Most independent MSPs get new clients two ways: a referral, or a list they bought and emailed. Both ignore timing. A referral arrives whenever a client's friend happens to mention IT. A bought list says a company exists, how big it is, and who runs it. It says nothing about whether that company is near a decision.
Timing is most of the game in managed services. A business that is happy with its provider does not take a meeting, no matter how good the pitch. A business whose provider just missed a migration date, or whose new operations lead is reviewing every vendor contract, takes the meeting.
Most of the events that push a company toward an IT decision leave a public trace. A firm moves offices, wins a contract, hires a leader, files a merger, or standardizes on an AI tool. This page lists eighteen of those events, why each one predicts a provider decision, and why each one is hard to catch by hand. SiteSmith builds target lists around signals like these, and an outbound system can watch for them across a whole territory.
A buying signal for managed IT services is a public event that shows a company is about to make a decision about who runs its technology. The event is not the purchase. It is the cause of the purchase. Common examples are an office move or renovation, a merger, a new operations or compliance leader, a firm crossing into a stricter regulator's jurisdiction, a new government contract with a cybersecurity clause, a first company-wide AI rollout, an email or security vendor change, a telltale job post, and an owner describing a technology problem on the record. Each of these creates work that an in-house person cannot absorb: cabling, migrations, security plans, policies, device management, and exam preparation. Signals of this kind are useful because they answer the timing question that referrals and purchased contact lists cannot. They tell a managed service provider which companies to contact this month, and what to say, instead of which companies merely exist.
Group 1: What firms are doing with their systems
A firm changes something in its own technology, and the change creates the need for help. The systems-change signals page covers this group in more detail.
1. AI rollout
A firm moves from staff using AI tools on personal accounts to a company account. The week that happens, it needs single sign-on (one login for every app), data retention settings, an acceptable-use policy, and someone to roll it all out. When a company standardizes on an AI tool it leaves a public trace, but one nobody reads unless they are looking for it.
2. Email or security vendor change
When a firm's email filtering or its public sender records change, something is moving. Usually it is a migration, and often it is a provider change already under way. A firm mid-migration is comparing providers, and a firm that just switched is watching the new one closely. Nobody announces this, so it is visible only to someone who checks.
3. IT project before launch
New remote-access, client-portal, or AI systems at a firm often show up in public records before they go live. A project visible before launch is one someone is still staffing and pricing. By the time it is announced, the vendors are chosen. Catching it early means reading records that are public but scattered.
Group 2: Filings and public records
Regulators, county offices, and government buyers publish records that describe a change before it is finished. The filings and public records page walks through each one.
4. Office move
A regulated firm changes its registered main office. A move means cabling, network, firewall, printers, access control, and a rewrite of the security plan, all against a fixed date. The filing sits in a public register nobody browses without a reason.
5. Office build-out
A tenant files for an interior renovation. Months later that tenant needs cabling, a network, and a firewall, and the general contractor will not supply them. Permits are filed by address rather than company name, which makes them slow to connect to a prospect.
6. Breakaway firm
Professionals leave a firm to open their own. Within weeks they must set up email, devices, document management, and security from nothing, with no IT person yet. The registration is public the day it is filed, but it looks like every other new business filing until someone reads who is behind it.
7. Firm arriving in a new state
An out-of-state firm registers to do business locally. Some are paper registrations. The ones opening a real office need local hands on day one, because their existing provider is hundreds of miles away. Sorting real offices from paper ones takes a second look.
8. Merger
Two firms combine. Someone must merge two email systems and two document systems by a fixed date, and both current providers are competing for the combined account. Mergers are announced to the firms' clients, not to the MSPs nearby, and the IT decision is made early.
9. Crossing a regulatory line
A firm is about to grow past the size where a stricter regulator and its cybersecurity exams take over. The SEC's examination priorities for fiscal year 2026 name controls for artificial intelligence, incident response, and Regulation S-P (the SEC's customer-data safeguards rule) as areas of focus. The amended rule also requires written policies for overseeing outside service providers, which includes the IT provider. A firm approaching that line needs policies it has never had, and its growth is visible only to someone who tracks the same firm over time.
