Insurance Is Not Just Protection It Is a Sign of MSP Maturity
After more than 30 years building and scaling MSPs, Nick and I have seen a consistent pattern. The businesses that grow well are not the ones that simply react faster or buy the latest tools. They are the ones that understand risk, communicate it clearly, and build mature operating disciplines around it. That is why insurance is far more than an annual admin task. It is a window into how well an MSP understands its own business, its clients, and the responsibilities that sit between the two. In this episode of MSP Mastery: Ctrl Alt Deliver, we sat down with Tim Stevenson from Sherpa Tech to unpack a topic many MSP owners avoid until something goes wrong. Insurance is rarely the most exciting conversation in an MSP, but it is one of the most revealing. Tim brought a practical perspective from the insurance side, and what stood out to us was how closely his observations aligned with what we have long seen in strong MSPs. Mature operators do not treat insurance as a tick box. They treat it as part of business design. What follows is not just a recap of Tim’s insights. It is our take on what this episode means for MSP owners who want to build businesses that are more profitable, more resilient, and far less exposed to nasty surprises.
MSP Mastery
5/17/20266 min read
Insurance Is Not Just Protection It Is a Sign of MSP Maturity
After more than 30 years building and scaling MSPs, Nick and I have seen a consistent pattern. The businesses that grow well are not the ones that simply react faster or buy the latest tools. They are the ones that understand risk, communicate it clearly, and build mature operating disciplines around it. That is why insurance is far more than an annual admin task. It is a window into how well an MSP understands its own business, its clients, and the responsibilities that sit between the two.
In this episode of MSP Mastery: Ctrl Alt Deliver, we sat down with Tim Stevenson from Sherpa Tech to unpack a topic many MSP owners avoid until something goes wrong. Insurance is rarely the most exciting conversation in an MSP, but it is one of the most revealing. Tim brought a practical perspective from the insurance side, and what stood out to us was how closely his observations aligned with what we have long seen in strong MSPs. Mature operators do not treat insurance as a tick box. They treat it as part of business design.
What follows is not just a recap of Tim’s insights. It is our take on what this episode means for MSP owners who want to build businesses that are more profitable, more resilient, and far less exposed to nasty surprises.
Risk visibility comes before insurance
Good MSPs know what could hurt the business most
One of the strongest themes in this episode was the idea that insurance should follow a clear understanding of risk, not replace it. That is a principle we strongly agree with. Too many MSPs buy policies without ever properly identifying where their real exposures sit. They assume that because they have cover in place, they have solved the problem. They have not.
Over the years, we have found that mature MSPs are very clear on their major risks. They know where client dependency sits. They understand their people risk. They know where poor process could create liability. They have thought about cyber exposure, vendor risk, and commercial exposure if a key service fails. That clarity changes the quality of every business decision.
Tim put this well when he described insurance as one mitigator among many. That is exactly right. Insurance is part of a broader discipline of risk management. If you do not know your big three business risks, your insurance program is likely built on guesswork.
This matters commercially as well. MSPs that understand their risk profile can have far better conversations with brokers, insurers, and clients. They are more likely to get the right cover, avoid gaps, and present as serious operators. That does not just reduce downside. It builds credibility.
The real lesson in cyber insurance is client responsibility
MSPs must stop letting clients confuse support with ownership
One of the most important points from this episode was the dangerous assumption some clients make that their MSP’s cyber insurance somehow protects them. We have both seen versions of this mindset before, and it is a warning sign of weak expectation setting.
An MSP can manage controls, deploy tools, monitor systems, and advise on best practice. None of that means the client has handed over ownership of risk. The client still owns its business. The client still owns its data. The client still owns the consequence of a staff member clicking a malicious link or failing to follow process.
Tim shared examples of clients believing they did not need their own cyber insurance because their MSP had cover. That is a red flag. It tells you the relationship boundaries are not clear enough. For us, this is where service maturity really shows up. Great MSPs do not just deliver support. They educate clients on the limits of that support. They explain where responsibility starts and stops. They make it visible during onboarding, in reviews, and in commercial discussions.
This is also where insurance becomes a sales and advisory tool. If a new client has poor controls and no cyber cover, that is not just an insurance issue. It is a business risk conversation. It opens the door for the MSP to explain what needs attention now, what can be improved over time, and what the client must own for itself. That is the kind of conversation trusted advisers have.
