The Small Business Acquisition Newsletter
Managed IT Services (MSP): Buy Recurring Revenue Before the Platforms Do
A complete acquisition playbook — market sizing, valuation benchmarks, deal flow analysis, and 4 real listings evaluated for you this month.
Your product in front of active acquirers
Reach SMB buyers, searchers, and sponsors deep in research mode. Premium placement between editorial sections.
A Recession-Resistant Cash Machine Hiding in Plain Sight
The 30-Second Takeaway
The U.S. managed IT services market reaches $71.1B in 2026 (Mordor Intelligence) and is compounding at 10-11% annually through 2031 (MRFR; Mordor). What matters most for you: roughly 82% of MSP revenue is recurring (GITNUX). That is the closest thing Main Street has to SaaS economics. Buyers know it. 466 MSP deals closed in 2025, up 20% YoY (M&A Signal), and 69-72% of disclosed deals involved private equity (Omdia/Canalys). The multiple ladder is steep. Owner-operated shops trade at 3.0-5.5x SDE, while $15M+ EBITDA platforms fetch 11-14x EBITDA (Aventis; M&A Signal). That spread is your opportunity. Buy a sub-$1M EBITDA MSP and add managed security, which is growing 12-18% a year (Scalepad). Then add compliance services, which only 36% of MSPs offer (Integris). A business built that way can sell to a platform at double your entry multiple. The catch is talent scarcity, tech retention after close, and a credit-dependent valuation cycle.
The U.S. market is valued at $71.1B U.S. (Mordor, 2026), growing at 10.2-11.0% CAGR 2026-2031 (MRFR; Mordor).
What's Driving Growth Right Now
Cybersecurity & Compliance Urgency: Security is growing at 18% vs. 14% for the overall MSP market. 97% of $10M+ MSPs offer managed security (Scalepad; Integris).
SMB Outsourcing Is Now Default: 88% of SMBs and 92% of 1,000+ employee firms use at least one MSP (JumpCloud, 2026).
Hybrid & Multi-Cloud Complexity: 73% of organizations run hybrid cloud. MSPs are moving from migration work to cost optimization (Sherweb, 2026).
AI-Enhanced Service Delivery: 80%+ of MSPs now offer AI-enhanced security (XDR/SIEM). 92.5% call AI a key growth driver (Integris, 2026).
Margin Expansion via Recurring Mix: Average MSP profit margin rose to 18.5% from 15.2% in 2022 as MRR reached 82% of income (GITNUX; SLI).
What Buyers Are Actually Paying
Median owner's discretionary earnings: ~$400K (est.). Median sale prices have risen to ~$1.6M (est.).
| Revenue Band | Typical Multiple | Metric | Notes |
|---|---|---|---|
| <$2M rev / $250K-$1M EBITDA | 3.0x-5.5x | SDE | Owner-operated. SBA buyer territory (Iconic; YourExitValue) |
| $1M-$2M EBITDA | 5.0x-6.0x | EBITDA | Institutional buyers appear above $1M EBITDA (Aventis; ProCloser) |
| $2M-$5M EBITDA | 6.0x-8.0x | EBITDA | Bolt-ons into platforms reach a 9.0x median (M&A Signal, Q4 2025) |
| $5M-$15M EBITDA | 7.0x-10.0x | EBITDA | Platform candidates at $15-50M EV draw competitive bids (CTA) |
| $15M+ EBITDA | 11.0x-14.0x | EBITDA | Financial services verticals reach 12-15x (Aventis; M&A Signal) |
What Drives Premium Multiples
The Multiple Arbitrage Play
Buy a $2M-revenue company at 3x SDE (~$900K). Build it to $8M revenue through organic growth and tuck-in acquisitions. Sell at 6–8x EBITDA. That spread between buying multiples and selling multiples is where serious wealth creation happens.
