MSP lead generation works best when you pick a vertical of 10 to 100 seat firms, such as law, accounting, dental or manufacturing, and reach them at the moment something changes: an office move, a hiring push, a compliance deadline, a cyber insurance renewal or a bad outage. Referrals and vendor partners bring the warmest leads. Cold email and calling fill the gaps, as long as the message is plain and helpful, not a scare.
This guide is for managed service providers and small IT firms that sell to other businesses. It covers who actually buys managed IT, the triggers to watch for, the channels that bring clients, how to talk about security and compliance without fear-mongering, and three example cold emails. For every niche in this series, start at how to get clients. If you also offer websites or marketing, see agency lead generation. Selling to the same small professional firms from another side is covered in how to get bookkeeping clients.
Who buys managed IT services?
The best MSP clients are firms large enough to depend on their systems but too small to employ a full IT team. In practice that is usually 10 to 100 seats, where one office manager or partner has been "doing the IT" and has run out of time.
| Vertical | Typical size | Why they buy | Who decides |
|---|---|---|---|
| Law firms | 5 to 60 staff | Client confidentiality, document systems, remote access for attorneys | Managing partner, office or firm administrator |
| Accounting and tax firms | 5 to 50 staff | Client financial data, tax season uptime, FTC Safeguards Rule | Managing partner, operations manager |
| Dental practices | 8 to 40 staff, often several sites | Practice software, imaging, HIPAA, front desk uptime | Owner dentist, practice manager |
| Medical practices and clinics | 10 to 100 staff | EHR uptime, HIPAA, device sprawl | Practice administrator, physician owner |
| Manufacturers | 20 to 100 seats plus shop floor | Production uptime, ERP, older machines on the network | Owner, operations or plant manager, controller |
| Nonprofits, architects, engineers | 10 to 60 staff | Large files, remote work, tight budgets | Executive director, principal |
Pick one or two of these. An MSP that supports "businesses of all sizes" competes with every other MSP. One that knows dental imaging software sounds like the obvious choice to a practice manager.
What triggers a firm to look for a new MSP?
Firms rarely switch IT providers on a quiet Tuesday. They switch when something changes, and most of those changes are visible from outside.
- Office move or new location. Cabling, network, phones and printers all need planning. Look for new listings on Google Maps, press releases and "we've moved" posts.
- Hiring. A firm posting several jobs will need laptops, accounts and onboarding. Job boards show this plainly. A post for an "IT coordinator" or "office manager with IT duties" is a strong signal.
- Compliance pressure. HIPAA for dental and medical practices. The FTC's Safeguards Rule for tax preparers and other financial businesses it covers. Client security questionnaires for law firms and manufacturers that supply larger companies.
- Cyber insurance renewal. Applications now ask detailed security questions. The Cyber Readiness Institute lists the controls carriers want to see: awareness training, multi-factor authentication, documented and tested backups, access management, secure email and regular patching. An owner filling that in alone often wants help.
- A bad outage. A ransomware scare, a failed server or a week without email. You will not usually see this from outside, which is why referrals and staying in touch matter.
- Their current provider changed. The solo IT person retired, or their MSP was bought and service slipped.
Triggers matter more than volume. Fifty firms that just opened a second office will do better than 500 random businesses.
Which channels work best for MSP lead generation?
Most MSPs mix a warm channel with an outbound one. Warm channels close faster; outbound gives you control over how many conversations you start.
| Channel | Speed to first lead | Best for | Watch out for |
|---|---|---|---|
| Client referrals | Slow to build, then steady | Every MSP | Only works if you ask, by name, after a win |
| Vendor and partner referrals | Medium | MSPs with a strong vertical | You must send work back |
| BNI chapters and chambers of commerce | Slow | Local MSPs | One IT seat per BNI chapter; time cost is real |
| Webinars and lunch-and-learns | Medium | Compliance topics for one vertical | Needs a list to invite first |
| Cold email | Fast once set up | Reaching named owners in one vertical | List quality and sending setup |
| Cold calling | Fast | Practice managers and office managers | Gatekeepers, timing |
| Medium | Firms above about 30 staff | Slow per contact |
Referrals from clients and partners
Your existing clients know other firms just like them. Ask after a visible win, such as a smooth move or a clean audit, and ask for one name. Partners who serve the same firms are the other source: practice software vendors, accountants, phone system and copier dealers, cabling contractors, and insurance brokers who sell cyber cover. A broker whose client cannot answer the security questions on a cyber application is a natural referral partner.
