Previously – https://blog.ciaops.com/2026/07/31/the-recurring-problem-a-managed-services-story-chapter-6/

The transformation that followed took the better part of eighteen months, and it was messier and slower than any tidy retelling makes it sound. Priya led it, with a whiteboard in her office that eventually filled an entire wall.

The first and hardest change was financial. Bridgepoint stopped selling hourly project work as its default and began requiring every new client, and every renewing one, to move onto a tiered managed-services contract with a three-year term — not because Priya loved locking clients in, but because Renata’s numbers had made the logic unavoidable: longer, deeper contracts weren’t just more predictable, they were worth measurably more, and clients who wouldn’t commit to a real partnership usually weren’t clients worth keeping anyway. It cost Bridgepoint two accounts that flatly refused the new terms. It gained the company, within a year, a recurring-revenue base that had climbed from 46 percent to 71 percent of total revenue, on its way toward the 85-percent target Priya had written at the top of the whiteboard and circled twice.

The second change was strategic focus. Rather than continuing to be everything to everyone, Bridgepoint made a deliberate bet on two verticals where it already had real experience: healthcare and light manufacturing. It hired a part-time compliance consultant with a HIPAA background, built a documented incident-response playbook mapped explicitly to healthcare regulatory requirements, and began marketing itself, for the first time in its history, as something other than a friendly generalist. The pitch decks stopped saying “we support any business” and started saying “we understand what a HIPAA auditor is going to ask you, because we’ve already answered it forty times.” Pricing for the healthcare tier came in meaningfully higher than the old flat rate — clients paid it without much argument, because for the first time, the price reflected expertise they could see, not just hours they were trusting someone to bill honestly.

The third change was the one Tom Baptiste’s plant-manager scare had made unavoidable: Bridgepoint built an actual AI governance offering, something that hadn’t existed anywhere in its service catalog eighteen months earlier. It started small — a one-time “AI readiness assessment” that inventoried every AI tool a client’s employees were already using, sanctioned or not, and flagged where sensitive data might be leaking to public tools nobody in leadership had approved. It grew into an ongoing service: written AI usage policies tailored to each client, ongoing monitoring for unsanctioned tool use, and, for the healthcare and finance clients who needed it, documentation aligned with emerging frameworks their own auditors were starting to ask about. It was Aisha’s idea, developed with a compliance consultant Priya brought in, and it became, within a year, one of the highest-margin services Bridgepoint had ever sold — not because it required expensive infrastructure, but because it required exactly the kind of judgment Jordan and his fellow senior technicians actually had, applied to a problem clients didn’t know how to solve themselves.

“We spent eight years being the people who fixed what broke,” Priya said, at the leadership offsite where she presented the first full year of results. “We’re spending the next eight being the people who tell clients what’s about to break, and what they’re not allowed to plug into their network without asking us first. That’s a completely different business. It just happens to be run by the same people.”

Previously – https://blog.ciaops.com/2026/07/30/the-recurring-problem-a-managed-services-story-chapter-5/

Dave called Aisha into his office the following Monday, alone, no leadership meeting audience. “Tell me honestly,” he said. “If we actually did this — really did it, not a five-hundred-ticket trial license — what would it take, and what would break?”

Aisha, to her credit, didn’t gloat. She pulled up a proposal she’d apparently been quietly refining for months on the assumption nobody would ever ask to see it. A tiered rollout: automated triage and resolution for the top eight ticket categories that accounted for nearly sixty percent of volume; predictive monitoring that could flag failing hardware and unusual network behavior before clients ever noticed a problem, instead of after; and, critically, a real security escalation path with automated paging, not a shared inbox and a prayer.