Why Every Private Equity Firm Wants In
Global M&A activity hit 466 (2025) deals. PE add-on acquisitions surged +20%, with PE firms accounting for 69-72%.
| Platform | PE Sponsor | Acquisitions | Focus |
|---|---|---|---|
| Evergreen Services Group / Lyra | Alpine Investors | 47 in 2025; Lyra's 100th MSP deal June 2025 | Regional MSPs; keeps local brands and leaders; permanent capital |
| New Charter Technologies | Oval Partners | ~32 platform companies incl. ProTech IT (Jan 2025) | $15-50M EV platforms; founder equity rollover; $1B revenue goal by 2029 |
| Thrive | Berkshire Partners / Court Square | 26-27 since 2016; 2025 deals incl. Abacode, Worksighted | Cyber-led managed services and GRC; doubling down on M&A in 2026 |
| Dataprise | Trinity Hunt Partners | 10 total, 8 in past 2 years incl. phx-IT | Operationally mature MSPs; 90-day integration playbook |
| Integris | OMERS Private Equity | ~8-10 incl. Aldridge Technology (Jun 2025) | National SMB platform with 600+ staff; security integration |
| Coretelligent | Norwest Equity Partners | 7+ incl. SoundView IT | Security and compliance-led regional consolidation |
| Ascend Technologies | M/C Partners | 4+ incl. Edafio, Switchfast, Stratosphere | ERP consulting and managed services bundling |
| Ntiva | PSP Capital | Active; regional add-ons (count undisclosed) | Cloud and managed infrastructure; vertical specialization |
4 Listings We're Watching This Month
We scoured BizBuySell, BizQuest, and broker networks to find the most interesting businesses currently on the market. Here's our analysis of each, with a quick verdict.
The Numbers Behind Every Job
| Service Type | Avg. Ticket | Gross Margin | Frequency |
|---|---|---|---|
| Per-user managed services | $100-$175/user/mo | 50-60% GM (SLI) | Monthly |
| Managed security (MDR/SOC) | $25-$50/user/mo | 55-65% GM | Monthly |
| vCIO / compliance (GRC) | $1.5K-$5K/mo | 60-70% GM | Monthly/Quarterly |
| Projects (cloud migrations) | $10K-$75K | 30-40% GM | 1-3x per client/yr |
| Break-fix (T&M) | $150-$200/hr | 35-45% GM | Ad hoc |
| Hardware & license resale | $2K-$20K | 10-20% GM | Ad hoc |
Break-Even Analysis
Fixed costs: ~$600K/yr (admin, tools, rent) /year
Variable cost %: 45% (tech labor, licenses)
Break-even revenue: ~$1.09M
Revenue per truck to break even: ~$185K revenue per billable tech
Industry KPIs
| Metric | Industry Benchmark | Top Quartile |
|---|---|---|
| Recurring revenue % | 82% (GITNUX) | 90%+ |
| Adjusted EBITDA margin | 15-18.5% (GITNUX) | 20-25% (SLI) |
| Revenue per employee | $150K-$175K | $250K (GITNUX) |
| Managed services gross margin | 45-55% (SLI) | 60%+ |
| Gross revenue retention | 85-90% | 95%+ |
| Endpoints per tech | 250-350 | 400+ |
| Reactive tickets/endpoint/mo | 0.8-1.0 | <0.5 |
The Workforce You're Buying Into
Training Pipeline
Apprenticeships: CompTIA-based 12-20 week paid programs; DOL-registered credentials
Trade School Graduates: Community college IT and cyber support tracks; cloud certs growing
Projected Shortage: 52% of MSPs report hard-to-fill roles; 4+ yrs experience now expected
Labor Strategies for Acquirers
Close-Linked Stay Bonuses: Fund 15-25% of salary retention bonuses from purchase price, vesting over 12-18 months, for every Tier 2-3 tech and service manager.
Paid Certification Ladders: Fund A+ to Network+ to Security+ to cloud certs with raises at each step. This builds security talent internally instead of buying it at market.
Profit-Sharing & Flexibility: Quarterly profit-share tied to agreement margin, plus hybrid schedules. These beat pure salary bids from platforms in most metros.
Automate Tier-1 Work: AI triage and RMM scripting cut reactive tickets so a smaller, better-paid team can cover 400+ endpoints per tech.