BNI, chambers and local groups
Local business groups bring referrals from the accountants, lawyers and insurance agents in the room. BNI allows one professional per specialty in each chapter, so if a chapter already has an IT member, look for another chapter nearby. These groups are slow but the leads close well.
Webinars and lunch-and-learns
A 30-minute session on one topic for one vertical works, such as "What the HIPAA Security Rule asks of a small dental practice". Hand out a one-page checklist. Attendees who ask follow-up questions are your leads.
Cold email and cold calling
Cold email lets you contact the owner or practice manager directly with something relevant to their firm. Calling works well alongside it, especially with practice managers who answer the phone. For a list-building and outreach process from start to finish, see our sales prospecting guide.
How do you build an MSP lead list?
Build it from public sources, one vertical and one area at a time.
- Search Google Maps for the vertical and city: "dental practice Columbus OH", "CPA firm Tampa". Note name, website, number of locations and review count.
- Check the website. Look at the team page to estimate headcount, check for a second location, and note the practice software or patient portal they mention.
- Look for triggers. Job posts, a new address, a "now open" announcement, a recently added partner.
- Find the decision maker. Practice manager, office administrator, managing partner or operations manager. The team page often names them.
- Find and verify the address. Take it from the firm's own site where possible and verify each one before sending. Our free email verifier checks single addresses.
Source matters. In our own cold email statistics study of 14,373 US business addresses, addresses found on the business's own website were dead 8.3% of the time, against 27.6% for imported lists. Dental practices, a core MSP vertical, came out at 59.3% safe to email, 14.8% dead and 19.1% catch-all, from a sample of 209 practices. That is a small group and could move a few points with more data, but it shows that roughly 1 in 5 practice addresses cannot be confirmed by a check alone.
To see what a finished list looks like, the free leads tool gives you 50 verified businesses in your chosen niche and city, with owner names where the site names one and the Google rating. Our lead list guide covers the fields to keep.
How should an MSP talk about security without fear-mongering?
Talk about what the firm already has to do, and offer to make it easier. Do not open with breach statistics, hacker stories or "you could be next".
Owners of small firms get a lot of scary IT email, and it reads as a sales tactic. If you imply they are already breached or non-compliant without evidence, you lose trust before the first call.
What works instead:
- Name the obligation, not the threat. "HIPAA asks every practice to do a security risk analysis" is a fact they can check. HHS publishes guidance on the risk analysis requirement and points small practices to its free Security Risk Assessment tool.
- Point at the deadline they already have. A cyber insurance renewal or a client security questionnaire is on their calendar. Offer to help them answer it accurately.
- Be specific about the covered firms. The FTC's Safeguards Rule covers tax preparation firms and other financial businesses in its scope. It asks them to designate a Qualified Individual to run their security program, who can work for a service provider, and to put multi-factor authentication on anyone accessing customer information. Say that plainly and let them decide if it applies to them.
- Offer something small first. A free one-page review of their current setup against their insurance application, or a 20-minute check of MFA and backups.
- Never guarantee compliance or protection. No MSP can promise a firm will pass an audit or never be breached.
What should an MSP cold email say?
One observation about the firm, one sentence about what you do in their words, and one easy question. Under 90 words. No "I hope you're well", no "end-to-end solutions", no threat statistics.
The three templates below are examples written for this page. Replace the bracketed details with what you actually found. More examples are in our cold email templates.
Template 1: dental practice with a new location (example)
Subject: {{city}} second office it
Hi {{first_name}},
Congratulations on the new {{new_location}} office for {{company}}.
I run IT for dental practices in {{region}}: network, imaging
workstations, practice software and backups, set up so both sites
work the same way.
