Most independent MSPs get new clients two ways: a referral, or a list they bought and emailed. Both ignore timing. A bought list says a company exists and who runs it, and nothing about whether that company is near a decision.
Timing is most of the game in managed services. A business happy with its provider does not take the meeting; one whose provider just missed a migration date does.
Most of the events that push a company toward an IT decision leave a public trace. This page lists eighteen of those events, why each one predicts a provider decision, which public record each one lives in, what an MSP sells into it, and why each one is hard to catch by hand. An outbound system can watch for all of them across a whole territory.
A buying signal for managed IT services is a public event that shows a company is about to make a decision about who runs its technology. The event is not the purchase. It is the cause of the purchase. Common examples are an office move or renovation, a merger, a new operations or compliance leader, a firm crossing into a stricter regulator's jurisdiction, a new government contract with a cybersecurity clause, a first company-wide AI rollout, an email or security vendor change, a telltale job post, and an owner describing a technology problem on the record. Each of these creates work that an in-house person cannot absorb: cabling, migrations, security plans, policies, device management, and exam preparation. Signals of this kind are useful because they answer the timing question that referrals and purchased contact lists cannot. They tell a managed service provider which companies to contact this month, and why now, instead of which companies merely exist.
Group 1: What firms are doing with their systems
A firm changes something in its own technology, and the change creates the need for help. The systems-change signals page covers this group in more detail.
1. AI rollout
An AI rollout is a firm moving staff from personal AI accounts to a company account, and the rollout predicts an IT decision because single sign-on, retention settings, and an acceptable-use policy all need someone to build the setup. The switch shows up in job postings that name the platform, in vendor-published case studies, and in press mentions, none of which get read unless someone is looking for one firm.
2. Email or security vendor change
An email or security vendor change is a switch in a firm's published SPF, DKIM, DMARC, or MX records, and the switch predicts an IT decision because a migration or a provider change is already under way. Those records are the public entries that say who may send or filter a firm's mail, and nobody announces a change, so it is visible only to someone who checks.
3. IT project before launch
An IT project before launch is a client portal, remote-access system, or AI assistant that appears in public records before going live, and the project predicts an IT decision because the vendors are still being chosen. It shows up in press releases, job postings, permit filings, and procurement notices, all public and all scattered, while someone is still staffing and pricing it.
What an MSP sells into this group. An AI rollout buys a governed setup: single sign-on, retention settings that match the firm's record-keeping duties, a one-page acceptable-use policy, and a short staff training, usually as a fixed-scope project. A vendor change or a project before launch buys a migration or a build with a named owner and a date. The buyer for an AI rollout is the operations lead handed the project without a team, or the owner in a firm too small for that role. The buyer for a vendor change or a project before launch is the same operations lead, or the owner where that role does not exist. The fear is downtime in the first week.
Group 2: Filings and public records
Regulators, county offices, and government buyers publish records that describe a change before it is finished. The filings and public records page walks through each one.
4. Office move
An office move is a regulated firm changing the main office address on file with a regulator, and the move predicts an IT decision because cabling, network, firewall, and the security plan all get redone against a fixed date. The record is a business-address amendment with the state Secretary of State, and for a registered investment adviser a Form ADV amendment on the SEC's Investment Adviser Public Disclosure site, a register nobody browses without a reason.
5. Office build-out
An office build-out is a tenant filing a permit for an interior renovation, and the permit predicts an IT decision because the finished space needs cabling, a network, and a firewall that the general contractor will not supply. Permits are filed by address rather than company name, which makes them slow to connect to a prospect.
6. Breakaway firm
A breakaway firm is a group of professionals leaving an established firm to register a new one, and the registration predicts an IT decision because email, devices, documents, and security must be built from nothing within weeks. The registration is public the day it is filed, and it looks like every other new filing.
