惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

U
Unit 42
C
Cybersecurity and Infrastructure Security Agency CISA
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Know Your Adversary
Know Your Adversary
S
Securelist
I
Intezer
AWS News Blog
AWS News Blog
L
LINUX DO - 热门话题
P
Privacy International News Feed
Recent Announcements
Recent Announcements
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
博客园 - 聂微东
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Attack and Defense Labs
Attack and Defense Labs
N
News and Events Feed by Topic
The GitHub Blog
The GitHub Blog
C
Cyber Attacks, Cyber Crime and Cyber Security
Schneier on Security
Schneier on Security
N
Netflix TechBlog - Medium
爱范儿
爱范儿
B
Blog
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
C
CERT Recently Published Vulnerability Notes
Hacker News: Ask HN
Hacker News: Ask HN
Google DeepMind News
Google DeepMind News
Engineering at Meta
Engineering at Meta
Blog — PlanetScale
Blog — PlanetScale
WordPress大学
WordPress大学
S
Secure Thoughts
K
Kaspersky official blog
N
News | PayPal Newsroom
O
OpenAI News
Last Week in AI
Last Week in AI
C
Check Point Blog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Cyberwarzone
Cyberwarzone
Application and Cybersecurity Blog
Application and Cybersecurity Blog
T
Tor Project blog
大猫的无限游戏
大猫的无限游戏
Vercel News
Vercel News
D
Docker
Hugging Face - Blog
Hugging Face - Blog
T
Threat Research - Cisco Blogs
Cisco Talos Blog
Cisco Talos Blog
The Register - Security
The Register - Security
博客园 - 司徒正美
Martin Fowler
Martin Fowler
人人都是产品经理
人人都是产品经理
P
Palo Alto Networks Blog

Heimdal Security Blog

Top 6 Managed Detection and Response Providers Cyber-Aware Customers Are Raising the Bar for MSPs and Other Vendors Cyber-Aware Customers Are Raising the Bar for MSPs and Other Vendors How to scale your patches without scaling your team (the patch wave) AI didn't break patching. It showed us patching was already broken. Heimdal Launches MSP Onboarding Wizard to Help Partners Onboard Microsoft CSP Customers in 2 Minutes How Dynamic Defense shuts an attacker out without shutting down the business Static security has run out of road. The case for Dynamic Defense Breaking the MSP Echo Chamber: The Power of Community How attackers built a RAT on a Windows machine using its own .NET compiler Attacker enables RDP, creates admin, erases evidence in ten seconds Heimdal Survey: Executives Four Times More Confident About AI Risk Than the Teams Managing It Your Next Insider Threat May Be an AI Coworker The OSI Model and Its Two Missing Layers Heimdal® Marks Six Years of Consecutive ISAE 3000 SOC 2 Type II Certification The State of AI Risk Management in 2026 AI Will Absorb 99.98% of SOC Triage Within a Year, as 79% of IT teams brace for AI-driven workload shift Top 10 Cybersecurity Companies in Europe Heimdal Expands AI Strategy with AI Wingman and Third-Party AI Containment You Only Know What You’ve Got When Its Gone Nordic MSPs Can Now Access Heimdal’s Unified Security and Compliance Platform Through Elovade OpenClaw Incidents Show Why AI Adoption Pressure Puts Companies at Risk Heimdal Claims Industry First With a Cyber Essentials Control Mapping for PEDM to Help Organisations Prove Least Privilege Five Predictions for Cyber Security Trends in 2026 Heimdal Achieves OPSWAT Gold Certification for Anti-Malware How to Avoid Holiday Shopping Scams (From a Former Cyber Detective) ITDR Best Practices: How to Detect, Prevent, and Contain Critical Identity Threats You’re Not Technical? That Excuse Just Expired! Tool Sprawl Taxes Your Business More Than You Think Heimdal 5.1.0 RC Dashboard: Smarter Automation, Stronger Compliance, and Smoother Control Can Generative AI Be Weaponized for Cyberattacks? Digital Warfare and the New Geopolitical Frontline Nearly 40% of 2024 Ransomware Payouts May Have Gone to Russia, China & North Korea
When Buyers Discount MSPs With One Big Customer
Danny Mitchell · 2025-11-27 · via Heimdal Security Blog

Your biggest customer loves you.

