How MSPs Can Spot Unmanaged IT Infrastructure From the Outside

The referral ceiling every MSP hits

If you run an MSP, your first 20 or 30 clients probably came from referrals. A happy client mentions you to a friend. A vendor sends someone your way. Your reputation builds, and the phone rings without you doing much marketing at all.

Then it stops. Not completely, but enough to notice. You're still getting referrals, maybe two or three a month. But you need five or six to hit your growth targets. The gap between where you are and where you want to be gets wider every quarter.

Most MSPs respond to this by trying to "do more marketing." They post on LinkedIn, sponsor a chamber of commerce event, maybe hire someone to run Google Ads. Some of this works, eventually. But none of it solves the core problem: you don't have a repeatable way to identify businesses that actually need managed IT services right now.

What a business's website tells you about their IT

Here's something most MSPs don't think about: a company's public website is a window into their entire technology posture. Not a perfect window, but a surprisingly revealing one.

Think about it from the other direction. If a business keeps their website updated, running a current CMS version, proper SSL, modern hosting, reasonable page speed, that tells you something. Someone is paying attention to their technology. They either have internal IT or they already work with a provider.

Now flip it. A business running WordPress 4.8 on shared hosting with no SSL certificate and a PageSpeed score of 22? Nobody is managing their technology. Not their website, and almost certainly not their internal systems either.

The website is the part of their infrastructure that faces the world. It's the part they should care about most, because customers see it. If even that is neglected, you can make a very reasonable assumption about what's happening behind the scenes: unpatched workstations, no backup strategy, consumer-grade networking equipment, and passwords written on sticky notes.

The specific signals that indicate unmanaged IT

Not every outdated website means a prospect for managed services. You need to know which signals actually correlate with IT neglect, and which are just cosmetic issues that a web designer should handle.

Outdated CMS versions

This is the strongest signal. WordPress 4.x stopped receiving security patches in 2019. Drupal 7 reached end of life in early 2025. Joomla 3.x has been unsupported since August 2023. If a business is still running any of these, nobody with technical knowledge is watching their systems.

A law firm in Denver running WordPress 4.8 is not just vulnerable to website exploits. They're telling you that nobody in their organization tracks software lifecycle dates. Their server operating systems are probably outdated too. Their firewall firmware hasn't been updated. Their antivirus, if they have one, is running with expired definitions.

No SSL certificate

In 2026, getting an SSL certificate is free and takes five minutes. Let's Encrypt made this a non-issue years ago. If a business still loads over HTTP, it means one of two things: their hosting is so outdated that SSL setup is complicated, or nobody has touched their web infrastructure in years. Either way, you have a prospect.

Legacy hosting indicators

Certain hosting signatures tell a story. A site running on Apache 2.2 (end of life in 2018) or PHP 5.x (end of life in 2019) is sitting on a server that hasn't been maintained. The hosting company may still keep the lights on, but nobody is patching the underlying software.

These businesses are often on cheap shared hosting plans they signed up for a decade ago. Their "IT guy" is whoever set up the website originally, and that person left three years ago.

No CDN, no caching, no optimization

A website with no content delivery network, no browser caching headers, and no image optimization is a website that was built once and abandoned. Modern web hosting services include most of these features by default. Their absence tells you the business is on an old, unmanaged setup.

Missing security headers

This is a more technical signal, but a powerful one. Websites without Content-Security-Policy, X-Frame-Options, or Strict-Transport-Security headers are wide open to common attacks. Any competent IT provider would have set these up. Their absence is another indicator that nobody technical is watching.

Using Google Maps to find these businesses

You know what to look for. The question is how to find these businesses at scale, without spending hours manually checking websites one at a time.

Google Maps is the best starting point because every listing represents a real, currently operating business. Unlike purchased lead lists that are stale within months, Google Maps data reflects businesses that are open today, with current addresses, phone numbers, and website links.

The approach is simple. Search for your target vertical in your target city. "Law firms in Denver." "Accounting firms in Charlotte." "Medical practices in Raleigh." "Construction companies in Tampa." Each search returns dozens or hundreds of real businesses with websites you can analyze.

The problem with doing this manually is obvious. You'd need to visit each website, view the page source, check the CMS version, test for SSL, look up the hosting provider, and check the server headers. For 200 results, that's a full week of work.

Enriching every result with tech stack data

This is where automation changes the equation. When you run a search in Lyre Leads, every Google Maps result gets automatically enriched with 40+ data points. That includes the exact signals MSPs care about:

• CMS and version number: WordPress 4.8, Drupal 7, Joomla 3.x, Squarespace, Wix, or custom-built
• SSL status: whether the site loads over HTTPS or shows a security warning
• PageSpeed score: Google's own performance rating for the site
• Tech stack details: server software, hosting indicators, frameworks, and libraries
• Analytics and tracking: whether they run Google Analytics, Facebook Pixel, or any tracking at all
• Social profiles: Facebook, Instagram, LinkedIn pages linked to the business
• Contact information: email addresses, phone numbers, physical address

After enrichment completes, you filter. Show every law firm in Denver running a CMS version more than three years old. Show every accounting firm in Charlotte with no SSL. Show every medical practice in Raleigh with a PageSpeed score under 30.