Where to Buy
| Rank | Metro | Demand | Competition | Pop. Growth | Home Value | Industry Spend |
|---|---|---|---|---|---|---|
| #1 | Dallas-Fort Worth, TX | 92/100 | High | ~1.9%/yr | ~$390K | Very High |
| #2 | Washington DC / N. Virginia | 90/100 | High | ~0.9%/yr | ~$590K | Very High |
| #3 | Raleigh-Durham, NC | 88/100 | Medium | ~2.3%/yr | ~$430K | High |
| #4 | Nashville, TN | 86/100 | Medium | ~1.8%/yr | ~$450K | High |
| #5 | Phoenix, AZ | 85/100 | Medium | ~1.7%/yr | ~$450K | High |
| #6 | Austin, TX | 84/100 | High | ~2.5%/yr | ~$460K | High |
| #7 | Tampa, FL | 82/100 | Medium | ~1.8%/yr | ~$380K | Medium-High |
| #8 | Charlotte, NC | 81/100 | Medium | ~1.9%/yr | ~$390K | High |
| #9 | Salt Lake City, UT | 78/100 | Low | ~1.5%/yr | ~$550K | Medium |
| #10 | Columbus, OH | 76/100 | Low | ~1.2%/yr | ~$300K | Medium |
#1 Dallas-Fort Worth, TX: Dense SMB base; HQ relocations drive co-managed IT demand
#2 Washington DC / N. Virginia: CMMC Phase 2 makes compliant MSPs scarce assets
#3 Raleigh-Durham, NC: Life sciences cluster needs HIPAA-grade managed IT
Regional Trends
Sun Belt: SMB in-migration and HQ moves sustain seat growth; platform density is rising fastest here.
Mid-Atlantic: CMMC Phase 2 and federal contractor density create the strongest compliance-led demand.
Northeast: NYDFS and Reg S-P drive finance work, but wages up 12-18% compress margins.
Midwest: Older founders and fewer platforms mean the lowest entry multiples in the U.S.
Methodology: Demand scores are a Deal Sheet composite; population and home values are Census/Zillow estimates.
Markets to Approach with Caution
- San Francisco Bay Area: Highest tech wages nationally; 12-18% wage inflation erodes SDE
- Manhattan, NY: Platform saturation plus NYDFS overhead; entry multiples already full
- Boston, MA: Home turf of Thrive and Coretelligent; competitive bids and wage pressure
- Shrinking rural markets: Declining SMB counts limit seat growth and exit buyer interest
What You Need to Know Before You Buy
Federal Requirements
CMMC 2.0 (DoD): MSPs handling CUI for defense clients need Level 2 certification (Est. cost: $10K-$50K/yr)
NIST SP 800-171: 110 controls; the baseline for CMMC and federal CUI handling (Est. cost: $8K-$30K/yr)
HIPAA Security Rule: BAA required; MSP is directly liable as a business associate (Est. cost: $5K-$25K/yr)
PCI DSS v4.0: All future-dated controls mandatory since Mar 31, 2025 (Est. cost: $5K-$15K/yr)
FTC Safeguards Rule: Covers CPA, auto dealer, and lender clients; MSP oversight required (Est. cost: $3K-$10K/yr)
SOC 2 Type II (AICPA): Not legally required but increasingly demanded by mid-market clients (Est. cost: $15K-$35K/yr)
State Licensing Matrix
| State | License Type | Requirements | Transferable? | Time to Obtain |
|---|---|---|---|---|
| CA | No MSP license | Business registration; C-7 license for low-voltage jobs >$1K | N/A - no license | N/A |
| TX | No MSP license | Business registration; alarm license only for security systems | N/A - no license | N/A |
| FL | No MSP license | Business registration; alarm contractor license if applicable | N/A - no license | N/A |
| NY | No MSP license | Business registration; NYC electronics license if repair offered | N/A - no license | N/A |
| IL | No MSP license | Business registration only | N/A - no license | N/A |
| PA | No MSP license | State business registration required | N/A - no license | N/A |
| OH | No MSP license | Business registration only | N/A - no license | N/A |
| MA | No MSP license | Business registration; local requirements vary | N/A - no license | N/A |
Upcoming Regulatory Changes
- CMMC Phase 2 (Effective: 2026-Q4) — Third-party Level 2 assessments required in DoD contracts from Nov 2026
- HIPAA Security Rule Update (Effective: 2026 (pending)) — Proposed mandatory MFA, encryption, and asset inventories; final rule pending
- NYDFS Part 500 Amendment 2 (Effective: 2025-Q4) — Universal MFA, asset inventory, and 72hr ransom payment notice for NY finance clients
- SEC Reg S-P Amendments (Effective: 2026-Q2) — Smaller RIAs/brokers must oversee service providers and meet 72hr breach notice
- NIS2 (EU) (Effective: 2024-Q4) — Explicitly puts MSPs in scope; applies to U.S. MSPs serving EU entities
Estimated Annual Compliance Cost
$10K-$60K/yr (est.)
