more meetings with better service. A monthly meeting filled with dashboards is not useful if nobody can explain which risks changed, what needs attention and who owns the next action.

Test the relationship with specific questions

You do not need to start by threatening to replace your MSP. A structured review can reveal whether the relationship is still working.

Ask for the current asset list and compare it with what actually exists. Then ask for outstanding patch issues, unsupported systems, recurring incidents and devices that have stopped reporting to management platforms.

Ask what security issues are currently open. Do not ask only for a list of alerts. Ask which ones require action, who owns them and what has already been done.

Ask about backups in practical terms. Which workloads are protected? Which jobs have failed recently? When was a restore last tested? Who is responsible for fixing a failed backup?

You can also ask your provider to identify the three biggest technical or security risks they currently see. A useful answer should be specific to your environment. It should not simply be a generic list of ransomware, phishing and outdated software.

If you want an independent view, a security assessment can examine the environment without relying entirely on the MSP's own reporting.

What to do in order

Start by reviewing the last several months of support activity. Look for recurring incidents, unresolved issues and problems that keep returning under different ticket numbers.

Next, ask for current infrastructure documentation and compare it with reality. Check devices, servers, network equipment, Microsoft 365 administration, backup systems and security platforms. Outdated documentation is often a useful indicator of whether anyone is maintaining the environment properly.

Then review the operational basics: patching, backups, endpoint protection, privileged access, monitoring and account management. Ask for evidence rather than accepting a general statement that everything is being managed.

After that, ask the provider to identify current risks and explain what is being done about them. Separate genuine remediation work from optional projects. You are looking for ownership, not a sales pipeline.

Finally, agree on what needs to improve and when it will be reviewed again. If the provider responds with specific actions, clear owners and useful evidence, the relationship may simply need better structure. If basic responsibilities remain unclear after repeated reviews, the problem is probably deeper than communication.