How to Evaluate Sources for Managed IT Service Providers Research

This guide is for analysts, buyers, journalists, and MSP owners who need to size up a claim about the managed IT services market: a growth stat, a security warning, a "top provider" list, a compliance deadline. The managed service provider world runs on a mix of government reports, security agency advisories, market research firms, and vendor content that often looks like independent research but isn't. Knowing which is which saves you from repeating a vendor's sales pitch as fact.

How the MSP research beat actually works

Managed IT services sit at the intersection of a few different reporting traditions, and each has its own habits.

Government and regulatory bodies publish the most rigorous material, but it's infrequent. The UK's Competition and Markets Authority-adjacent work (Frontier Economics' 2025 study on the MSP market) had to build its own sector dataset because, as the report notes, there is no dedicated Standard Industrial Classification code for MSPs. That single fact tells you something important: official statistics on "how many MSPs exist" or "how big the market is" are almost always estimates built from proxy categories, not clean counts. Treat any precise-sounding market-size figure with that caveat in mind.

Security agencies are a second, distinct lane. The NSA and CISA's joint advisory on mitigating risks from MSPs in cloud environments is the kind of source you want to anchor a piece on vendor risk or supply-chain security. It's dated, attributed to named agencies, and scoped narrowly to cloud-reseller risk rather than the whole MSP market.

Market research aggregators (Scoop Market, Grand View Research, MarketsandMarkets, and similar) publish frequent stat roundups about MSP market size, growth rates, and regulatory trends like GDPR or the US cybersecurity executive order. These are useful for spotting trends fast, but they often repackage older primary studies, sometimes without saying so. Always try to trace the number back to its original report and publication date.

Then there's vendor and MSP-marketing content: blog posts from MSPs themselves (Ntiva, Corsica Technologies, New Charter Technologies, and hundreds of others) ranking "top providers" or listing "signs of excellence." These are sales content first. They can still be useful for understanding how MSPs position themselves and what services are considered standard (security operations, compliance, vCISO, disaster recovery), but a ranked list from a company selling the thing it's ranking is not independent evidence.

Trade associations (CompTIA, MSPAlliance) and channel trade press (ChannelE2E, MSSP Alert, Channel Futures) sit in between: closer to the industry than government, but with more editorial distance than a single vendor's blog.

How to evaluate a source before you cite it

1. Who published it, and do they sell what they're describing? A "best MSPs" list from an MSP, or a security product category ranking from a vendor in that category, is marketing. Read it for positioning insight, not as a neutral comparison.
2. Is the number traceable to a primary source? Market-size and growth-rate figures circulate widely with the original study stripped out. If a stat roundup doesn't name and date its source report, treat the figure as unverified.
3. Does the source define its terms? "MSP" itself is loosely defined; the UK market study had to construct its own taxonomy precisely because no standard classification exists. A source that doesn't define scope (does it include cloud resellers? staff augmentation? pure help-desk shops?) is hard to compare to anything else.
4. Is it dated and does the date matter? Security advisories and regulatory guidance (NSA/CISA cloud risk guidance, GDPR compliance requirements, executive orders) have real effective dates. An undated or vague "recent guidance" reference should be a red flag.
5. Does it disclose methodology? The UK government study's published methodology (four-stage approach, dataset construction, QA steps) is a model of what to look for. Market research firms vary widely in how much of this they disclose; some hide it behind paywalls entirely.
6. Is there a regulator or named agency behind safety and compliance claims? For cybersecurity and data-handling claims specifically, prioritize CISA, NSA, national data protection authorities, or insurance/compliance bodies over vendor blogs, even when the vendor content cites the right regulation by name.

A standing brief worth filing

If you track this beat regularly, a useful standing brief reads something like: "Each week, flag any new government or regulatory publication on managed service providers (UK CMA/Frontier Economics-style market studies, CISA/NSA advisories, EU/national data protection guidance), any market research update with a traceable primary source, and any notable MSP M&A or regulatory enforcement action, each with publisher, date, and one line on whether the source is independent or vendor-funded." A research tool or a standing weekly brief can run that filter for you so you're not re-litigating source quality every time a new stat shows up in your feed.