Every IT company says the same three things

Proactive. 24/7 monitoring. Security first. When two providers make identical claims and you can’t verify either, the only thing left to compare is the price – and that’s how most businesses end up choosing.

Put two IT proposals side by side. Read the first page of each.

Proactive support. Round-the-clock monitoring. Security-first approach. Trusted partner. Twenty years of experience. Both of them. Almost word for word.

One is meaningfully cheaper.

You are not being lazy or short-sighted when you pick the cheaper one. You’re doing the only rational thing available. Two things that look identical differ by price, and price is the single number on the page that is concrete, comparable, and definitely true.

The claims aren’t lies. They’re unverifiable.

That’s the distinction that matters, and it’s not the same thing.

The expensive provider probably is better. They may well have twenty-two years of spotless work behind them. But you’re not technical. You can’t audit their patching, read their access policies, or judge whether their backup strategy is any good. So when they tell you they’re proactive, and the cheaper firm tells you they’re proactive, you have received exactly the same amount of usable information from both: none.

You can’t buy what you can’t see.

And it doesn’t stop when you’ve signed

Here’s the part that costs businesses more than the original decision.

Once you’ve chosen, the same problem carries on quietly for years. Your provider says things are fine. Nothing appears to be on fire. You have no way of telling the difference between a business being genuinely well looked after and a business that has simply been lucky so far.

Most businesses only find out which one they were during an incident, an insurance claim, or a client’s security questionnaire. All three are bad moments to discover that “we monitor everything” meant somebody would probably notice eventually.

Ask for evidence instead

The fix isn’t finding a provider who makes bigger promises. It’s refusing to accept promises as the unit of comparison. Three things to ask for — at the proposal stage, and then every quarter afterwards.

Numbers, not adjectives. “Proactive” is an adjective. Ask instead: what percentage of our devices are fully patched, this month? What percentage of accounts have multi-factor authentication actually enforced? When did you last restore a file from backup as a test, and how long did it take? Those have answers. A provider doing the work will have them to hand, and a provider who has to go and find out has told you something.

In the proposal, not in a portal. Plenty of providers will point you at a dashboard. A dashboard you logged into once in 2019 isn’t proof, it’s a filing cabinet. If the evidence matters, it should be in the document you’re reading when you make the decision, and in the review meeting afterwards.

Something they didn’t mark themselves. Everything above is still a provider scoring their own homework. Useful, but it’s their number. Independent certification is the part somebody else signed off. In the UK, Cyber Essentials Plus is the floor rather than an achievement – it’s the entry ticket, and it’s worth knowing that a good number of cheaper outfits don’t hold it. In the US and Canada, SOC 2 plays a similar role. Above both sits ISO 27001, which far fewer providers hold, and which says they don’t merely claim to run a system — an external auditor has confirmed they do.

One honest caveat

None of this means cheaper is worse. Some excellent small providers charge less because they’re lean and local, and some expensive ones are coasting on a nice office.

The point isn’t price. It’s that you should be choosing on something you can actually check – and right now, most businesses aren’t choosing at all. They’re guessing, and calling it a decision.

Three questions to ask

Whether you’re choosing a new provider or reviewing the one you’ve got:

1. What are our current numbers? Patch compliance, MFA coverage, and the date of the last tested backup restore. Three figures.
2. Where do those numbers live, and how often will I see them? If the answer is a portal you’d have to remember to open, ask for them in the review instead.
3. What certifications do you hold, and can I see the certificate? Not “we work to those standards”. The certificate, with a date on it.

If a provider finds any of that awkward, you’ve learned something useful for the price of one email.

Our founder made the case to IT providers themselves – the same three moves, from the other side of the table.

The free Business Risk Audit includes a section on whether you can evidence how your data is protected. Four minutes.