7. Firm arriving in a new state
A firm arriving in a new state is an out-of-state company filing to do business locally, and the filing predicts an IT decision when a real office opens, because the existing provider is hundreds of miles away. The ones opening a real office need local hands on day one, and sorting them from paper ones takes a second look.
8. Merger
A merger is two firms combining under one registration, and the announcement predicts an IT decision because two email systems and two document systems must become one by the closing date, and one incumbent provider usually loses. The record is the articles of merger filed with the Secretary of State, or an amended Form ADV for advisers; the press release reaches clients, not the MSPs nearby, and the IT decision is made early.
9. Crossing a regulatory line
Crossing a regulatory line is a firm growing past the size at which a stricter regulator with cybersecurity exams takes over, and the crossing predicts an IT decision because the new examiner asks for policies never written before. The crossing shows up in an amended Form ADV on the SEC's Investment Adviser Public Disclosure site, the same register as an office move. The SEC's examination priorities for fiscal year 2026 name controls for artificial intelligence, incident response, and Regulation S-P (the SEC's customer-data safeguards rule) as areas of focus. The amended rule also requires written policies for overseeing outside service providers, which includes the IT provider.
10. Tax-season security plan
A tax-season security plan is the written information security plan (WISP) that federal rules require of every paid tax preparer, and the annual renewal season predicts an IT decision because the requirement lands on the owner's desk before filing season. Many small preparers have a plan on paper and nobody to make it true.
11. Defense work
Defense work is a contract award carrying the DFARS cybersecurity clause, and the award predicts an IT decision because the winner must meet NIST SP 800-171 on the systems that hold covered defense information, often for the first time. Awards are public on SAM.gov and USAspending.gov but plentiful, and nobody sorts out the local first-time winners.
12. Clients about to need a provider
Clients about to need a provider are the customers of a small IT company that dissolves or is bought, and the filing predicts an IT decision because every one of those customers is about to be handed to someone new. The record is a Secretary of State dissolution filing or a published business-sale record. The client list is not public, so this one takes a second step to turn into names.
What an MSP sells into this group. Moves, build-outs, breakaways, arrivals, and mergers all buy a fixed-scope launch or integration project, then the managed contract. Regulatory lines, tax-season plans, and defense awards buy compliance work: written policies, a security plan an examiner can read, and the controls behind it. The buyer is the owner or managing partner for a move, the owner for a build-out, the founder for a breakaway, the regional lead or owner for an arrival, the managing partner for a merger, the compliance officer or owner for a regulatory line, the owner for a tax-season plan, and the owner or contracts lead for a defense award. Clients about to need a provider buy continuity, a takeover with no gap in service, and the buyer is each client's own owner. The fear is a missed date, a failed exam, or a customer left stranded.
Group 3: People and hiring
A new leader or a revealing job post says more about the next year than any field on a bought list. The people and hiring signals page goes deeper on both.
13. New COO or compliance officer in their first months
A new COO or compliance officer is a leader who inherits the IT vendor and the next exam, and the appointment predicts an IT decision because a new leader reviews every contract while change is still easy. Appointments show up on a firm's own press page, in local business journals, and on professional profiles, one at a time across hundreds of firms, so the ones in a territory slip past.
14. Telltale job posts
A telltale job post is a listing that shows one person carrying a firm's whole IT load, and the post predicts an IT decision because a firm hiring for that role is about to review what the outside provider does. A firm too small for an IT department but big enough to need one posts its only IT job, reposts it weeks later, or asks a new hire to run a device-management or AI-assistant rollout. A firm hiring someone to hold its outside IT vendors accountable means the current provider is about to be reviewed. Job posts expire fast, and reading them for these patterns is slow.
What an MSP sells into this group. A new COO or compliance officer buys a vendor review and the documentation the last provider never produced, usually as an assessment first. A telltale job post buys co-managed IT when the firm fills the role and full managed IT when the role stays open. The buyer for a new COO or compliance officer is that new leader, afraid of being blamed for the incumbent's gaps. The buyer for a telltale job post is the owner or hiring manager, afraid of the same gap surfacing before the hire lands.
