Relevance · TAM build · the MSP market

Every managed services provider in your market, judged one at a time.

Most markets aren't written down anywhere. This one now is — sourced from directories and datasets, harnessed into structured evidence, and put through a written qualification rubric that decides, company by company, whether it is actually an MSP. Here is how it was built, what it found, and how to work it.

companies shown are illustrative

32,918

Confirmed managed services providers

QUALIFIED

25,606

Confirmed selling into a local market

78% OF THE LIST

Regions, 35 page languages, judged on identical terms

COVERAGE

Columns on every company — identity, geography, and 13 tagged attributes

PER ROW

Segments you can filter to, today

Security-led

8,240

run a distinct security practice — mssp or both

Compliance-led

8,124

name a framework: HIPAA, ISO 27001, CMMC

Already selling AI

4,916

a named AI service on the page today

No AI anywhere

25,372

site read, nothing about AI on it

Vertical specialists

8,221

not generalist — healthcare, legal, finance

01 · The method

Four stages, and a check
at the end of each.

Nothing here is a single model call. A market gets built by finding companies, turning each one into evidence, judging that evidence against a written standard, and then measuring whether the judgement was right — with the last stage feeding back into the third.

Stage 01

Sourcing

Forty-odd directories, datasets and follower scrapes, deduped on domain into one row per company — with every source that found it kept.

→ a pool of candidate domains

Stage 02

Context harness

Apify for the LinkedIn identity, Firecrawl for the site — a summary plus verbatim spans lifted from the raw page.

→ 21 columns of structured evidence

Stage 03

Processing

The rubric reads the evidence and returns a verdict with its reasoning. Anything thin or disputed escalates to a deep-research agent that reads the live site.

→ a verdict, a reason, and 23 tagged fields

Stage 04

Evals

Independent researchers judge a sample blind, never seeing the rubric. Disagreements become doctrine fixes, and the rubric version increments.

→ a measured accuracy, and the next revision

02 · Sourcing · where the market came from

A market is not one list.
It is forty of them, deduped.

No single source contains the MSP market. It is scattered across vendor partner directories, franchise locators, review marketplaces, official registers and lookalike datasets — each with a different shape, a different bias, and a wildly different hit rate. The build treats sourcing as a portfolio, and measures every source by what survives qualification.

Three source categories · every source below has been scraped

A · Datasets

complete

discolikescraped

lookalike expansionscraped

Job-title reversescraped

openmart · firmablescraped

theirstack · predictleads · sumblescraped

Clay · Prospeo · PDL · Crustdatascraped

A list we built or bought. Lookalike inference, firmographic search, and the job-title inversion — qualifying on a person signal that only exists inside an MSP, so the company arrives pre-qualified.

B · Directories

complete

globalmspdirectory · mspdirectoryscraped

Franchise locatorsscraped

CloudSecureTech · Expertisescraped

Maps · Microsoft partnersscraped

Clutch · Manifest · TechBehemothsscraped

Vendor + distributor partner listsscraped

A public listing site we scraped. A listed partner is contractually verified — not someone who clicked follow. City-organised directories make locality true by construction rather than inferred.

C · LinkedIn followers

complete

SentinelOne · Rewst · IT Gluescraped

ConnectWise · Kaseya · Dattoscraped

NinjaOne · N-able · Pax8scraped

Huntress · Todyl · ThreatLockerscraped

+ vendor pages across the stackscraped

Followers of a vendor's page. A softer signal than a partner listing — someone who follows Datto is probably in the channel — so it feeds the pool and Gate A does the deciding.

Every source · expand to see the full list

▶ADatasets8 sources

A list we built or bought. Lookalike inference, firmographic search, job-ad technographics, and the job-title inversion — finding people who hold titles that only exist inside an MSP (vCIO, NOC technician, dispatch coordinator, PSA administrator) and reversing to their employer, so the company arrives pre-qualified.

