Your MSP is busy. That doesn't mean it's working.

Your MSP is busy. That doesn't mean it's working.

Loading the Elevenlabs Text to Speech AudioNative Player...

TL;DR

  • Most MSP operations problems come from misdirected effort, not a lack of it. 

  • Meeting bloat is measurable: multiply attendees by duration across all recurring meetings and the cost becomes visible. 

  • Utilization figures are misleading without separating productive hours from rework and repeat tickets. The number that matters is effective utilization. 

  • Monday escalations are a symptom of a missing Friday close-out habit, not bad luck. 

  • None of these fixes require new software. They require a decision to look at how the operation actually runs. 

  • Start with the problem that causes the most friction this week. The rest will follow. 

Three operational habits that separate high-performing MSPs from ones that are firefighting at scale 

Most MSPs track utilization. Few of them track whether the utilization is productive. That gap is where margin disappears. 

Pull your PSA data and look at what is actually driving those hours. In most operations, a significant portion of what looks like productive time is rework, repeat tickets and context switching. Engineers moving between five clients in a morning. The same ticket type appearing for the third time this month because nobody documented the fix. Meetings filling the calendar with no clear output. And every Monday starting with escalations that were visible on Friday afternoon but were never handed off properly. 

Busy is not the same as productive. The three problems below are where the gap between those two states is most consistently found. 

Problem one: meetings are consuming time that would otherwise be billable or spent on process improvement 

Count the recurring meetings in your business this week. Multiply attendees by duration for each one. Add it up. That number, in hours, is what your meetings cost you every single week. Not in theory. In actual engineer and leadership time. 

The weekly standup that made sense with four people now has twelve attendees and no clear output. The check-in that took fifteen minutes when the team was small now runs an hour because nobody has stopped to ask whether it still needs to exist. Meetings do not get cancelled on their own. They accumulate. 

What a meeting audit looks like 

Start by listing every recurring meeting, its attendee count, and its duration. Then ask one question about each: what decision or output does this meeting produce that could not happen another way? If the answer is 'it keeps people aligned' or 'it's a good chance to catch up,' that is not a meeting. That is a written update or a shared channel. For every meeting on the list, there are five options: keep it, reduce its frequency, reduce attendance, convert it to an async update, or cancel it. Run this exercise and there will almost certainly be at least one meeting that can go this week. 

The question to ask before booking any meeting 

Before any recurring meeting gets added to the calendar, it should be required to answer three things: what decision needs to be made, who specifically needs to make it, and why this cannot happen in writing. If all three cannot be answered, it is not a meeting yet. This is also the right framework to apply when reviewing existing meetings during an audit. 

Problem two: utilization numbers are not telling you what you think they are 

95% utilization looks strong on a leadership dashboard. It signals that engineers are working and that capacity is being used. What it does not tell you is what they are working on. 

Pull the PSA data and look at what is driving those hours. In most MSP operations, a meaningful share of what registers as productive utilization is rework, repeat tickets, and context switching. Time logged against issues that should have been automated months ago. High utilization with low first-time resolution rates does not indicate a productive team. It indicates a team that is repeatedly handling the same problems. 

What to actually measure 

Separate time data into two categories: productive hours, meaning first-time resolutions, proactive work, and environment improvements, and waste hours, meaning rework, repeat tickets, and anything appearing in the queue three or more times without a permanent fix. The number that matters is effective utilization, which is productive hours only as a percentage of total available time. That figure tells you whether the operation is improving or running in place. 

Once the waste is located, the fixes tend to be straightforward. Repeat tickets are automation or documentation candidates. Context-switching patterns point to scheduling and assignment problems. Persistent time sinks at the client level often indicate a need for a different service tier or a direct conversation about scope. 

One report, this week 

Pull a time entry export from your PSA. Look for the top five time sinks by category. A complete analysis framework is not required to start. The question to ask is: if 20% of this wasted time needed to be cut in the next 90 days, where would the starting point be? The data will usually make the answer clear. 

Problem three: Monday morning problems are created on Friday afternoon 

The pattern is a familiar one. The laptop closes on Friday and everything feels under control. Monday morning arrives with three escalated tickets, a frustrated client email, and an on-call engineer who had no context on anything that was developing over the weekend. 

None of this is unpredictable. The SLA breach risk was visible on Friday at 4pm. The open P1 was still assigned to someone going off-shift. The scheduled weekend change had no documented rollback plan. Monday chaos is not bad luck. It is a missing Friday process. 

This is the same thinking applied to SOC operations at enhanced.io. Every alert triaged correctly the first time reduces rework downstream. Every escalation handed off cleanly on a Friday means a calmer weekend for the MSP and their clients. The principle scales from SOC operations all the way to basic service desk management. 

What a Friday close-out covers 

A Friday close-out review does not need to take long. Ten to fifteen minutes, done consistently, changes what Monday looks like. The five areas to cover are: open P1 and P2 tickets with status and documented next action, any SLA breach risks in the next 48 hours, scheduled weekend changes with confirmed ownership, an on-call handoff with context for each open issue, and a brief proactive update for any client with something live or unresolved. 

The internal version should be under 200 words. It is not a meeting. It is a written summary the on-call engineer reads in three minutes and knows exactly where they stand. 

Why this is hard to sustain and how to make it stick 

The reason most teams do not have a Friday close-out habit is not that they do not see the value. Friday afternoon is when the instinct is to close the laptop and leave. The fix is to make it non-negotiable for one month, assign ownership to a specific person rather than 'the team,' and keep the format short enough that it does not feel like additional work. After four Fridays, the benefit is self-evident: calmer weekends, cleaner Mondays, and clients who notice that someone is always watching their environment. 

The bigger picture 

These three problems, meeting bloat, inaccurate utilization measurement, and the missing Friday handoff, are operational basics. They do not require new tools or a large change program. Left unaddressed, they compound. The team gets busier without becoming more productive. Engineers burn out. Clients notice. The business adds headcount to address problems that are fundamentally process problems. 

The MSPs that scale well are not always the ones with the most engineers. They are the ones that built the operational discipline to make every hour count, cut the meetings that do not need to exist, and close every Friday knowing what Monday morning will look like. 

Start with one of these this week. The one that causes the most friction right now is the right place to start. The rest will follow. 

FAQ

How do I get buy-in to cancel meetings when the culture is used to them?

Frame it as an experiment rather than a permanent decision. A four-week meeting audit, where everything is under review, is a lower-stakes conversation than announcing cancellations. Most people privately find unnecessary meetings frustrating and will engage with the process. Starting by cancelling one meeting without asking for permission is usually the most effective proof of concept. If nothing breaks, that is the data you need.

Our PSA data is messy. Can we still do a utilization analysis?

What is the right cadence for a meeting audit?

Who should own the Friday close-out?

How do we measure whether these changes are actually working?

We are a small MSP with a team of five. Does this still apply?

About Author

Mark Duke

Mark Duke is CTO and co-founder of enhanced.io. He designed the SOC architecture on Stellar Cyber Open XDR and oversees all technical delivery across the platform.