Group 4: What owners say in public
These signals are the owner's own words, or the owner's silence, and they name the exact problem. The what owners say in public page covers how to use each one.
15. Owners on the record
An owner on the record is a managing partner describing a technology problem on a podcast or recorded webinar, and the recording predicts an IT decision because the problem is named, dated, and still open. Nobody indexes hour-long recordings, so the quote goes unheard.
16. Forums and social posts
A forum or social post is an owner or IT manager describing technology pain in the places peers talk shop, and the post predicts an IT decision because patience with the current provider is already gone. Most posts are anonymous, so this signal describes the problem more often than it names a firm. A named firm posting publicly goes to the top of the list. Reading those threads is slow.
17. AI mistakes in local courts
An AI mistake in a local court is a public ruling on fabricated AI citations in a filing, and the ruling predicts an IT decision because every other firm in that county now needs a governed AI setup. A governed setup means approved tools, retention rules, and a review step before anything is filed, the standard ABA Formal Opinion 512 sets for lawyers. Never name the lawyer involved. Rulings sit in dockets nobody reads for this purpose.
18. Silence on AI
Silence on AI is a regulated adviser disclosing no meaningful AI use while the SEC's examination priorities expect written AI policies, and the silence predicts an IT decision because the next exam will ask for what the firm cannot show. The disclosure is the Form ADV Part 2A brochure, and silence is the hardest signal to spot by hand, because the record is what is missing from it.
What an MSP sells into this group. A recorded complaint or a forum post buys whatever the owner named, and the first project is scoped to that one problem. A court ruling buys a governed AI setup for every firm in the county. Silence on AI buys exam readiness: policies, vendor reviews, and training records the firm can show. The buyer for a recorded complaint or a court ruling is the managing partner, for a forum post the owner, and for silence on AI the compliance officer. The fear is being the next ruling or the next exam finding.
All 18 signals at a glance
| Signal | What changes at the firm | What it needs | Service model | Who decides |
|---|---|---|---|---|
| AI rollout | Staff move to a company AI account | Single sign-on, retention settings, acceptable-use policy, training | Fixed-scope project, then managed | Operations lead |
| Email or security vendor change | Mail or filtering provider switches | A migration with a named owner and a date | Project, then managed | Operations lead or owner |
| IT project before launch | Portal, remote access or AI assistant announced early | A build with a plan and a date | Project | Operations lead |
| Office move | Main office address changes | Cabling, network, firewall, access control, security plan | Project, then managed | Owner or managing partner |
| Office build-out | Interior renovation permitted | Cabling, network and firewall before move-in | Project | Owner |
| Breakaway firm | New firm registered by departing professionals | Email, devices, documents and security from nothing | Launch package, then managed | Founder |
| Firm arriving in a new state | Out-of-state firm registers locally | Local hands for a new office | Managed or co-managed | Regional lead or owner |
| Merger | Two firms combine | Two email and two document systems become one | Integration project, then managed | Managing partner |
| Crossing a regulatory line | Firm moves to a stricter regulator | Written policies, controls, exam readiness | Compliance work, then managed | Compliance officer or owner |
| Tax-season security plan | Annual renewal restates the security-plan duty | A plan that is true, not only on paper | Compliance work | Owner |
| Defense work | New award carrying the DFARS clause | NIST SP 800-171 on the systems that hold covered data | Compliance project, then managed | Owner or contracts lead |
| Clients about to need a provider | Their IT company dissolves or is bought | Continuity, a takeover with no gap | Managed | Each client's owner |
| New COO or compliance officer | New leader inherits the vendor and the next exam | Vendor review and documentation | Assessment, then managed | The new leader |
| Telltale job posts | Firm hires for its only IT role or a rollout | A bench behind one person, or the whole function | Co-managed or full managed | Owner or hiring manager |
| Owners on the record | Managing partner names a problem in a recording | The one named problem, fixed | Scoped project | Managing partner |
| Forums and social posts | Owner or IT manager describes pain in public | The named problem, then a review | Scoped project | Owner |
| AI mistakes in local courts | A public ruling on fabricated citations | Governed AI setup for firms in that county | Project, then managed | Managing partner |
| Silence on AI | Adviser discloses no AI use while examiners ask | Policies, vendor reviews, training records | Compliance work | Compliance officer |
What to do with a signal
Nobody buys the day the event happens; the decision follows weeks later. A signal is a reason to start, not a promise of a reply tomorrow.