Three years together. They trust you, pay on time, and refer others.

From where you sit, that’s loyalty. From where a buyer sits, that’s a $$$ discount on your exit.

This perception gap kills more MSP deals than bad financials.

Sam Levy saw it constantly when he led tech mergers and acquisitions (M&A) at Drake Star, an investment bank focused on tech.

We talked to him about it on Episode 14 of The MSP Security Playbook.

“They’re like, but no, why would they leave? They love us,” Sam said.

“But you don’t know because your client may have a change in leadership and all of sudden it’s kind of, oh, I’m friends with that other MSP, we’re going to switch. And now you actually don’t have a business.”

Cover art for episode 14 of the MSP Security Playbook, with Sam Leve headshot and title: 'What to Fix Before Your MSP Exit'

Episode 14 of the MSP Security Playbook podcast

Sam’s observation aligns with broader M&A research on how buyers actually quantify concentration risk. The thresholds are specific, and they’re not negotiable.

The Numbers Buyers Actually Use

Investment banking research on MSP valuations establishes clear red-flag thresholds that Sam sees play out in real deals. These aren’t suggestions. They’re dealbreakers.

According to M&A advisory research, any customer generating more than 10 percent of total revenue warrants scrutiny from institutional buyers.

The concern accelerates above 20 percent.

Once a single customer exceeds 20 percent of revenue, a majority of buyers begin requesting structural protections or discounts. Beyond 30 percent, most buyers walk away entirely. Over 40 percent, the business becomes fundamentally unattractive to conventional acquirers.

The valuation math is brutal:

  • Top customer under 10 percent: 4-6x EBITDA
  • Customer at 11 percent to 20 percent: 3.5-5x EBITDA
  • Customer at 20 percent to 30 percent: 2.5-4x EBITDA
  • Customer above 40 percent: 2-3x EBITDA, or no deal

One IT services firm had 60 percent of revenue from a single customer. Despite strong financials, acquirers significantly discounted the valuation.

Some walked away entirely.

After 18 months of diversification work, the company’s valuation multiple improved by 2.2x in the next deal cycle.

That’s not incremental improvement. That’s a different category of business.

Why This Gap Exists

Buyers underwrite risk, not relationships.

If a 40 percent customer leaves after the sale, earnings before interest, taxes, depreciation, and amortization (EBITDA) drops 30 percent to 40 percent. The entire deal economics collapse.

Private equity firms model returns on EBITDA multiples. Losing 40 percent of EBITDA means the acquisition doesn’t hit return targets. Ever.

Sellers think loyalty. Buyers think probability.

What if the customer gets acquired and the new parent has a preferred vendor? What if a new CIO comes in and wants to consolidate vendors? What if the customer faces budget pressure and moves services in-house? What if your point of contact retires and their replacement has a buddy at another MSP?

That’s the gap Sam sees between sellers and buyers. Sellers rely on relationships buyers can’t control. A buyer can’t bank on your personal rapport with the CTO. They can only bank on contract terms, stickiness, and diversified risk.

The consequences of ignoring this risk are documented. According to research on customer concentration and business failure, companies with a single customer above 30 percent of revenue face 47 percent higher bankruptcy risk during sector downturns.

This isn’t theoretical. An analytics firm called Appen thrived on one major AI contract customer. When that customer terminated and moved to in-house development, the business collapsed into insolvency.

The Two Types of Diversification

Sam emphasized that diversification isn’t just about customer count. It’s about customer count AND industry spread.

Customer count diversification: Don’t have a revenue structure where two or three customers are large accounts and the rest are small. Buyers want balanced books where losing one account hurts but doesn’t kill you.

Industry guidance suggests no single customer should exceed 15 percent to 20 percent of revenue.