Source	What it is	Status
discolike	Lookalike-expansion dataset	scraped
lookalikes	Second lookalike pass	scraped
Job-title reverse	Find MSP-only titles, reverse to the employer	scraped
openmart	Local SMB discovery	scraped
firmable	ANZ-native B2B company + people data	scraped
theirstack	Job-ad technographics — PSA/RMM in job ads	scraped
Clay · Prospeo · PDL	Firmographic search + waterfall enrichment	scraped
BuiltWith	Website technology fingerprinting	scraped

Seed quality decides everything here. The bulk lookalike pass and the second, narrower one use the same technique — and the cleaner seed qualifies at more than twice the rate. Volume from a loose seed is mostly waste.

▶BDirectories21 sources

Source	What it is	Status
globalmspdirectory	Horizontal MSP directory, 23 countries	scraped
mspdirectory.com	Horizontal MSP directory	scraped
CloudSecureTech	City-organised, Google ratings + verified data	scraped
Franchise locators	TeamLogic · CMIT · Computer Troubleshooters	scraped
Google Business Profile	Local-native index — address + phone by construction	scraped
Microsoft Solutions Partner	Largest partner ecosystem in the market	scraped
Clutch.co	Reviews, size band, hourly rate, service split	scraped
The Manifest	Clutch's sister index, different long tail	scraped
TechBehemoths	43 countries — best non-US coverage	scraped
Cloudtango	Per-country MSP Select lists	scraped
Expertise.com	Curated 'Best IT Services in <city>' pages	scraped
discovermsps	Per-country pages incl. Netherlands	scraped
MSPAlliance	Association + MSP Verify accreditation	scraped
Pax8 marketplace	Distributor marketplace + partner directory	scraped
Vendor partner locators	ConnectWise · Kaseya/Datto · NinjaOne · N-able	scraped
Security partner locators	Huntress · SentinelOne · ThreatLocker · Sophos	scraped
Elioplus	Channel-partner aggregator across many vendors	scraped
Robin Robins	Largest MSP CEO peer group; owner-led members	scraped
Canada directories	ManagedServices.ca · ManagedByte · mspdatabase	scraped
UK Companies House	SIC 62020 — free, official, bulk-downloadable	scraped
SAM.gov	NAICS 541513 — Computer Facilities Management	scraped

Ranking lists are a negative filter, not a source. Channel Futures MSP 501 · CRN MSP 500 · MSSP Alert Top 250 skew large and national — the opposite of the ICP. Scraped to build an exclusion list, they raise the qualify rate of everything else.

▶CLinkedIn followers27 vendor pages

Followers of a vendor's page — a softer signal than a partner listing. Someone who follows Datto is probably in the channel; the rubric does the deciding. The spread across vendor pages is enormous, and it tracks brand size inversely.

Source	What it is	Status
Huntress	Cybersecurity vendor	scraped
Datto	PSA + RMM + backup	scraped
Acronis	Backup + security	scraped
SentinelOne	Cybersecurity vendor	scraped
Rewst	Direct competitor	scraped
ASCII Group	Peer group (gated community)	scraped
Gradient MSP	MSP automation platform	scraped
N-able	RMM	scraped
IT Glue	Documentation vendor	scraped
ConnectWise	PSA	scraped
NinjaOne	RMM	scraped
MSP Geek	Independent community	scraped
Pia	Direct competitor	scraped
SuperOps	PSA + RMM	scraped
Right of Boom	Security conference	scraped
CrowdStrike	Cybersecurity vendor	scraped
Pax8	Marketplace	scraped
Hatz AI	AI platform for MSPs	scraped
MSPbots	Direct competitor	scraped
Syncro	PSA + RMM	scraped
Hudu	Documentation vendor	scraped
Resolve	Direct competitor	scraped
Managed Services Summit	UK event	scraped
MSP Global	EU event — the only EU-oriented source	scraped
ProVal Technologies	MSP consultant	scraped
Mitzo.Tech	Direct competitor	scraped
Neo Agent	Direct competitor	scraped

The biggest brand page is the worst source. A Kaseya-scale follower base attracts vendors, press and jobseekers alongside MSPs, while a niche documentation or automation vendor pulls almost pure channel. Volume and density run in opposite directions.