6 Non-Negotiables Before You Write That LOI
1. Audit MRR Quality, Not Just MRR %
Pull every agreement. Confirm term, auto-renew, and assignment clauses. Month-to-month 'recurring' revenue should be valued like project revenue.
2. Measure Agreement Gross Margin
Target 50-60% managed services GM (SLI). Below 45% usually means underpriced legacy seats or tool sprawl. Both are fixable, so negotiate on it.
3. Lock In Key Technicians
30-40% post-close turnover is common. Fund stay bonuses of 15-25% of salary, vesting over 12-18 months, out of purchase price.
4. Diligence the MSP's Own Security
MSPs are supply-chain targets (Kaseya, 2021). Require MFA on all RMM/PSA access, EDR on tech endpoints, and a recent third-party pen test.
5. Map Vendor and License Transfers
Microsoft CSP, RMM, and security vendor contracts may need re-papering. Confirm transfer terms and any minimum-commit liabilities before LOI.
6. Stress Client Concentration
Cap any single client at 10-15% of revenue or move the excess into an earnout. Losing one 20% client can break SBA DSCR covenants.
Value Creation Hack: The Service-Agreement Arbitrage
Most founder-run MSPs haven't repriced in 3+ years. Move every client to a security-inclusive per-user bundle (EDR, MDR, security training, backup) at +$25-$40/user/mo. On 1,000 seats at $30, that adds $360K of revenue at ~60% margin, or ~$216K of EBITDA. At a 6x exit, that is roughly $1.3M of enterprise value from one pricing letter and a 90-day rollout.
What's the Return?
SBA Searcher
PE Platform Build
Strategic Tuck-In
| Growth Rate / Exit Multiple | DSCR: 0% revenue loss | DSCR: 5% revenue loss | DSCR: 10% revenue loss | DSCR: 20% revenue loss |
|---|---|---|---|---|
| 3.5x SDE entry ($1.75M) | 1.54x | 1.35x | 1.15x | 0.77x |
| 4.0x SDE entry ($2.0M) | 1.35x | 1.18x | 1.01x | 0.67x |
| 4.5x SDE entry ($2.25M) | 1.20x | 1.05x | 0.90x | 0.60x |
| 5.0x SDE entry ($2.5M) | 1.08x | 0.94x | 0.81x | 0.54x |
The Full Picture
Key Risks
Post-Close Talent Flight
30-40% staff turnover in the first 12 months is common. 59% of IT firms can't recruit cloud/security talent (CompTIA).
Mid-Market Multiple Compression
$2-5M EBITDA MSPs could slide from 8x toward 6x as platforms consolidate and independent buyers face capital limits (Aventis).
Contract Churn & Concentration
10-15% annual client churn is typical. Top-client concentration in small MSPs can erase a year of growth in one renewal cycle.
MSP as Cyberattack Vector
A breach of your RMM tool hits every client at once. The Kaseya 2021 attack reached ~1,500 downstream businesses.
Hyperscaler Encroachment
AWS, Azure, and GCP are bundling managed services and compressing margins in managed data center work (24.7% of the market, per Mordor).
Credit Cycle Dependence
The 9x median assumes steady PE deployment and benign credit. Rate shocks or an SMB recession would hit both exit multiples and churn.
AI Commoditization of Tier-1
AI-driven monitoring and ticket triage compresses helpdesk value. MSPs that don't invest in automation risk becoming price-takers.
Tailwinds (Bull Case)
Security Spend Outpacing Market
Managed security is growing 12-18% annually, about 2x the overall MSP rate (Scalepad; IMARC). Ransomware keeps budgets resilient.
