LA·IT·REVIEW
Home / Answers / What Are the Risks of Using an MSP?
Answer · 4 min · Updated Jul 2026

What Are the Risks of Using an MSP?

The main risks of using an MSP are vendor lock-in, weak offboarding, over-reliance on one provider, and the security of the MSP itself. Each one is manageable, but only if you screen for it before you sign.

For this guide we checked 21 Los Angeles and Pasadena IT firms against their own address and licensing records. That work surfaced a pattern worth flagging up front: the danger is rarely in the daily support. It shows up when the relationship ends, or when the provider you trusted turns out to be a weak link itself.

Here is the short version, then the detail on each.

The four risks at a glance

Risk What it looks like How to lower it
Vendor lock-in The provider owns your passwords, documentation, and tools. Leaving is slow and costly. Keep admin accounts and documentation in your name. Read the exit terms first.
Weak offboarding Access is not pulled cleanly when a staffer leaves or you switch firms. Get a written offboarding process and proof it runs.
Over-reliance One outside team holds all the knowledge. Nobody inside understands your systems. Keep one internal owner. Consider co-managed IT.
The MSP's own security The provider holds keys to everything you run. Their breach becomes your breach. Vet their security controls and confirm they are a real, reachable firm.

Risk 1: Vendor lock-in

Every provider takes over parts of your system to run it. The problem starts when they hold the keys in their own name instead of yours.

When you outsource IT, the firm sets up accounts, writes the documentation, and often buys your software licenses through its own portal. If all of that sits inside the provider's accounts, you cannot leave without rebuilding it. Some contracts add long terms or exit fees on top.

Lower it:

  • Keep admin credentials for your Microsoft 365, domain, and firewall in accounts you own.
  • Store documentation somewhere you can export at any time.
  • Have licenses billed to you where possible, not resold inside a bundle you cannot unpick.
  • Read the term length and cancellation clause before you sign, not after.

Risk 2: Weak offboarding

Offboarding is the clean exit. It matters twice: when one of your employees leaves, and when you leave the provider.

A weak process leaves old accounts active and knowledge undocumented. A former staffer who keeps email access, or an outgoing provider that still holds admin rights, is a live security hole. This is where a "cheap" provider gets expensive.

Lower it:

  • Ask exactly how they remove a departing employee's access, and how fast.
  • Ask what a provider switch looks like: what they hand back, and when their own access is cut off.
  • Get both answers in writing.

Risk 3: Over-reliance

If one outside firm handles everything and no one inside your company understands the setup, you have a single point of failure. An outage, a billing dispute, or a slow week at the provider becomes your problem with no fallback. Over-reliance also makes lock-in worse over time.

Lower it:

  • Name one person inside your company as the IT owner, even if they never touch the work.
  • Keep your own copy of key documentation and account lists.
  • Consider co-managed IT, where an internal person or team shares the load with the provider instead of handing it over whole.

Risk 4: The security of the MSP itself

This is the risk most buyers miss. To support you, the provider holds privileged access to every system you run. Attackers know this. Breaking into one MSP can expose all of its clients at once, so the provider's security is now part of yours.

There is a simpler version of the same problem: some firms that rank for local IT searches cannot even be verified. Across the 21 providers we checked, several that appeared for Los Angeles IT searches had no confirmable office in LA County. One was run from Houston and served "Pasadena, Texas." Another was registered in Cyprus. If you cannot confirm where a provider is, you cannot hold it accountable when something breaks.

Lower it:

  • Ask what security controls they run on their own tools: multi-factor login everywhere, logged admin access, and a tested backup of their own systems.
  • Ask which compliance standards they actually hold, and who audited them. Treat any standard with no named auditor as unproven.
  • Confirm they are a real firm with a street address you could drive to.

How to check for all four before you sign

The best defense is a careful selection process. Every risk above is easy to spot with the right questions and hard to fix once you have signed.

See how to choose a managed IT provider for the full question checklist, including the exit and security questions that surface these problems early.