Most buying signals live in systems and filings. Two live in people. This page covers signals 13 and 14 from our pillar, 18 buying signals that show a company is about to change IT providers: a new operations or compliance leader in their first months, and the job posts that show a firm is carrying more IT than it can hold.
Both are easy to describe and slow to spot by hand. A leadership change is one line on a company page. A job post is one listing among thousands. An outbound system can watch for both across a whole territory.
A new chief operating officer or compliance officer is a buying signal for managed IT because that person inherits two things on day one: the current IT provider and the next audit or regulatory exam. They did not choose the vendor, and their first months are the one period when questioning it is expected. Job posts are a second people signal. A firm posting its only IT job, reposting that job, or asking a new hire to run a device-management or AI-assistant rollout is showing that one person carries the whole technical load. A firm hiring someone to hold its outside IT vendors accountable is signaling that the current provider is about to be reviewed. Both signals are low volume, and neither leads to a purchase on the day it appears.
1. The new COO or compliance officer in their first months
When an operations or compliance leader starts, nobody hands them a scorecard for the IT provider. They get a contract and an invoice. Then they ask what a new person is allowed to ask: what do we pay, what do we get, and are we ready for the next exam?
That last question is the sharp one at regulated firms. Registered investment advisers and broker-dealers must keep a written incident response program that covers oversight of their service providers, and must notify affected customers of a breach within 30 days. Securities and Exchange Commission (SEC) examination staff has said it will assess whether firms have policies to supervise their use of AI. Paid tax preparers must have a written security plan for client data. The compliance officer produces that paperwork, and the IT provider supplies most of it.
A provider that cannot produce that paperwork on request is on its way out, and the new leader is the one person paid to say so. This is slow to spot by hand because leadership announcements are scattered across company pages, local press, and professional profiles.
2. The four telltale job posts, and what each one means
A job post is a firm telling the public what it cannot do in house. Four patterns matter, and each points to a different service model. All four hide in the description, not the title, so finding them by hand means reading every listing from every firm in the territory and remembering which ones you saw before.
- The only IT job. A firm big enough to need one IT person and too small to need two. The hire will be the whole department. Fill the role, and the offer is co-managed IT, because a lone hire needs a bench, a backup team for nights and vacations. Leave it open, and the offer is full managed IT.
- The repost. The same job, listed again. The first hire fell through, or nobody applied at that pay, and the work did not wait. Co-managed is the bridge while they keep hiring. If the reposting continues, a provider costs less than an empty chair.
- A device-management or AI-assistant rollout in the description. The firm plans to hand a project to someone who has not started. Support for Windows 10 ended in October 2025 and the paid extension doubles in price every year. An AI-assistant rollout brings single sign-on, retention settings, and a use policy. Co-managed covers the project. Full managed is the answer when nobody will run the result.
- The vendor-accountability hire. An IT manager or operations director whose description says "manage outside IT vendors." The firm wants someone to watch the provider, so the provider is about to be reviewed. Most often this is a full managed replacement with the new hire as the buyer, and sometimes co-managed with the hire as internal owner.
3. How to open the conversation with each
Every opener follows one rule: refer only to the public fact, ask one question, and never claim to have found a problem you have not seen.
The new leader. Congratulate them, then ask about what they inherited. "Most operations leaders inherit an IT contract they did not pick. If a second set of eyes before your next exam would help, I am glad to share what we look for."
The only IT job or the repost. Offer the bench. "When that person starts, they will be the whole department. We work alongside single IT hires so after-hours does not land on one person."
The rollout post. Talk about the project. "Your listing mentions a device-management rollout. Here is what usually goes wrong in the first month."
The vendor-accountability hire. Be the comparison point, not the replacement. "If you are building a scorecard for outside IT, here is the one we hand our clients."
4. Caveats
Nobody buys the day the announcement or the job post appears. A new leader needs weeks to learn the firm before touching a vendor, and a hiring process takes weeks on its own. Follow-up runs over weeks, not once.
The sharpest signals are low volume. They sit at the top of a list built to the MSP's ideal-client definition. They are not the whole list.
Not every post is a signal. A firm with an IT team adding a fifth person is growing, not struggling. A new COO with strong internal IT may have no vendor to review. The regulatory points above apply only to the right firm types: SEC material to registered advisers and broker-dealers, the security-plan rule to paid tax preparers.
Where to go from here
People signals pair well with what owners say out loud: see podcasts, forums, court records, and silence on AI. For the operating model these signals feed, see how to build an MSP outbound system.
Sources and editorial note
SiteSmith publishes practical operating guidance and cites external sources for factual industry and security claims. This article is not legal, regulatory, or cybersecurity advice.