What sourced best · measured where a source ran at scale

lookalikes, clean seed

96.5%

globalmspdirectory

88.3%

vendor followers, niche

81.7%

mspdirectory.com

66.1%

lookalikes, bulk seed

38.2%

vendor followers, mega-brand

6.1%

Qualify rate — the share of a source's rows that survived Gate A, from the build's own telemetry. The spread is the strategy: a verified directory listing beats a lookalike model, and a clean seed beats a big one. The same lookalike technique scores 96.5% or 38.2% depending on nothing but the seed; the same follower scrape scores 81.7% on a niche vendor and 6.1% on a mega-brand page that attracts everyone.

Aggregation · forty-odd sources become one row per company

◇

Scrape

Each source on its own schedule and its own shape — HTML tables, JSON APIs, paginated city pages, partner locators behind a browser session.

→

≡

Normalise

Every row reduced to a common spine: domain, name, whatever geography and size the source carried, and the source tag itself.

→

⧉

Dedupe on domain

The same company appears in a directory, a follower scrape and a dataset. One row survives; every source that found it is kept as an array.

→

⊞

Enrich

The surviving row goes through the harness once — LinkedIn match, then site scrape — regardless of how many sources contributed it.

→

✓

Classify

One rubric pass. One verdict. The source array rides along, so any qualify rate can be recomputed per source afterwards.

Why dedupe on domain and keep the array: overlap between sources is not waste, it is corroboration — and it is the only way to measure which source is actually worth running again. A company found by four independent sources is a different prospect from one found by a single lookalike pass.

03 · Context harness

A domain is not evidence.
Something has to go and look.

Between a raw domain and a verdict sits the harness: the machinery that turns a URL into structured, quotable evidence. The rubric can only be as good as what the harness hands it — and most of the loss in a build like this happens here, not in the judgement.

STAGE 01

Apify · LinkedIn

The company's own self-description — which carries managed-services language surprisingly often when the website buries it.

DescriptionSpecialtiesIndustryEmployees

medium trust

STAGE 02

Firecrawl · summary

A ≤350-word English summary of the homepage, navigation and footers stripped, plus extracted offerings and verticals.

Clean MarkdownCore OfferingsICP

highest trust

STAGE 03

Firecrawl · observed

Verbatim spans lifted from the raw page. All nineteen locality signals fire from here — never from the summary.

PhonesAddressesPlaces servedOnsite claims

verbatim

FALLBACK

Deep-research agent

When the harness comes back thin, the row escalates to an agent that reads the live site properly. Full detail in Processing, below.

~90s/rowquotes its sources

the escalation path

Where the harness loses real providers · measured, not theorised

Failure

What happens

Fix

Evidence off the homepage

A provider's homepage compresses the managed offering into one line while the pricing or support page carries the proof — per-device tiers, an ITIL desk, SLAs.

escalate to the agent

Bot-blocking

Sites returning 403 to a plain fetch and 200 to a browser user-agent.

browser UA

Apex vs www · JS-rendered

Pages that 404 on one host variant and resolve on the other; React shells whose copy lives in the JS bundle.

retry both · read the bundle

Redirects & dead rows

Domains 301'd to acquirers, dissolved companies, hijacked domains now serving spam.

liveness gate upstream

In every confirmed recovery across two independent evaluations, the qualifying evidence was not on the homepage. Following four obvious sub-paths, sending a browser user-agent, and rendering JavaScript raises the ceiling on everything downstream.

04 · Processing · the rubric

One definition, four tests,
and a question that settles it.

Qualification is not keyword matching. The rubric is a written constitution — seven documents, a locked vocabulary, and a validator — that decides what a company is and then uses vocabulary as evidence for that judgement, never as the verdict.

