12 IT Provider Red Flags to Catch Early

Most businesses that fire an IT provider say the same thing afterward: the signs were there for a year. Not the dramatic ones, the outage or the lost data, but the small ones, the ones that were easy to explain away because switching felt harder than tolerating.

This is the companion to our guide on the nine signs you should fire your IT provider. That article is about relationships that are already broken. This one is about catching the trajectory earlier, while the fix is a hard conversation instead of an emergency. Here are twelve red flags worth acting on the first time you see them.

1. Onboarding was a login, not a project

A serious provider starts by documenting your environment: every device, every account, every vendor, every credential. If your onboarding was "send us your passwords and call when something breaks," they never learned your business. Everything after that is guesswork billed by the hour.

2. There is no ticket system, or nobody uses it

Texting one technician feels personal and fast, until that person is unavailable and there is no record of anything. No ticket history means no accountability, no trends, and no way for a second engineer to pick up where the first left off. If you cannot see a list of your open issues right now, that is a flag.

3. Response expectations were never written down

"We usually get back to you pretty quick" is not a service level. You want stated response targets by severity, even informal ones. Providers who resist putting a number on paper are keeping their options open at your expense. If yours has gone quiet entirely, our guide on what to do when your IT provider is not responding covers the escalation ladder.

4. You have never seen your own documentation

Ask for a copy of your network documentation and password inventory. The answer tells you everything. A good provider hands it over, because it is yours. A provider who stalls, or admits it does not exist, has made your business dependent on their memory. That dependency is the raw material of every data hostage situation we see.

5. Admin accounts live under their email addresses

Check who owns your domain registrar, DNS, Microsoft 365 or Google Workspace admin, and backup portal. If those accounts are registered to the provider's email instead of an address your business controls, leaving them later means recovering your own identity from a third party. Fix this one immediately, whoever your provider is.

6. Patching and backups run on faith

Ask two questions: when was the last patch cycle, and when was the last successful backup restore test? Not backup run, restore test. If the answers are vague, your protection is theoretical. This is usually not malice, just drift, but drift is exactly what you pay a provider to prevent.

7. Every fix is a restart

Restarts resolve symptoms. If the same issue returns weekly and the answer is always a reboot, nobody is doing root cause work. Watch for the phrase "keep an eye on it": it usually means the investigation just ended.

8. Projects get quoted but never scheduled

The migration that has been "next quarter" for three quarters. The firewall replacement that never lands on a calendar. Providers who are stretched thin park non-urgent work indefinitely, and the flag is not the delay itself, it is that you have to keep asking.

9. The bill grows without a conversation

New line items appearing without discussion, per-user counts that never get trued down when people leave, "supplies" and "management fees" nobody explained. None of these is fatal alone. Together they tell you how the relationship will handle money when something big comes up. Our breakdown of what IT support should cost a small business gives you market ranges to compare against.

10. Security questions get answered with brand names

Ask what protects you and listen for the shape of the answer. "You have SentinelOne" is a product name. "Every device runs managed endpoint protection, MFA is enforced on all accounts, and here is our patching cadence" is a program. Providers who answer with brand names often stopped thinking after the purchase.

11. Staff turnover keeps resetting your history

Every few months a new technician asks how your office is set up. If institutional knowledge about your business keeps walking out their door, you are paying tuition on the same education repeatedly, and documentation clearly is not happening behind the scenes.

12. Renewal terms quietly got longer

Watch for auto-renewing multi-year terms, 90-day notice windows, and early termination fees appearing in renewal paperwork. Confident providers do not need to lock the exits. If your agreement got harder to leave at the same time service got worse, that is not a coincidence, it is a strategy.

Two or three flags? Start quietly

You do not need to confront anyone or announce anything. Start by getting your own house keys back: confirm your business controls its registrar, DNS, and admin accounts. Then get a second opinion. We will map your environment and hand you a written switch plan within 48 hours, free, whether you use it or not. If you do decide to move, most switches take one to three weeks (here is exactly how the timeline works), we onboard in parallel so nothing goes down, and we make the breakup call so you never have to.