10. Tax-season security plan
Federal rules require paid tax preparers to have a written information security plan. That is a deadline, not a buying signal on its own, but every year before filing season it puts IT on the owner's desk. Many small preparers have a plan on paper and nobody to make it true. The deadline is the same for every preparer, so the slow part is knowing which ones will act.
11. Defense work
Contracts that carry the DFARS cybersecurity clause (the defense contracting rules) require the contractor to meet NIST SP 800-171, a federal security standard, on the systems that hold covered defense information (the government data a contractor handles). A new award names a contractor about to face those requirements, often for the first time. Awards are public but plentiful, and nobody sorts out the local first-time winners, who rarely know what the clause means until someone explains it.
12. Clients about to need a provider
When a small IT company files to dissolve or is bought, its clients may soon need someone new. The filing is public. The client list is not, so this one takes a second step to turn into names.
Group 3: People and hiring
A new leader or a revealing job post says more about the next year than any field on a bought list. The people and hiring signals page goes deeper on both.
13. New COO or compliance officer in their first months
A new COO or compliance officer inherits the IT vendor and the next exam, and is the one person paid to question both. A new leader reviews every contract early, because that is when change is easiest. Appointments are announced one at a time across hundreds of firms, so the ones in your territory slip past.
14. Telltale job posts
A firm too small for an IT department but big enough to need one posts its only IT job, reposts it weeks later, or asks a new hire to run a device-management or AI-assistant rollout. Each of these says one person carries the whole load. A firm hiring someone to hold its outside IT vendors accountable is telling you the current provider is about to be reviewed. Job posts expire fast, and reading them for these patterns is slow.
Group 4: What owners say in public
These signals are the owner's own words, or the owner's silence. They are low in volume and high in value because they hand you the opening line. The what owners say in public page covers how to use each one.
15. Owners on the record
A managing partner describes a technology problem on a podcast or a recorded webinar. Now there is a firm, a quote, and a date, the most specific opening an outbound message can have. Nobody indexes hour-long recordings, so the quote goes unheard.
16. Forums and social posts
Owners and IT managers describe pain in their own words in the places they talk shop. Most posts are anonymous, so this feeds message copy more than list volume. A named firm posting publicly goes to the top of the list. Reading those threads is slow, and useful posts are rare.
17. AI mistakes in local courts
Courts publish rulings on fabricated AI citations. Each one is a dated reason to offer the other firms in that county a governed AI setup: approved tools, retention rules, and a review step before anything is filed. Never name the lawyer involved. Rulings sit in dockets nobody reads for this purpose.
18. Silence on AI
Regulated advisers that disclose no meaningful AI use, while examiners ask for written AI policies, vendor reviews, and training records, are a conversation about being ready for the next exam. Silence is the hardest signal to spot by hand, because there is nothing to search for. You find it only by reading what a firm did not say.
What to do with a signal
A signal is a reason to start, not a promise of a reply tomorrow. Three rules keep it useful.
Follow up over weeks, not once. Nobody buys the day the event happens. A firm that files a merger may not pick a provider until weeks later. A short sequence that names the event, offers something specific to it, and checks back as the date approaches turns a signal into a meeting.
Put signals on top of a list, not in place of one. The sharpest signals are low volume. Those accounts sit at the top of a list built to the MSP's ideal-client definition: size, industry, geography, and service model. The list is the base; signals decide what the first line says. An MSP that chases signals without an ideal-client definition ends up pitching firms it cannot serve.
Treat the reply as the last filter. A signal says a company is probably near a decision. Only the person at the company can say it is. Write the message so a yes or a no is easy to give, then read the replies rather than counting them. The reply, not the signal, is where a prospect becomes a conversation.
This is the model behind the outbound system SiteSmith builds for MSPs: an ideal-client list with signal accounts at the top, worked over weeks, with replies routed to a person who can act.
Where to go from here
Each group has its own page: systems-change signals, filings and public records, people and hiring signals, and what owners say in public. For sending, reply handling, and handoff, read how to build an MSP outbound system.
Sources and editorial note
SiteSmith publishes practical operating guidance and cites external sources for factual industry and security claims. This article is not legal, regulatory, or cybersecurity advice.