The definition everything hangs on

A managed services provider takes ongoing operational responsibility for other organisations' IT, under a continuing commercial relationship, using its own people and systems, delivered as a repeatable service to many clients.

Security counts — an MSSP is a provider whose managed domain happens to be security. Cloud, network, backup and endpoints all count. Size, geography and language never disqualify: a five-person shop and a national provider are both providers.

Seven documents, one system · each answers a different question

00 · precedence canon

Which rule wins?

The constitution. Authority order, conflict resolution, the standing laws. Defines no field and no judgement.

01 · output contract

What shape is the answer?

23 keys, their exact order, types, the false-branch empties, and 30 cross-field consistency rules.

02 · enum registry

Which words am I allowed?

Every locked value and its meaning. Never says when a value applies — only that it exists.

03 · qualification doctrine

How do I decide?

Gate A and its four tests, the disqualifiers, locality scoring, tag derivation, confidence. Never invents a value.

04 · field interpretation

What may I read it from?

Which surface can evidence what, the trust order between them, and the confidence caps that follow. Never reaches a verdict.

05 · runtime prompt

What do I do, right now?

The only file that executes. Compiles the doctrine into ordered steps. Introduces nothing not already in 00–04.

A rule written in 03 with no matching block in 05 does not run. That failure mode is this pack's characteristic defect, so a parity script checks the two against each other on every edit — alongside a validator that enforces the output contract mechanically.

Two independent questions · never conflated

Gate A — hard gate

Is it a managed services provider?

A definition match, not a keyword match. Read everything, decide what the business is, then use vocabulary as evidence for that judgement — never as the verdict.

Optimises for precision. A false positive here pollutes the whole list, so genuine uncertainty returns false — bounded by a counterweight so that evidenced operational responsibility still stands.

Gate B — scored attribute

Does it sell locally?

Nineteen weighted signals — phones by position, addresses, served-area markup, on-site claims — summed to a 0–10 score against a threshold of 6. It never affects Gate A.

Optimises for honesty, not precision. Three states: if the page could not be read the answer is unknown, never no. That distinction is why the two are emitted separately.

Gate A · the four tests, all of which must hold

Continuing responsibility

End the relationship tomorrow — does the client lose ongoing operations, or just a finished deliverable?

They operate it

The provider's own team and tooling run it. People placed under the client's direction fail.

Recurring model

Subscription, retainer or per-seat, open-ended. Hourly rates and milestone billing fail.

Repeatable, many clients

A standardised service sold repeatedly. Bespoke-per-client fails.

The one test that does the most work

Delivery-model test

What does the client receive each month — and who runs it?

A service the provider operates → a provider. Named people, a finished build, or a report → not. This single question separates a real MSP from a staffing firm with a managed-services page, a reseller whose SOC belongs to a vendor partner, and a consultancy on a subscription. Measured across eighteen hand-researched companies, it separated every one correctly, in both directions.

✓

Qualifies

Operated service. A managed SOC, RMM monitoring, a service desk, patching, managed endpoints, managed DBA or cloud

Recurring by construction. Per-seat, per-device, flat monthly, open-ended

Their people and systems. The provider's tooling and staff run it

Delegated roles. An outsourced CISO or DPO held continuously on a stated retainer

Narrow but operated. Security-only, cloud-only or DBA-only still counts

Ancillary lines are fine. A repair bench, a dev line or a product does not undo a provider

Does not

Named people. Staffing, staff augmentation, contract-to-hire — however it is billed

Terminal work. Assessments, audits, pen tests, roadmaps, migrations, training

Interim, not retained. "Fractional", "1 day a month", day rates — a substitute for a hire

Advice on a subscription. A monthly retainer over policies and reports, with nothing operated

Someone else's systems. Tuning the client's tenant; working on government-furnished tooling

Upstream of a provider. Software sold to MSPs; a reseller fronting a vendor's SOC

Traps the rubric is built to survive · vocabulary lies in both directions

"Managed Services" · Silver / Gold / Platinum tiers · subscription pricing

A staffing firm. The deliverable is "a dedicated team of certified talent". Recurring billing never converts labour supply into a managed service.

