Hiring an IT or security provider is uncomfortable, because the thing you are trying to evaluate is the thing you are hiring them for. You cannot easily judge whether their technical answers are good.
So do not try. The questions below are useful precisely because you can evaluate the answers without being technical. They test whether a provider is straight with you, and whether they think about your business or just their stack.
We are a provider ourselves, so read this with appropriate scepticism. It is still the advice we would give a friend.
“What would you do in the first month?”
You are listening for whether they want to understand your business before changing it.
A good answer involves finding out what you have, what matters most, and where the real exposure is, before recommending purchases. A weaker answer is a product list in the first meeting, before anyone has asked what you do.
Be a little wary of certainty that arrives too early. Anyone who knows exactly what you need before looking is selling from a catalogue.
“What are you not going to do?”
Good providers have edges. They will tell you what sits outside their competence and who they would bring in.
A provider who claims to do everything equally well, across every technology, at every scale, is either very large or not being straight with you. Willingness to say “that is not our strength” is a strong signal.
“Who actually does the work?”
The person selling is often not the person delivering. Ask who you will deal with day to day, what happens when they are on leave, and whether work is subcontracted or offshored.
None of those answers is automatically bad. Not knowing, or being cagey, is.
“What happens when we leave?”
This one is revealing, and it is the one people forget to ask while feeling optimistic at the start.
Ask directly: if we part ways, do we keep our licences, our data, our domain and our documentation? Who holds the administrator credentials for our own systems?
You should own your own tenancy, your own domain, and your own admin access. A provider who holds those in their name has made leaving painful by design. Some do this without malice, simply because it is administratively easier for them, but the effect on you is the same. Ask, and get the answer in writing.
“How do you charge, and what makes a bill go up?”
You are looking for predictability and honesty about the edges, not just an attractive headline rate.
Ask what is included, what is billed separately, what happens in an emergency or after hours, and what a typical month looks like for a business your size. Ask for an example of a month that went over, and why. Every provider has had one. An answer to that question tells you more than the rate card.
“What do you do when something goes wrong?”
Ask about response times, but pay more attention to the story than the number. Ask them to describe a real incident: what happened, what they did, how they communicated, what they changed afterwards.
Providers who talk openly about mistakes and what they learned are usually the ones who learn. Flawless records are rarely real.
“Can I speak to a client like us?”
Ask specifically for a reference of similar size and industry. A glowing reference from a business ten times your size tells you little about how you will be treated.
Then actually make the call, and ask the reference the most useful question available: what is frustrating about working with them? Everyone has something. The answer tells you what you would be signing up for.
Signals worth noticing
Fear as a sales technique. Real risk is worth explaining plainly. If a conversation is built on alarm and urgency rather than evidence, that is a sales strategy.
Reluctance to explain. A provider who cannot explain why something matters in language you understand either does not understand it themselves or does not respect you. Neither is good.
Pressure to sign quickly. Reputable providers are comfortable with you taking time.
No interest in your business. If nobody asks what you do, who your customers are, or what would hurt most if it stopped, they cannot prioritise sensibly.
The honest summary
You are not really assessing technical skill in a first meeting, because you cannot. You are assessing whether someone is straightforward, whether they are curious about your business, and whether they have arranged things so you can leave. Those three things predict the relationship better than any certification.
Happy to be asked all of the above. If you would like a conversation with no pressure and no catalogue, get in touch.