Managed services

A managed IT services provider is a third-party service provider that proactively monitors & manages a customer's server/network/system infrastructure, cybersecurity and end-user systems against a clearly defined Service Level Agreement (SLA).^[1] Small and medium-sized businesses (SMBs), nonprofits and government agencies hire MSPs to perform a defined set of day-to-day management services so they can focus on their core businesses with reduced risk of extended system downtime or service interruptions. These services may include network and infrastructure management, security and monitoring.^[1][2]

Most MSPs bill an upfront setup or transition fee and an ongoing flat or near-fixed monthly fee, which benefits clients by providing them with predictable IT support costs. Sometimes MSPs act as facilitators who manage and procure staffing services on behalf of the client. In such context, they may use a vendor management system (VMS) for transparency and efficiency. A managed service provider may also help a business create IT disaster recovery plans.^[3]

The managed service provider (MSP) model emerged in the 1990s alongside the rise of application service providers (ASPs), which pioneered the remote delivery and management of IT services.^[4] Initially focused on the remote monitoring and management of servers and networks, MSPs gradually expanded their offerings to include services such as mobile device management, managed security, remote firewall administration, security as a service (SECaaS), and managed print services.

The first books on the topic of managed services - Service Agreements for SMB Consultants: A Quick-Start Guide to Managed Services^[5] and The Guide to a Successful Managed Services Practice^[6] - were published in 2006 by Palachuk and Simpson, respectively. Since then, the managed services business model has gained ground among enterprise-level companies. As the value-added reseller (VAR) community evolved to a higher level of services, it adapted the managed service model and tailored it to SMB companies.

As the IT infrastructure components of many SMB and large corporations are migrating to the cloud,^[7] with MSPs (managed services providers) increasingly facing the challenge of cloud computing, a number of MSPs are providing in-house cloud services or acting as brokers with cloud services providers.^[8][9] A recent survey claims that a lack of knowledge and expertise in cloud computing rather than client's reluctance, appears to be the main obstacle to this transition.^[10][11]

The most common managed services revolve around IT: connectivity and bandwidth, network monitoring, security,^[12] virtualization, and disaster recovery.^[13] Application-specific managed services provide a fully managed runtime environment for a particular software platform rather than general-purpose IT infrastructure.^[14] WordPress.com is an example of this model, providing WordPress content management system as a managed service in which infrastructure operations, platform maintenance, and security are administered by the provider while users manage websites through the application layer.^[15]

Attackers have compromised MSPs and software used by MSPs as a form of supply chain attack.^[18] In October 2018, the U.S. National Cybersecurity and Communications Integration Center (NCCIC) warned the public that it knew of attackers, including advanced persistent threats, attempting to infiltrate the networks of MSPs as a way to conduct cyber espionage and intellectual property theft.^[19] NCCIC said that this type of attack, which dated to at least 2016, targeted MSPs because compromising them could allow attackers to access customer networks.^[19]

By 2019, attackers began targeting MSPs to spread ransomware because hacking into a MSP could allow them to install ransomware in many MSP client systems.^[20] Attackers found and exploited vulnerabilities in software used by MSPs, such as remote monitoring and management products.^[20] In the July 2021 Kaseya VSA ransomware attack, the REvil criminal organization exploited a vulnerability in Kaseya software to attack its MSP customers with ransomware and up 1,500 companies that were clients of the MSPs.^[21] In 2025, the DragonForce ransomware group attacked a MSP and used its remote monitoring and management platform to steal client data and encrypt client systems.^[22]

• Application service provider – Business providing software via the web
• Customer service – Provision of service to customers
• Enterprise architecture – Business function methodology
• Information technology outsourcing – Contracting internal tasks to an external organizationPages displaying short descriptions of redirect targets
• Managed service company – Company structure in the United Kingdom
• Managed private cloud – Aspect of cloud computing
• Remote monitoring and management – Management software
• Service (economics) – Activity for which payment is due
• Service provider – Organization that provides services to other organizations
• Service science, management and engineering – Term introduced by IBM
• Service level agreement – Official commitment between a service provider and a customer
• Technical support – Maintenance service of electronic consumers
• Web service – Service offered between electronic devices via the Internet