“What would it take?” she said. “Budget, about $140,000 in tooling and integration over the first year. What would break — that’s the harder question. Not the technology. The technology works; I’ve been running the proof of concept for months and the failure rate on auto-resolved tickets is under two percent, and every one of those gets caught and escalated to a human, not silently dropped. What breaks is the team, if we don’t handle this right. Jordan thinks this is about replacing him. It isn’t. But if we don’t say that out loud, clearly, more than once, he’s going to be right to be angry, because nobody will have told him otherwise.”

Dave took that seriously enough to have the conversation with Jordan directly, which was, in its own way, harder than the conversation with Renata Cole had been. They sat in the break room after hours, two coffees going cold.

“I’m not going to pretend some of this doesn’t automate work you currently do,” Dave said. “It does. Password resets. Basic troubleshooting. The stuff that’s been eating your week. What I need from you isn’t to compete with it. It’s the thing it can’t do — sit with Tom Baptiste and tell him honestly what his plant manager’s AI habit is going to cost him if nobody manages it, or walk into a room with a healthcare compliance officer and speak their language because you’ve done it for eleven years. I can’t automate the part where clients trust you. I can only automate the part where they don’t need to wait nineteen hours for a password reset while they’re deciding whether they still do.”

Jordan didn’t answer right away. “So my job changes,” he finally said. “From doing the work to explaining the work.”

“Your job changes from being the guy who shows up,” Dave said, “to being the guy clients call before they know they have a problem. That’s a better job than the one you have now. It’s just not the one you were trained to think you were signing up for.”

It wasn’t a clean resolution. Jordan stayed skeptical for months, and two of Bridgepoint’s other senior technicians left over the following year — one retired early, one took a role at a competitor that hadn’t changed anything and, as far as anyone could tell, was quietly struggling because of it. But Jordan stayed, and by the following spring he had become, somewhat to his own surprise, the person clients most wanted running their onboarding calls for the company’s new security offering, because he was the one person in the building who could explain, in plain language and without a sales pitch, exactly why it mattered.

Previously – https://blog.ciaops.com/2026/07/29/the-recurring-problem-a-managed-services-story-chapter-4/

The idea of selling Bridgepoint, or at least taking on a growth investor, had floated around Dave’s head for a couple of years, mostly as a retirement fantasy he indulged on long drives. In March, half out of curiosity and half because losing Lakeside had rattled him more than he wanted to admit, he agreed to a preliminary valuation conversation with an M&A advisory firm that specialized in IT services roll-ups. Marcus had a contact; the meeting cost nothing but an afternoon.

The advisor, a clipped, unsentimental woman named Renata Cole, walked Dave and Priya through Bridgepoint’s financials with the emotional affect of someone reading a weather report. Revenue: $9.4 million. EBITDA: roughly $1.6 million, a healthy-looking 17 percent margin. Dave had always been quietly proud of that number.

“Your EBITDA is fine,” Renata said. “Your multiple is going to be a problem.”

“Explain that to me,” Dave said.

“At your size, with your revenue mix, buyers in this market are going to look at three things before they look at anything else,” she said, ticking them off on her fingers. “First: what percentage of your revenue is contracted, recurring, and sticky, versus one-off project work that could evaporate next quarter. Second: how concentrated your revenue is in your largest clients. Third: whether you have any real differentiation, or whether you’re a generalist competing on relationships and price. On the first, you’re sitting around forty-six percent recurring revenue — buyers want to see north of eighty-five percent before they’ll pay a premium multiple. On the second, your largest client is nineteen percent of revenue, and buyers get nervous well before that; anything over twenty to twenty-five percent concentrated in one account is a red flag they’ll price into the offer. On the third — no offense, Dave — ‘we’ve been doing this for eight years and our clients like us’ isn’t a moat. It’s a headline that every generalist MSP could put on their own website.”

She turned her laptop around so they could see the slide. A business with Bridgepoint’s EBITDA and a strong recurring-revenue base, high client diversification, and a specialized niche could reasonably expect eight to twelve times EBITDA, even higher with a security specialization. A business that looked like Bridgepoint currently looked — generalist, project-dependent, concentrated — was more realistically priced at four to six times, and buyers would likely structure a meaningful chunk of even that as an earnout contingent on retaining the client base through the transition.

