What "top 10 managed IT provider" lists don't tell you

A disclosure first

We are a managed service provider writing about lists that rank managed service providers. That is a conflict of interest and you should read this with it in mind. The fair response is not to skip the article — it is to apply the checks at the bottom of it to us exactly as readily as to anyone else. They are the same checks either way, and none of them require you to take our word for anything.

The four things a "top 10" list usually is

"Top 10 managed IT providers in Sydney 2026" is a page title, not a category of research. Behind that title there are usually one of four business models, and they produce very different documents.

• Paid placement. The directory sells position. Sometimes this is disclosed as "sponsored" or "featured", sometimes it is a premium membership tier that happens to correlate perfectly with appearing near the top. The ranking is a price list with an ordinal on it.
• Lead generation. The list is free to appear on and the operator charges providers per enquiry, or sells your enquiry to several of them at once. Placement follows who is buying leads this quarter. This is also why "get matched with the right provider" forms exist: you are the product being matched.
• Search engine optimisation content. A content agency generates a "top 10" page for every city and every service because those phrases attract search traffic. Nobody contacted any of the providers. The ten names came from the first page of Google, which is a list of who is good at search engine optimisation.
• Genuine editorial or survey work. This does exist. It is rare, it takes real effort, and it is easy to identify because the people who did the work are proud of the method and publish it.

The first three are not scandals. They are ordinary advertising, and advertising is legitimate. The problem is only that they are presented in the visual language of a ranking — a numbered order, a rating out of five, a badge — which invites you to read them as an assessment of quality when no assessment took place.

Read the methodology, or notice there isn't one

A list that ranked something can tell you how. Look for a methodology section and check it for five things:

• Whether providers paid. Anything — placement fee, membership, lead fee, affiliate commission on a signed contract. Australian Consumer Law expects commercial relationships behind an apparent endorsement to be disclosed, so a page that says nothing about money on a page that is clearly commercial is telling you something.
• What was measured. "Reputation" and "expertise" are not criteria. Number of verified client reviews, years in operation, certifications held, response time data — those are criteria.
• Who was considered. A ranking of the providers who applied is a ranking of the providers who applied. It says nothing about the ones who did not.
• When it was last updated. A page titled 2026 is not necessarily a page written in 2026. Check whether the entries still exist as businesses.
• Who wrote it. A named author with a background in the sector is a different proposition to "Editorial Team" or no byline at all.

There is one more useful tell. Open two or three "top 10" pages for the same city and compare them. Genuine assessments of the same market should overlap substantially. If the ten names are almost entirely different each time, none of the pages is measuring the market — they are each measuring their own customer base.

Review platforms are a different animal

Directories that verify reviews against an actual engagement are more useful than editorial lists, because the underlying content comes from clients rather than from the provider or the publisher. They are still worth reading carefully.

Providers choose which clients to invite, so a review set is a curated sample by construction. Read the three-star reviews rather than the five-star ones — they are where the specifics live, and a provider with none at all has either an unusually consistent service or an unusually selective invitation list. Check whether reviews name a project and a timeframe. And weight recency heavily: managed services is a people business, and a glowing review of a team that has since turned over completely describes a company that no longer exists.

Awards, badges and what they certify

Industry awards are a mixed field. Some are judged by a genuine panel against published criteria. Others charge an entry fee, and the entry fee is doing more work than the judging. The tells are the same as for lists: are the criteria published, who judged, how many entrants were there, and did entry cost money.

Vendor badges are a separate thing again and are frequently misread. A partner badge certifies a commercial relationship with that vendor, sometimes with a competency requirement attached, sometimes not. It says something real about what a provider can procure and support. It does not say anything about whether they will answer the phone at seven o'clock. Individual certifications held by named people are the more informative signal, because they attach to a person you can ask for by name — and you should confirm that the person is still there.

Five checks worth more than any ranking

None of these require a directory, and all of them are things a provider can answer in a first conversation.

• References you selected, not the three they offered. Ask for a list of clients of similar size in your sector and choose which ones you speak to. A provider comfortable with that is telling you something a testimonial cannot.
• The exit terms, read before the service terms. Notice period, what happens to your data and documentation, whether administrative credentials are held in your tenant or theirs, and what offboarding costs. This is the single most predictive clause in the contract, because it tells you how confident they are that you will stay.
• Who actually answers out of hours, where they are located, and whether after-hours coverage is monitoring, triage or genuine resolution. Those are three different products sold under the same two characters.
• Named people with current certifications, and which of them would work on your account. Not the company's aggregate credential wall.
• How Australian obligations flow through the contract — data location, breach notification timeframes, subcontractors and their location. If your provider learns of a breach on a Friday, your obligations start then, not when they get around to telling you.

We have written both a longer set of questions on the Australian obligations and a twelve-question version for the first meeting.

How to use a list anyway

Use it as a name-gathering exercise and nothing else. A directory page is a reasonable way to discover that six providers exist in your city that you had not heard of, which is a genuinely useful thing to learn and is all it is capable of telling you.

Then throw away the order. Build a shortlist of three to five from whatever sources you like — the list, your accountant, your industry association, another business your size that has been through it — and run the same process across all of them. Comparable briefs produce comparable proposals, and a comparison you performed yourself beats a ranking somebody sold, including one that happens to have us near the top of it.

Questions