When you get to the network and phones at the new office, would a
short checklist of what to sort before opening day be useful?
{{sender_name}}
Template 2: accounting firm before tax season (example)
Subject: {{company}} tax season it
Hi {{first_name}},
{{company}} has {{staff_count}} people on the team page and is
hiring {{role}}, so you'll have new laptops and logins to set up
before tax season.
I look after IT for accounting firms: onboarding, backups, MFA and
the paperwork the FTC Safeguards Rule asks for, handled monthly.
Would it help if I sent over the new-hire setup checklist we use?
{{sender_name}}
Template 3: cyber insurance renewal, law firm (example)
Subject: law firm cyber renewal
Hi {{first_name}},
Most cyber insurance applications now ask about MFA, tested backups
and patching, and firms the size of {{company}} often fill them in
without an IT person in the room.
I help law firms in {{city}} answer those questions accurately and
close any gaps before the renewal date.
When is {{company}}'s next renewal? Happy to walk through the
security section with you.
{{sender_name}}
Follow-up to template 3 (example)
Send 4 to 5 days later in the same thread.
Hi {{first_name}},
One practical thing in case it is useful: before you sign the
application, check that the MFA answer covers email, remote access
and any admin accounts, not just your own login.
If someone already handles this for {{company}}, just say and I
won't follow up again.
{{sender_name}}
The follow-up gives away one useful step and an easy way to say no.
How many leads does an MSP need?
An MSP adding one or two clients a quarter does not need thousands of contacts. A focused list of a few hundred firms in one vertical, contacted with a short sequence and refreshed as new triggers appear, is enough to test an offer.
MSP sales cycles are long. A firm may reply now and sign in six months when its contract ends, so record when each "not now" firm's contract or renewal comes up and contact them again then.
Sending setup matters as much as the list. Use separate sending domains so your main company domain is never at risk, warm up each mailbox before any cold email, and keep daily volumes per mailbox small. An MSP that burns its own domain on cold email has a hard conversation with every existing client whose tickets go to spam.
What mistakes do MSPs make with lead generation?
- Selling to everyone. "Businesses in the metro area" gives you nothing to say.
- Leading with fear. Breach headlines and "you could be next" read as a pitch and get deleted.
- Pitching a full contract first. Offer an assessment, a checklist or a project before the monthly agreement.
- Listing tools, not outcomes. The office manager cares that new hires have a working laptop on day one, not about your RMM platform.
- Ignoring the partner channel. Software vendors, insurance brokers and accountants already talk to your best prospects.
- Sending from the main domain. Keep cold email on separate domains.
- Emailing personal addresses. Contact firms at their business addresses only.
Cold email to businesses is legal in the US when you follow CAN-SPAM: truthful headers and subject lines, a physical address and a working opt-out. Rules differ in other countries, so check them before sending outside the US.
MSP lead generation FAQ
What is the best lead source for an MSP?
Referrals from existing clients and partners close best. Insurance brokers, practice software vendors and accountants already serve the firms you want. Add cold email or calling to a focused vertical list so you are not waiting for referrals to arrive.
What size business should an MSP target?
Most MSPs do best with firms of about 10 to 100 seats. Below that, budgets are tight. Above it, firms often have internal IT staff and run formal procurement.
How do I get MSP clients without fear-based marketing?
Talk about obligations and deadlines the firm already has, such as a HIPAA risk analysis, an FTC Safeguards Rule program or a cyber insurance renewal. Offer something small and useful first, such as a checklist or a short review, and never promise compliance or protection.
Is cold email effective for MSPs?
It works when the list is narrow and the email names something true about the firm, such as a new location or a hiring push. It works poorly with generic security pitches to large, unverified lists.
Should an MSP buy leads?
Buying a list is fast, but in our study 27.6% of addresses from imported lists were dead, against 8.3% found on the business's own site. If you buy, use it as a list of firm names and find and verify each address yourself.
What triggers a business to switch IT providers?
Office moves, new locations, hiring, compliance requirements, cyber insurance renewals, a bad outage, and changes at their current provider, such as a retirement or an acquisition.