Managed Firewall · Managed IDS/IPS · Managed Detection & Response · 24×7×365

A reseller. The SOC belongs to a vendor partner. The firm self-describes as a value-added reseller on its own about page.

"Governance as a Service" · fixed-fee monthly packages · "continual"

A consultancy. Its own ICP names the client's MSP as a party it works alongside. Someone else runs the IT.

Hourly IT support · console repair · TV repair · a rural high street

A real MSP. Per-device monthly tiers, bundled support hours, 24/7 cover, HIPAA and PCI clients. The repair bench is a side line.

"An innovative consulting firm" · French-language site · own software products

A real MSSP. It "designs, operates and publishes" — with delegated CISO and DPO roles on recurring monthly retainers.

A thin homepage · a five-person team · no pricing anywhere

A real MSP. The services page carries the full RMM stack, a customer helpdesk portal, patch management and EDR.

The second engine · deep research, when the rubric can't decide

The fallback

Two engines, not one. The cheap one runs everything. The expensive one settles what it can't.

The same system that produced the ground truth in the evals runs in production as an escalation path. Any row the rubric flags as thin, low-confidence or a judgement call goes to an agent that reads the live site properly — and comes back with quotes. ~1s per company against ~90s, so it is spent where it changes an answer.

The rubric reads one row — a ≤350-word homepage summary and the LinkedIn fields. It is fast, deterministic and right about seven times in eight. Its one structural blind spot is that the qualifying evidence is very often not on the homepage: across every confirmed miss in this build it sat on a pricing page, a services page, inside a JavaScript bundle, or behind a redirect.

What it does

Goes and reads the site properly

Fetches the homepage, then the services and pricing pages — including language variants — with a browser user-agent, following redirects, retrying www against apex, and pulling copy out of JS bundles when the DOM comes back empty.

Every verdict comes back with verbatim quotes and the URL each came from. That is the audit trail: you can check it rather than trust it.

When to run it

Three queues, in order

1. insufficient_evidence — the scrape failed, not the company.
2. low confidence — the rubric flagged its own thin evidence.
3. The judgement calls — consultancy, break-fix, specialist.

Roughly 90 seconds and one live fetch per company, against about a second for the rubric. It is the appeal court, not a replacement — spent only where it can change an answer.

05 · Evals · how well it works

Measured against blind ground truth,
not asserted.

A rubric that grades its own homework proves nothing. So the qualification agent was never allowed to be its own referee: a second, independent system produced the answers, and the rubric was rewritten until it matched them.

Two models, two jobs · and they were not allowed to agree by accident

Ground truth

Deep research · Fable

Given a domain and nothing else. It browses — homepage, services, pricing, language variants, redirects, JS bundles — and returns a verdict with verbatim quotes and the URL each came from. Expensive, slow, and answerable to primary evidence rather than to a rubric.

It never saw the rubric. It could not be tuned toward the rubric's answer, because it did not know what that answer was.

The system under test

The rubric · Luna

Given one row of pre-gathered context — the LinkedIn fields and a website read — and the seven governing documents. It never browses. Roughly a second per company, and it must reach the same verdict from a fraction of the evidence.

A different model family from the referee on purpose. Agreement between two different architectures is evidence; agreement with yourself is not.

The loop · run until the disagreements ran out

Step

What happens

Output

1 · Label

Deep research judges a batch from live sites, with quotes. These become the answer key.

ground truth

2 · Run

The rubric classifies the same batch from harness context alone, blind to the key.

verdicts

3 · Diff

Every disagreement is read individually. Which is right, and why did the rubric reach the other answer?

the defect list

4 · Amend

The doctrine changes — a rule bounded, a disqualifier narrowed, a worked example added from the row that failed. Never a patch for one company.

a new version

5 · Repeat

Re-run the whole batch, including everything that already passed, so a fix cannot quietly break something else.