Follow up over weeks, not once. The decision lands weeks after the record appears, and the reason for reaching out stays the same the whole way.
Put signals on top of a list, not in place of one. The sharpest signals are low volume, so those accounts sit at the top of a list built to the MSP's ideal-client definition.
Treat the reply as the last filter. Only the person at the company can say a decision is real, so read the replies rather than counting them.
This is the model behind the outbound system SiteSmith builds for MSPs.
Questions owners ask
What is a buying signal for managed IT services?
A public event that shows a company is about to decide who runs its technology. The event is the cause of the purchase, not the purchase itself: a move, a merger, a new leader, a contract with a security clause, or an owner naming a problem out loud.
How far ahead of the decision do these signals show up?
Weeks to months. A move is filed before the boxes arrive, a merger is announced before the systems merge, and a job post runs before the hire. Follow-up runs over that whole window, not on the day the record appears.
Do I need a tool to watch for these?
Not for one company. Any one signal for one firm is an afternoon in public records. Watching every firm in a territory every week is a system, and that is where a tool or a service earns its place.
Which signals matter most for an MSP?
The ones tied to a fixed date and a named firm: mergers, moves, defense awards, and new leaders. An owner's own words are rarer and worth more per account, because the problem is already named.
Should signals replace my prospect list?
No. Signals sit on top of a list built to an ideal-client definition: size, industry, geography, and service model. An MSP that chases signals without that definition ends up pitching firms it cannot serve.
Are these signals legal and ethical to use?
Every signal here is a public record, a public filing, a public post, or a public recording. Nothing requires private data, and the message that follows should name the public event, not anything the firm did not choose to make public.
Terms used across these pages
- MSP. Managed service provider, an outside company that runs another company's IT for a monthly fee.
- SEC Division of Examinations. The arm of the Securities and Exchange Commission that inspects registered advisers and broker-dealers; its fiscal year 2026 priorities name AI controls, incident response, and customer-data safeguards.
- Regulation S-P. The SEC's customer-data safeguards rule; the 2024 amendments require written policies for overseeing service providers that handle customer information.
- DFARS 252.204-7012. The defense contracting clause that requires contractors to protect covered defense information and report cyber incidents.
- NIST SP 800-171. The federal security standard that DFARS 252.204-7012 points to.
- WISP. A written information security plan, which federal rules require of every paid tax preparer.
- ABA Formal Opinion 512. The American Bar Association's opinion on generative AI tools, which says firm managers must set clear policies on permissible use and train their people.
Where to go from here
Each group has its own page: systems-change signals, filings and public records, people and hiring signals, and what owners say in public. For sending, reply handling, and handoff, read how to build an MSP outbound system.
Sources and editorial note
SiteSmith publishes practical operating guidance and cites external sources for factual industry and security claims. This article is not legal, regulatory, or cybersecurity advice.
- Acquisition.gov, DFARS 252.204-7012
- SEC Division of Examinations, Fiscal Year 2026 Examination Priorities (PDF)
- SEC, Regulation S-P amendments, final rule (PDF)
- IRS, Protect Your Clients; Protect Yourself
- NIST, SP 800-171 Revision 3
- ABA Formal Opinion 512, Generative Artificial Intelligence Tools (PDF)