The buyer already knows your numbers before you walk into the room

MSP buyers in 2026 run seven checks before they write a check: gross margin, net retention, growth rate, recurring revenue as a percentage of total revenue, customer concentration, data sovereignty, and key-person risk. Every one of those seven items gets scored before your story gets heard. If your books can't answer them in an afternoon, the buyer assumes the worst and prices it in.

That's not opinion. That's the operating doctrine of the people running these deals right now. Joel Cox, a partner at DLA Piper who works the buy side of technology M&A, laid it out plainly: buyers want recurring revenue, net retention, growth rate, and gross margin, full stop. Cox told cfotech.co.nz that AI has made technology M&A tougher, not easier, because buyers are more cautious about what they're underwriting. The fundamentals matter more now, not less.

I've sat on the other side of this table. When I ran due diligence at Hartford Steam Boiler for Munich Re, I saw one pattern hold across dozens of deals: the businesses that could show their numbers without scrambling always got the higher offer. The ones that needed "a few weeks to pull that together" never recovered their negotiating position. That delay tells a buyer everything. It says the operator doesn't know their own engine room.

This is the doctrine: due diligence is non-negotiable. Not because buyers are cruel. Because they're pricing risk, and unpriced risk always gets a discount attached to it.

The framework: The 90-Day Bottleneck Audit

I built a process called the 90-Day Bottleneck Audit for exactly this moment: the 90 days before you go to market, where every gap you haven't closed becomes a buyer's use point instead of your asset. The audit runs the same seven checks a buyer's team will run, except you run them first, on your own clock, with time to fix what's broken.

Think of it like a casualty drill on a submarine. You don't wait for the flood to find the weak seal. You test every seal on a schedule, log the results, and fix what fails before it's live. A pre-sale audit is the same discipline applied to a balance sheet.

The 7 points buyers check

1. Gross margin above 50%

Gross margin is the first filter. Cox's buy-side clients want to see it clean and consistent, not propped up by one good quarter. The N2M Capital 2026 MSP valuation report shows the multiple spread tracks capability directly: cybersecurity-first MSSPs with strong margins hit 10 to 14x EBITDA, while break-fix generalists sit at 3 to 5x. Margin is the floor. Everything else is what pushes you off that floor.

If your margin sits below 50%, don't wait for a buyer to find it. Find it yourself. Look at underpriced legacy contracts, overstaffed delivery teams, and vendor stacks nobody has renegotiated in three years. Fix those before you're in a data room, not during.

2. Net revenue retention above 110%

NRR tells a buyer whether your existing customers are growing or shrinking on you. Above 100% means expansion is outpacing churn. Above 110% means your installed base is compounding without you closing a single new logo. CT Acquisitions' 2026 multiples report found that organic MRR growth above 15% and NRR above 105% supports the top of the valuation range, while NRR below 95% pushes an MSP toward the floor regardless of size.

This is the compounding asset every buyer wants: revenue that grows itself. If your NRR is soft, get in front of it. Cross-sell backup, security monitoring, and compliance add-ons to the base you already have before you go to market, not after.

3. MRR/ARR as a percentage of total revenue

Recurring revenue is the single largest lever on your multiple. The Datto Global MSP Benchmark, cited in CT Acquisitions' 2026 report, puts median MRR share at 62% across nearly 2,000 MSPs. Every 10 points of MRR share above 60% has historically correlated with 0.75x to 1.25x of additional multiple. That's not a rounding error. That's the difference between an 8x exit and a 10x exit on the same EBITDA.

Project work and time-and-materials billing are not bad businesses. They're just not what buyers pay a premium for. If your revenue mix leans heavy on projects, start converting what you can into managed contracts now. Two years of runway, not two months, is what it takes to move that number meaningfully.

4. Customer concentration under 5% per account

Cox was specific on this one: no single customer should represent more than 5% of revenue. A concentrated customer base is a single point of failure, and buyers underwrite failure points as discounts, not footnotes. Lose that one account post-close and the buyer's model breaks. They know it, so they price it before it happens.

Run the math on your top three accounts today. If any one of them clears 5%, you have two years to diversify before you go to market, or you accept that the deal will carry an earnout structure built around retaining that specific relationship.

5. Change-of-control provisions

Buried in your customer contracts is language that can quietly kill a deal: change-of-control clauses that let a customer walk, renegotiate, or terminate the moment ownership changes hands. If half your contracts have that clause and you don't know it until diligence, you've just handed the buyer a renegotiation tool. Pull every material contract now. Know exactly which ones trigger on a sale and fix the ones you can before you're under a letter of intent with a clock running.