→ back to 2

Where the loop stopped

Full agreement between the cheap rubric and the expensive referee.

Not "close enough" and not an average — the loop ran across hundreds of hand-researched rows and more than a dozen rubric revisions (v2.0 → v4.6), until every row the deep-research agent judged, the rubric judged the same way, from a fraction of the evidence and a fraction of the cost. That is the entire point: a ~1-second-per-row system that reproduces a ~90-second-per-row investigation. Convergence is what licenses running it across tens of thousands of companies.

What the disagreements taught · every one became a rule

Change

The disagreement behind it

Effect

Counterweight law

Three standing instructions pushed toward rejection and none pushed back. Evidenced operational responsibility now stands unless a disqualifier is shown to be the primary identity.

structural

Delivery-model test

Promoted to run before any disqualifier — what does the client receive each month, and who runs it? The one question that resolved the hard cases in both directions.

recall + precision

Absence gates

"Consultancy" and "break-fix" were firing on advisory register and on the word hourly. They now fire only on the absence of recurring delivery.

the largest single class

Single-domain rule

Operating one client-owned IT domain — managed DBA, cloud, network, backup — is still managed services, even as the only practice area.

narrow providers

Worked examples

Rescued rows written back into the runtime prompt as examples. The set previously showed no hybrid ever passing, so the model had no template for accepting one.

largest driver

The traps run both ways, which is why convergence is hard. A staffing firm publishing Silver/Gold/Platinum "managed services" tiers is not a provider. A reseller whose SOC belongs to a vendor partner is not a provider. A rural repair shop with per-device monthly pricing is one. Vocabulary decides nothing; the delivery model decides everything.

06 · What the qualified list looks like

The shape of the market,
once you can see all of it.

Qualification produces more than a yes. Every confirmed provider carries a tagged profile — where it sells, what it runs, who it serves, what it has certified, and how it talks about AI. Read together, these are the segmentation axes: the difference between one list of MSPs and a market you can cut.

Region

32,918 companies

USA

52%

19%

13%

AUS

Half the market is US. The EU tail is deeper than it looks — France, the Netherlands, Germany, Italy, Poland and Spain each carry real volume, and 35 page languages appear across the list. Non-English sites were judged on identical terms.

Practice areas

16-value registry · 6.2 avg

service_desk_support

82%

cyber_security

76%

cloud_services

70%

professional_services

62%

network_connectivity

60%

backup_recovery

49%

monitoring_observability

38%

collaboration_comms

35%

servers_virtualisation

26%

endpoint_device_mgmt

26%

compliance_risk

24%

Breadth is the qualifying signal, not any single area. Only 3.5% of the list runs one or two practice areas; the median provider runs six. That is what separates a managed practice from a specialist.

Provider type

msp · both · mssp

msp

75%

both

21%

mssp

Security is nearly universal but rarely the whole business: 75.8% run a cyber_security practice, while only 4.5% are security-only. The 20.6% marked both run broad managed IT and a separately marketed security practice.

Vertical focus

max 3 tags, or generalist

generalist

75%

healthcare

12%

financial_services

government_public_sector

professional_services

manufacturing

legal

education

nonprofit

generalist is a real answer, not a gap. Three quarters serve whoever is nearby. The vertical-focused quarter is where a compliance-led message lands hardest — healthcare alone is 3,886 providers.

Governance posture

named frameworks only

Any framework named

25%

nist2,891 hipaa2,689 iso270012,528 soc21,598 pci_dss1,440 gdpr1,355 cmmc1,015 cyber_essentials983 nis2404 essential_eight288

Posture is true only when a framework is actually named — compliance talk with nothing nameable stays false. The mix is regional: Cyber Essentials is UK, Essential Eight is AU, CMMC and HIPAA are US. 8,124 providers name at least one.

AI posture

observed · gates nothing

ai_absent

77%

ai_active

15%

ai_aware

ai_led

The wedge is right here. 77% of the market shows no AI on its site at all, while 4,916 already sell a named AI service to clients. Two completely different conversations, and the column tells you which is which. ai_led (0.5%) is the only value that ever disqualified.