Four to six times $1.6 million was, doing the arithmetic Dave really didn’t want to do in front of Renata, somewhere between $6.4 million and $9.6 million — for a company he’d spent eight years and, by his own private accounting, most of his thirties and half his forties building. Not a number to be ashamed of, exactly. But nowhere near what he’d let himself believe it might be worth, and nowhere near enough for the number to represent what it was supposed to represent: proof that the thing had been worth doing.

“I’m not telling you to sell,” Renata said, more gently, watching his face. “I’m telling you what the market is actually pricing, so that if you ever do want to sell — or even if you just want to run a business that isn’t one bad quarter away from a crisis — you know exactly which three levers you’d need to pull. It’s not really about me, or about a buyer. It’s about whether your business model matches the world your clients are actually living in now. Right now, it doesn’t quite.”

Dave didn’t sleep much that night. He kept coming back to something Aisha had said in November, dismissed at the time as youthful overconfidence: You’re spending forty percent of your week resetting passwords. That’s not judgment. That’s just volume.

For the first time, he let himself actually finish the thought he’d been avoiding for a year: Bridgepoint wasn’t losing because it was doing anything badly. It was losing because it was doing, extremely well, a version of the job that increasingly nobody needed done that way anymore.

Previously –  https://blog.ciaops.com/2026/07/28/the-recurring-problem-a-managed-services-story-chapter-3/

Denise Okafor called on a Thursday in February, and this time there was no anger in her voice at all, which was somehow worse. “We’re moving our IT relationship to Meridian Health IT at the end of our contract term,” she said. “They only work with medical practices. Their entire pitch was built around HIPAA and nothing else. Dave, I like you. I’ve liked working with Bridgepoint for six years. But I can’t keep explaining to my board why our IT provider treats a medical practice exactly the same as a landscaping company. We need a security team that speaks our language natively, not one that’s learning it because we complained.”

Bridgepoint’s ninety-day notice clock started that afternoon. $640,000 in annual revenue — nearly seven percent of the company’s total — was walking out the door, and it was walking toward a competitor that had done exactly one thing Bridgepoint hadn’t: picked an industry, gone deep, and built a service around that industry’s specific compliance reality instead of a generic bundle stretched to cover everyone.

Dave took the loss personally, because it was personal — Lakeside had been one of his first ten clients — but the number that actually kept him up that week wasn’t the $640,000. It was something Marcus said almost in passing, trying to soften the blow: “At least it wasn’t Baptiste. If we lost Baptiste on top of this, that’d be real trouble.”

Baptiste Manufacturing was Bridgepoint’s single largest client, at just under 19 percent of total revenue — a family-owned metal fabrication company that Tom Baptiste had built up from his father’s two-man machine shop. Dave hadn’t thought about customer concentration in those terms before. He thought about it constantly after that.

Two weeks later, he got a call from Tom that gave him a preview of exactly how that could go. Baptiste’s plant manager had started using a free AI chatbot to draft supplier emails and, it turned out, to summarize confidential pricing data from a shared drive he didn’t fully understand the access permissions on. Nothing had leaked — yet — but Tom had found out from his own son, who worked on the shop floor and had seen it happening, and he was furious that nobody at Bridgepoint had ever mentioned that this was even a risk worth managing.

“You guys handle our computers,” Tom said. “Isn’t this exactly the kind of thing you’re supposed to be telling us about?”

Dave didn’t have an answer for that either. Bridgepoint had never offered anything resembling a policy for how clients’ own employees used AI tools, because as recently as eighteen months earlier, it hadn’t occurred to anyone that this was IT’s job to manage. It clearly was now. Somebody was going to own that conversation with clients. Dave just didn’t know yet whether it would be Bridgepoint or whoever Bridgepoint’s next competitor turned out to be.