Industry diversification: Different industries follow different economic cycles. This is your hedge. The sector-specific data shows why this matters:

Manufacturing dropped 15 percent during the 2007-2009 recession. Some sectors, like automotive, fell 35 percent. If you served only manufacturing clients, your revenue tanked.

Construction is highly cyclical. MSPs serving only construction face correlated revenue pressure.

Healthcare is recession-resistant. Healthcare is non-discretionary. People need it regardless of the economy. According to Bureau of Labor Statistics projections, job growth for healthcare IT roles is forecast at 32 percent through 2032, over six times the national average.

Sam put it plainly: “If you’re not a sector focused MSP, maybe diversify in multiple industries so that if real estate is not doing well, you have also clients in oil and gas and you have also clients in other industries.”

When one sector tanks, the others stay stable. That’s the hedge buyers pay for.

How to Start Diversifying Now

If you’re sitting at 40 percent concentration right now, you’re not broken. But you do need a plan.

Run your concentration numbers. What percentage of revenue comes from your largest customer? Your top three? Your top five?

If your largest customer is above 20 percent, you’re in the discount zone. Above 30 percent, you’re in the “most buyers walk away” zone.

Set your target. Optimal: no customer above 15 percent of revenue. Acceptable: no customer above 20 percent.

Understand the timeline. Concentration reduction is not fast. According to M&A advisors who work with MSPs, meaningful improvement takes 12 to 18 months minimum. Optimal improvement takes two to three years.

Year 1: Planning, repositioning, pipeline building. Expect 5 percent revenue lift from new customer acquisition.

Year 2: New customer revenue starts showing in P&Ls. Concentration metrics begin improving.

Year 3 and beyond: Diversification accelerates, metrics hit target levels.

Grow strategically. Don’t add one customer at 10 percent of revenue. Add five customers at 2 percent each. This distributes acquisition risk and reduces concentration faster.

Target industries with different economic cycles. If you serve manufacturing, add healthcare. If you serve construction, add professional services. Spread the risk.

Even If You’re Not Selling

Concentration is a business risk, not just a sale risk.

Churn happens for reasons you can’t control. The customer gets acquired. The new parent consolidates vendors. A new CIO comes in and wants to review all vendor relationships. The customer faces cash constraints and moves services in-house. Your point of contact leaves. Their replacement has a buddy at another MSP.

Industry data shows that best-in-class MSPs keep churn below 5 percent. If you’re concentrated, one customer leaving blows past that threshold immediately.

Real consequences documented in MSP failures: One MSP had 70 percent of revenue from a single customer.

When that relationship ended, the business couldn’t sustain operations. Another had three large clients representing most of revenue. Two moved services in-house, one hit cash problems. The MSP lost revenue equivalent to an entire employee’s compensation.

Resilience matters whether you’re selling in 12 months or 10 years.

Build Resilience, Get Paid For It

Buyers evaluate MSPs through a risk lens most owners don’t use daily. Concentration feels like strength when it’s loyalty. It looks like fragility when it’s dependency.

The numbers don’t lie. Diversified MSPs command 4-6x EBITDA. Concentrated MSPs get two to three times EBITDA or no deal at all. That’s not a small gap. That’s a different category of business.

You want a business that survives losing any single customer. That’s what buyers pay premium multiples for. It’s also what lets you sleep at night.

This is written by Danny Mitchell, head of content at Heimdal. I’m a journalist, not an M&A advisor. The data here comes from research and from talking to people like Sam Levy who do this work every day. Your business is yours. Before you restructure your customer base or start planning an exit, talk to someone who can look at your specific numbers and situation.

Sam’s a good place to start. Find him here on LinkedIn.

Watch the full conversation with Sam Levy on YouTube, Spotify, Apple, or subscribe to get episodes and insights like this delivered weekly.

Author Profile

Head of Content at Heimdal. A journalist by trade who cares about helping MSPs and security teams make better decisions, enjoy their work, and see real results.