One qualified company, as the sheet stores it

practice_areas = [ cyber_security, cloud_services, endpoint_device_management, network_connectivity, servers_virtualisation, service_desk_support ]
stack_tools = [ "microsoft 365", "datto", "connectwise", "aws" ] · provider_type = both · ai_posture = ai_active

Arrays, not scores. Six practice areas is the median; ten is a full-stack provider and two is a focused one. Because every tag is a controlled value from a locked registry, the whole list is filterable and countable — you can cut the market by what providers actually run, not by what a description happened to say.

Stack tools observed · named tools only, never inferred

Microsoft 3657,849 Azure3,604 AWS2,450 Cisco1,398 VMware1,316 Datto1,117 ConnectWise1,000 SharePoint996 Microsoft Teams909 Fortinet834 Veeam791 Google Workspace626 Sophos553 SentinelOne448 Ubiquiti369 Cisco Meraki290 Acronis265 WatchGuard258 CrowdStrike171 Huntress170 Kaseya153

Empty is normal and never counts against a company. A tool is only recorded when the page names it, so 15,742 of 32,918 carry one. Most keep the rest behind the login — but where it appears it is a precise targeting hook: a ConnectWise shop and a NinjaOne shop are different conversations.

07 · Working the list

One file. Every company
fully described.

Everything on this page is computed from the delivered list — no sampling, no estimates. One row per company, deduped on domain, twenty columns each, every tagged value drawn from a locked registry so the whole file filters cleanly.

the list

Rows

32,918

Confirmed managed services providers. Being in the file is the verdict.

Columns

Identity, geography, and thirteen tagged attributes per company.

Unique key

Domain

Deduped across all 56 sources — every source that found a company was kept as provenance.

Vocabulary

locked

Every tag comes from a closed registry, so filters can't miss on spelling or synonyms.

What ships where. Every figure and recipe on this page is computed from the full 32,918-row list. The downloadable pack carries a 1,642-row sample — 5%, region-stratified within 0.1% of the real mix — so you can run these exact filters yourself. The full list was delivered to the client this map was built for; the sample is drawn to match its region mix.

What's next — the contact layer. This list is companies, deliberately: the map before the people. The next build attaches named decision-makers to every qualified provider — starting from the roles that only exist inside an MSP, so the contact validates the company as much as the company validates the contact.

Filter recipes · real counts from the file

Local providers

Local confirmed = TRUE → 25,606

The site positively evidenced a local trading area — phones, addresses, served-area markup, on-site claims.

Security-led

Provider Type IN ("mssp","both") → 8,240

A distinct security practice — for a security-forward message rather than a general managed-IT one.

Compliance-led

Governance confirmed = TRUE → 8,124

Then slice by framework: hipaa 2,689 (US healthcare) · cyber_essentials 983 (UK) · essential_eight 288 (AU).

Already selling AI

Ai Posture = "ai_active" → 4,916

A named AI service on the page today — a partner or enablement conversation.

No AI anywhere

Ai Posture = "ai_absent" → 25,372

Site read, nothing about AI on it — the greenfield conversation, and 77% of the market.

Full-stack providers

Practice Areas Array has 8+ entries → 9,537

Broad operators — the widest attach surface for any tool or service sold into the stack.

Vertical specialists

Vertical Tags NOT CONTAINS "generalist" → 8,221

Healthcare 3,886 · financial services 2,554 · legal 1,602 — where a vertical-specific message lands hardest.

Five ways to misread this sheet

Reading Number Of Employees = 0 as zero staff

It means LinkedIn did not report a headcount. Filter on it as a size floor and you silently drop thousands of real providers.

Reading Local confirmed = FALSE as "national"

It means locality was not evidenced on the page. Some are national; many simply have a thin website.

