Eight signs it is time to leave your IT provider

Why companies stay too long

Changing IT providers feels risky. They hold the credentials, they know the environment, and the transition happens while the business still has to operate. So the bar for leaving gets set unreasonably high, usually somewhere around a catastrophe.

That is the wrong bar. The right question is narrower: is this relationship producing an environment that gets healthier over time, or one that is quietly accumulating problems? Here is how to tell.

1. Nobody can produce documentation

Ask for a current network diagram, an asset inventory, and a list of your licenses and renewal dates. A healthy provider sends these within a day or two because they maintain them as a matter of routine.

If the request produces delay, vagueness, or a promise to put something together, the environment is being managed from memory. That is fragile while they are working for you and genuinely dangerous when the one person who remembers it leaves.

2. The same problem keeps coming back

Some issues are recurring by nature. Most are not. If the same application fails every month and the fix is always the same restart, nobody has looked for the cause.

Fast ticket closure looks like good service on a report and can mean the opposite. A provider measured purely on resolution time has no incentive to spend the afternoon that would end the problem permanently.

3. Every recommendation is a purchase

Sometimes hardware genuinely needs replacing. But if every conversation ends with a quote, and the quotes cluster around one manufacturer, you are receiving sales output rather than advice.

A useful test: ask what they would do if you had no budget for the next two quarters. A good provider will describe what can be mitigated through configuration, policy, and prioritization. A reseller will struggle with the question.

4. You never hear anything until something breaks

Silence is not stability. If months pass with no reports, no patching summaries, no notes about anything they noticed and addressed, the likely explanation is that nobody is looking.

Proactive management generates evidence. You should be able to see that patches were applied, backups verified, alerts triaged, and issues resolved before they reached anyone. Absence of that evidence is meaningful.

5. Backups have never been restore-tested

Ask directly: when was the last time you restored our data to confirm it works, and how long does a full recovery take?

Hesitation here is the single most serious answer on this list. Backups that have never been tested are an assumption, and an untested assumption sitting between your company and a ransomware event is not protection.

6. Everything is billed hourly

Break-fix billing puts your interests and your provider's in direct opposition. They earn more when things go wrong, and prevention reduces their revenue. Most providers on hourly billing are not consciously exploiting this. The incentive works quietly anyway.

A monthly retainer inverts it: stability becomes the profitable outcome. It also makes your costs predictable, which matters more than the hourly rate comparison suggests.

7. Security is treated as a product you declined

If security appears only as an upsell line item, and declining it produced no further conversation, you are carrying risk somebody chose not to explain to you.

You do not need every control immediately. You do need to know which specific exposures you are accepting and why. A provider who lets multi-factor authentication go unimplemented without a written record of that decision is not managing your risk.

8. You have become the escalation path

The clearest sign of all. If your office manager is calling the internet provider, chasing the software vendor, and keeping track of which ticket is unresolved, then the coordination you outsourced has come back to you while you continue paying for it.

What a good transition looks like

If several of these apply, the switch is more manageable than it feels. A competent incoming provider does discovery before anything changes, documents what they find, and sequences the handover so the two arrangements overlap rather than gapping.

Insist on a few things: your credentials placed in a vault you own, documentation delivered as work product rather than a favor, no exclusivity that prevents you evaluating alternatives, and a defined offboarding process written into the agreement at the start. Ask a prospective provider how a client leaves them. The willingness to answer plainly tells you most of what you need to know.