6. Data sovereignty and legal AI data use

This is the point most MSP owners haven't priced in yet, and it's moving fast. Cox flagged it directly: buyers now ask where client data physically sits, whether it can legally be used to train or run AI systems, and whether that data is structured well enough for a buyer to build on top of it. "The data has to be legally permissible to use for AI strategies, and structured and accessible in a way that an AI build can realistically happen," Cox said. "That's where I see the big value proposition for IT services businesses in the years ahead."

This is not theoretical for MSSPs specifically. A detailed 2026 legal guide on MSSP M&A found that data ownership and portability clauses vary wildly across MSAs, with some contracts assigning client-derived threat data to the MSP as a trade secret and others assigning it entirely to the client. Buyers now read those clauses line by line, because an AI product roadmap built on data you don't legally control is a roadmap built on sand.

Get a lawyer to review your MSAs for data ownership language before a buyer's lawyer does it for you. Know what you can legally build on and what you can't.

7. Key-person risk and employee retention

The seventh point rounds out to equity schemes and key-person dependency, because a business that can't run without the founder in the room isn't a business a buyer can transfer. Cox's guidance on preparation ties directly here: he recommends owners start preparing at least two years before a sale process, using that runway to build management depth, document delivery workflows, and reduce founder dependence.

The scale of the market backs up why this matters. Versent, an Australian technology consultancy, sold to Telstra for AUD $267 million, a deal built on exactly this kind of preparation: clean fundamentals, a transferable delivery model, and a team that could run without one person holding every relationship. That's not an accident. That's two years of discipline showing up in a single number.

Doctrine Connection: Due diligence is non-negotiable

Due diligence is not a hurdle a buyer clears on the way to a handshake. It is the entire negotiation. Every gap they find becomes use. Every gap you close before they find it stays yours. An operator who treats the audit as a formality is an operator who will discover, mid-deal, that the buyer has already decided the discount before the first call.

The businesses that win here run their own casualty drills before the buyer shows up with a checklist. That's the whole doctrine in one sentence.

The math on waiting

Cox's advice to prepare two years out isn't a suggestion, it's a structural fact of the current market. AI has made acquirers more cautious, not less, and buyer teams are often occupied running their own AI strategy or raising their own capital, which stretches out timelines even for sellers who are ready. Cox noted that a natural acquirer might need a bolt-on right before an IPO or a trade sale, and the seller who's already prepared is the one who captures that window. The seller who needs six months to get their data room together misses it entirely.

The market backs this up with real numbers. M&A Signal's 2026 MSP report found the valuation gap between top-quartile and median MSPs in the same revenue tier widened from roughly 1.5 to 2.0 turns of EBITDA in 2022 to 2023 to 2.5 to 4.0 turns by 2024 to 2025. The market is getting better at pricing quality and worse at forgiving unpreparedness. That gap is your two years of work, priced in real dollars.

FAQ

Q: How long before a sale should I start this audit? Two years, minimum. Cox's guidance, echoed across every sell-side advisory report referenced here, is consistent: use that runway to fix margin, retention, and concentration issues while you still control the timeline. Fixing NRR or customer concentration takes quarters, not weeks.

Q: What net revenue retention number actually moves my multiple? Above 105% supports the top of your valuation range. Below 95% pushes you toward the floor, regardless of your total revenue size. The delta between those two numbers, across a $5M to $15M MSP, is commonly two to four turns of EBITDA.

Q: Does data sovereignty really affect valuation yet, or is this early? It's early but moving fast, and it's already a live diligence item for MSPs serving regulated or AI-adjacent clients. Cox said sovereignty hasn't yet become a major factor in most MSP deals he's handled, but it's already central for deep-tech and AI-native businesses, and IT services firms with clean, legally-usable data have a real value proposition buyers are starting to price.

Q: What's the single biggest mistake sellers make in this audit? Waiting until diligence to organize the data. An MSP that needs weeks to produce retention cohorts, contract summaries, or margin breakdowns by service line signals disorganization, and buyers price disorganization as risk. Prepare the data room before you need it, not after a buyer asks for it.

Q: Should I fix every gap before going to market, or can some wait for negotiation? Fix what you can control: margin leakage, contract language, data governance. Accept what you can't fully solve, like a still-concentrated customer base, and be ready to explain it with a mitigation plan. Buyers discount unexplained risk far more than explained risk.