Counting Stack Tools without normalising

"microsoft 365", "microsoft_365" and "office 365" are separate values. Any raw count understates by about a third.

Treating ai_absent as a weak lead

It is 77% of the market and means the site says nothing about AI — for most sellers that is the opening, not the disqualifier.

Filtering on Country Code for language

Use Page Language — a Belgian or Swiss provider may publish in any of three. 35 codes appear across the list.

Reading empty arrays as negatives

Stack Tools = [] and Governance registry = [] mean the page named nothing — most providers keep their stack behind the client login.

08 · Run it yourself

The whole system, on your machine.

The rubric is plain Markdown — not a black box and not a service. Change what qualifies, re-run it, and check your edit with the two consistency scripts that ship with it.

Three pieces · they do different jobs

01-rubric/

The processing agent

~1s per company

Judges a company from context already gathered — the LinkedIn fields and the website read. It never browses. This is what produced the verdicts in the list.

7 documents · 32,918 rows judged

02-research-agent/

The fallback

~90s per company

The same job, done expensively. It goes and reads the live site — sub-pages, redirects, JS bundles — and quotes its sources so you can check it.

reads the live site · quotes sources

05-howto/

The column guide

read this first

Every delivered column explained — what it means, how it was derived, and how to filter on it. The one to open when the question is about the data rather than the method.

+ six filter recipes

Two ways to get it · identical contents

Route A · terminal

One command

Pulls the pack into your current directory. Nothing to install, nothing to unzip.

$ curl -fsSL https://tam-build.relevanceai.io/msp/tam-map-msp.tar.gz | tar xz && cd tam-map-msp && echo "Unpacked. You are now in tam-map-msp/. Start with START_HERE.md"

The terminal confirms with Unpacked and leaves you inside the folder. Then point any assistant at it: claude "Read LLM_GUIDE.md and help me work this data." — or open the folder in your editor and ask the same thing.

Route B · download

The zip

For an editor with an AI assistant — or to upload straight into a ChatGPT or Claude project as knowledge.

Download the pack →

Into a project, upload LLM_GUIDE.md, SHEET_INTERPRETATION.md and your CSVs. Send the markdown, not the PDFs — same content, a fraction of the size.

LLM_GUIDE.md        ← paste this to any assistant first
START_HERE.md       per-route instructions
01-rubric/          the processing agent · 7 docs
02-research-agent/  the fallback
03-sourcing/        sourcing paths · context harness
04-data/            the qualified list + schema
05-howto/           reading the sheet · VS Code

Plain Markdown and Python. No account, no service, no vendor lock — the rubric is documents you can read, edit and re-run.

Orient the assistant

LLM_GUIDE.md is written for the model, not for you — it explains the three pieces, the definition, and the rules that stop it misreading a verdict.

Read the verdicts

Open 05-howto/SHEET_INTERPRETATION.md — every column, six filter recipes, and the five common ways to misread the sheet.

Recover the rejects

Hand the assistant 02-research-agent/ with 3–9 domains. It reads the live sites and comes back with verbatim quotes and source URLs.

Classify new companies

Point it at 01-rubric/ and give it a batch — the same seven documents that produced this list, run on whatever you bring.

Change what qualifies

Edit 03_qualification_doctrine.md and 05_runtime_prompt.md together, then run parity.py and check_pack.py. A rule in 03 with no block in 05 does not run.

Every managed services provider in your market, judged one at a time.

Four stages, and a checkat the end of each.

A market is not one list.It is forty of them, deduped.

A domain is not evidence.Something has to go and look.

One definition, four tests,and a question that settles it.

Measured against blind ground truth,not asserted.

The shape of the market,once you can see all of it.

One file. Every companyfully described.

The whole system, on your machine.

Four stages, and a check
at the end of each.

A market is not one list.
It is forty of them, deduped.

A domain is not evidence.
Something has to go and look.

One definition, four tests,
and a question that settles it.

Measured against blind ground truth,
not asserted.

The shape of the market,
once you can see all of it.

One file. Every company
fully described.