Untapped GRC Revenue
Only 36% of MSPs offer formal compliance services (Integris). This is high-margin vCIO/GRC expansion inside your existing client base.
Founder Succession Wave
Founders in their 50s-60s drove 466 deals in 2025 (M&A Signal). Expect 3-5+ more years of tuck-in supply.
Deep PE Exit Market
200+ PE firms back 250+ MSP platforms (2025), so you have a ready exit buyer even at sub-$5M EBITDA (Omdia/Canalys).
CMMC Phase 2 Mandate
DoD contracts will require third-party Level 2 assessments from Nov 2026, creating forced demand for compliant MSPs (DoD).
Vertical Specialization Premium
Healthcare, legal, and finance MSPs trade at 12-15x vs. a 9x general median (M&A Signal). Compliance know-how builds switching costs.
Automation Margin Lift
AIOps and automation cut delivery costs 20-30%. AI-enabled MSPs command 1.5-2.0x multiple premiums (Integris; Scalepad).
The Final Take
Managed IT is the rare small-business category where you can buy subscription economics at Main Street prices. Revenue is 82% recurring, demand is growing double digits, and more than 75 PE platforms are waiting to pay platform multiples at exit. The arbitrage is real, but it rewards operators who can keep technicians, price for security, and run the business like a software company.
Sweet spot for individual searchers: $1.5M-$4M revenue MSPs with $400K-$900K SDE, 75%+ contracted MRR, no client above 12% of revenue, and a second-in-command tech you can retain. Pay 3.5-4.5x SDE using SBA 7(a) with a 10-15% seller note. Walk away from break-fix shops dressed up as MSPs.
For PE-backed buyers: Build a vertical or security-led platform at $2M-$5M EBITDA. Then tuck in founder-owned MSPs at 4-5x and consolidate onto one RMM/PSA stack. Cross-sell MDR and GRC to reach 10-12x exits. CMMC-ready and healthcare MSPs are the scarcest assets in the market right now.
Bottom line: The 2024-2026 pricing window won't stay open forever, and founder supply is at its peak today. Buy contracted revenue, reprice it for security, protect your techs, and you'll own exactly the asset the platforms are paying up for.
Join 2,000+ Searchers and Sponsors
One email per week. No spam. Unsubscribe anytime.
Related Resources
Sources
Mordor Intelligence, United States Managed Services Market 2026 · Market Research Future, US Managed Services Market 2025-2035 · IMARC Group, US Managed Services Market 2025-2034 · Grand View Research, Global Managed Services Market 2025-2030 · Statista, MSP Market Share & Growth Analysis 2025 · Iconic, MSP Valuation Multiples & Buyer Demand 2026 · ClearlyAcquired, SaaS & MSP Valuation Multiples 2026 · YourExitValue, MSP Business Valuation 2026 · Aventis Advisors, Who is Buying MSPs 2015-2025 & MSP Multiples · Omdia/Canalys, MSP M&A 2025: Deals Focus on Cybersecurity, AI · M&A Signal, 2026 MSP M&A Deal Tracker & Valuation Reference · Solganick, Technology Services M&A Update & MSP Tracker · Drake Star, MSP M&A Quarterly Reports Q1-Q2 2025 · CTA Acquisitions, Private Equity MSP 2026 · ProCloser, MSP Valuation Multiples by Revenue Tier 2026 · IBBA Market Pulse, Small Business Sales Multiples Q2 2026 · Integris, 10 MSP Trends to Watch 2026 · Scalepad, 2026 MSP Trends Report · Sherweb, MSP Trends & Challenges 2026 · ConnectWise Service Leadership Index, MSP Benchmarking 2025-2026 · MSP Global, State of the Industry Report Winter 2025 · GITNUX, MSP Industry Statistics 2026 · CompTIA, IT Labor Shortage & Cybersecurity Recruiting Data 2025-2026 · JumpCloud, MSP Adoption Drivers & Device Management Survey 2026 · BLS.gov, Occupational Outlook & IT Wage Data 2025-2026 · U.S. DoD, CMMC Program Rules (32 CFR 170; 48 CFR) · HHS OCR, HIPAA Security Rule NPRM (Jan 2025) · FTC, Safeguards Rule (16 CFR 314)