Liability gaps are usually created by poor scope and fuzzy language
When things go wrong the contract tells the story
If there is one lesson MSP owners need to take seriously, it is this. Liability gaps rarely appear out of nowhere. They are usually created much earlier through vague scope, weak documentation, and assumptions that were never tested.
Nick and I have spent decades helping MSPs tighten service delivery, and this is one of the most overlooked commercial disciplines in the business. If your agreements do not clearly define what you do, what you do not do, and where third party responsibility sits, you are leaving too much open to interpretation. When a major incident occurs, that is when interpretation becomes expensive.
Tim made the point that many claims follow the line of contract. That is exactly why legal protections and service clarity matter so much. If you resell or bundle a third party service, your client will usually come to you first if something fails. Whether that turns into a dispute, a claim, or a manageable issue often comes down to how clearly expectations were set in the first place.
This episode reinforced something we often tell MSP owners. Do not wait until a claim to discover what your commercial model really says. Review your scope. Review your terms. Review how your team explains client responsibility. These are not legal housekeeping tasks. They are core parts of delivering a mature and profitable service.
The hero moment was not the policy It was the response
Calm action protected both the client and the MSP
The strongest case study in this episode was the ransomware event involving co managed servers. An MSP owner called under pressure, worried about responsibility and exposure. What followed is where the real lesson sits.
Tim advised the MSP to trigger its cyber policy immediately, not because the MSP was definitely liable, but because speed matters in the first hours of an incident. That decision quickly clarified that the affected assets belonged to the client, which meant the client needed to trigger its own response. The client did not have cyber insurance, but the MSP was still able to help direct them to the right incident response support. The client got help. The MSP looked competent and composed. Most importantly, the MSP avoided taking on financial responsibility that was not theirs.
That is a textbook example of what strong leadership looks like under pressure. The win was not simply that insurance existed. The win was that someone knew how to use it quickly, calmly, and strategically.
For MSP owners, the lesson is simple. You do not rise to the occasion during an incident. You fall to the level of your preparation. That means knowing your broker, knowing your response path, understanding your policy position, and making sure your team knows what to do when something serious happens. Insurance is only useful if it can be activated intelligently.
The future of risk management is still about people
AI will increase speed but people still carry accountability
We also explored AI, supply chain exposure, and where risk is heading next. As expected, the technology is moving quickly. But the business lesson is not new. The strongest MSPs will still be the ones that keep a human in the loop.
That was one of the most practical insights from this episode. AI can draft, analyse, automate, and accelerate. What it cannot do is carry accountability on behalf of your business. Professional indemnity exposure still sits with the MSP when bad advice or perceived bad advice is given. If your team starts relying on AI output without judgement, review, and context, you are not becoming more efficient. You are becoming more exposed.
Tim’s point that cyber policies are generally adapting to AI related incidents, while professional indemnity wording may still be less clear, is especially important. MSP owners should take that as a prompt to review how AI is being used internally, where it touches client advice, and what that means for policy coverage.
This brings us back to a theme Nick and I return to often. The real differentiator in an MSP is not the toolset. It is the capability of the people using it. Invest in judgement. Invest in communication. Invest in process discipline. The businesses that do this well will be the ones that handle the next wave of risk without losing control of the client relationship.
Mature MSPs do not avoid insurance conversations
This episode confirmed something we have believed for a long time. Insurance is not a side issue for MSP owners. It is closely tied to service maturity, client communication, commercial clarity, and leadership under pressure. When an MSP understands risk properly, scopes services clearly, keeps clients accountable for their part, and prepares for incidents before they happen, insurance becomes far more than protection. It becomes part of a better run business.
Tim Stevenson’s examples gave us a real world lens on issues many MSPs face every day. But the deeper lesson is one Nick and I have seen across decades of growth, mistakes, and hard won experience. The MSPs that scale well are the ones that make risk visible early and deal with it directly.
If this episode has you thinking about where the gaps might sit in your own business, that is a good thing. Reflection is where maturity starts. If you want to unpack how these lessons apply to your MSP, connect with us at MSP Mastery: Ctrl Alt Deliver. Jeni, Nick, and the MSP Mastery team are always up for a practical conversation about building an MSP that works better for you, your team, and your clients.
