Getting Margins Right: The Essential Mix of Recurring, Product, and Professional Services for MSPs

The episode centers on profit margins and service mix strategies for MSPs, emphasizing the importance of maintaining recurring revenue margins above 50%, preferably targeting 65–70% for long-term sustainability. Industry averages indicate recurring revenue margins as low as 35%, which Speaker B and Speaker C note presents a risk to driving profit down to the bottom line. The discussion identifies that margins tend to erode with organizational growth due to overhead but underscores the necessity of regular price adjustments built into client contracts and regular scrutiny of margin performance as core practices to avoid financial shortfalls. Supporting these observations, Speaker C advises MSPs to gradually move from lower margin brackets to achieve at least 50% in recurring services, acknowledging this transition typically requires sustained effort over several years. For professional services, a margin range of 40–60% is considered attainable, with 50% as the practical target. Regarding income mix, respondents suggest 70% of revenue should derive from recurring services and the remaining 30% from professional or project-based work. Both speakers highlight that smaller MSPs may achieve higher margins, while competitive pressure and organizational complexity often erode these numbers. Adjacent discussions address operational and security challenges. The show covers recent FBI public service announcements warning of increased cyber threats originating from Russian and Iranian actors, specifically targeting government, political, and journalist entities. Speaker C and Speaker B recommend that MSPs communicate only the most relevant advisories to clients to avoid information overload, framing updates as evidence of service diligence rather than sources of alarm. In addition, Microsoft’s new AI security dashboard in Microsoft 365 is reviewed, which uses Defender sensors already present in Windows 11 devices to provide visibility into AI activity and configuration security at no extra cost, provided suitable licensing for Defender is in place. The operational implications for MSPs include the need for rigor in pricing models, clear partnership agreements, and transparent communications with clients about both technology changes and external threats. The recurring emphasis on risk management, margin preservation, and responsible client engagement reflects a harm-reduction mindset. Regular contract reviews, maintaining consultative relationships, and avoiding over-communication of security issues are presented as accountability measures that support stability and trust in MSP operations.Question of the week: What margins should I be targeting? And what is the mix that I should be shooting for? Recurring Professional services Product sales   Talking to clients about international affairs. The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are jointly issuing this public service announcement (PSA) to warn the public about ongoing phishing campaigns by cyber actors associated with the Russian Intelligence Services (RIS) targeting commercial messaging applications. The activity targets individuals of high intelligence value, such as current and former U.S. government officials, military personnel, political figures, and journalists. https://www.ic3.gov/PSA/2026/PSA260320   The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate information on malicious cyber activity conducted by actors on behalf of the Government of Iran Ministry of Intelligence and Security (MOIS). Specifically, MOIS cyber actors are responsible for using Telegram as a command-and-control (C2) infrastructure to push malware targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups around the world. This malware resulted in intelligence collection, data leaks, and reputational harm against the targeted parties. https://www.ic3.gov/CSA/2026/260320.pdf   New AI Security Dashboard for M365. Requires Defender onboarding to be effective  Check it out: https://AI.security.microsoft.com Learn: https://techcommunity.microsoft.com/blog/microsoft-security-blog/security-dashboard-for-ai---now-generally-available/449463   Amy’s class is now available for purchase at Coassemble.  This is her Create your AI Service Package.  The purpose of the course is to consider all of the things that you might want to include in your offering. https://www.thirdtier.net/2026/03/20/create-your-ai-management-package/  Coassemble: https://coassemble.com/c/0ZKD2Z Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.