In minutes, you go from "I need MSP prospects" to "here are 34 businesses in my territory whose public-facing technology is outdated, and here's the specific evidence."

Turning tech signals into a conversation

This is where most MSPs get it wrong. They see the data and jump straight to a sales pitch about managed services packages and monthly retainers. That doesn't work. The business owner doesn't care about your services. They care about their problems.

Start with what you found. Be specific. Be helpful. Don't sell.

Bad approach: "Hi, I run an IT services company and we specialize in helping small businesses like yours with their technology needs. Would you be open to a conversation about how we can help?"

Better approach: "Hi, I noticed your website is running WordPress 4.8, which stopped receiving security updates in 2019. That means your site has at least 47 known vulnerabilities that haven't been patched. I see this pattern a lot with businesses your size, and usually it means the internal systems have similar gaps. I put together a quick overview of what I found. Would it be useful if I sent it over?"

The second approach works for three reasons. First, it's specific. You're not guessing that they have IT problems. You're showing evidence. Second, it's about their risk, not your service. Third, it positions you as someone who noticed a problem and wants to help, not someone who's trying to sell something.

The "outside-in" assessment offer

Once you've made contact, the natural next step is a free technology assessment. But frame it around what you've already found, not as a generic offer.

"Based on what I can see from the outside, your web infrastructure hasn't been updated in several years. In my experience, that usually means there are similar gaps internally: outdated operating systems, backup gaps, network security issues. I'd be happy to do a quick assessment to see if that's the case. No charge, no commitment. If everything looks fine, I'll tell you that too."

This works because you've already demonstrated credibility. You found real issues with their website. You're not asking them to trust you blindly. You've earned the right to look deeper.

Real examples: MSP prospecting by vertical

Law firms in Denver

Search "law firms in Denver" and enrich the results. Filter for WordPress versions below 5.0. You'll find firms running sites that were built years ago and never updated. Many of these firms handle sensitive client data, contracts, case files. If their website security is this neglected, their document management and email security probably are too.

Your angle: "You handle confidential client information every day. Your website has known security vulnerabilities that have been public for years. I'd want to make sure your internal systems aren't similarly exposed."

Accounting firms in Charlotte

Search "accounting firms in Charlotte" and filter for no SSL. During tax season, these firms exchange financial documents with clients via email and web portals. A firm whose website can't even handle basic encryption is a compliance risk, and they probably know it on some level. They just don't know how to fix it.

Your angle: "Your website transmits data without encryption. If your client portal or email works the same way, that's a serious exposure during tax season. Want me to take a look?"

Medical practices in Raleigh

Healthcare has HIPAA. A medical practice with an insecure website and outdated technology is a practice that's one audit away from a very bad day. Search "medical practices in Raleigh," filter for legacy CMS and no SSL, and you'll find practices that need help they don't even know they need.

Your angle: compliance. Not scare tactics, but genuine concern. "HIPAA requires reasonable safeguards for electronic health information. Your website suggests your technology infrastructure may have gaps. I can do a quick check to help you understand your exposure."

Using AI scoring to prioritize your list

After filtering, you might still have 40 or 50 prospects. You can't call all of them this week. You need to prioritize.

Lyre Leads includes an AI scoring system that evaluates each lead based on multiple factors: review count, rating, website quality, online presence, and overall business signals. For MSPs, the most interesting prospects are businesses with strong review counts (meaning they're busy and profitable) but weak technical signals (meaning they need help).

A law firm with 200 reviews and a 4.7-star rating but WordPress 4.8 and no SSL is a much better prospect than a solo practitioner with 3 reviews and the same technical issues. The first firm has money, clients, and reputation to protect. They can afford managed services and they have a real reason to invest.

Building a territory strategy

The real power here is repeatability. Once you've worked your way through law firms in Denver, you move to accounting firms. Then construction companies. Then medical practices. Then you move to the next city in your territory.

Here's a weekly rhythm that works:

• Monday: Run 2-3 searches in your target verticals and cities. Let enrichment finish.
• Tuesday: Filter results by tech signals. Export the top 20 prospects with the worst technology and the best business indicators.
• Wednesday-Thursday: Write personalized outreach for your top 10. Reference the specific CMS version, SSL status, or hosting issue you found.
• Friday: Follow up with anyone who opened your previous emails. Add new prospects from remaining search results.

Do this for a month and you'll have more prospects in your pipeline than referrals gave you all year. Do it for a quarter and you'll have a predictable source of new business that doesn't depend on anyone remembering to recommend you.

Why this works better than traditional MSP marketing

Most MSP marketing is generic. "We provide managed IT services for small businesses." "We're your outsourced IT department." "We keep your systems running so you can focus on your business." Every MSP in your city says the same thing. None of it gives a prospect a reason to call you instead of the other ten MSPs saying the exact same words.

This approach is different because you're leading with evidence. You didn't just find their name in a directory. You found a specific, verifiable problem with their technology. You can point to their WordPress version number. You can show them the SSL warning in their browser. You can tell them their server software is three years past end of life.

That specificity changes the conversation. You're not asking them to believe you're good at IT. You're showing them you already found something their current setup missed. That's a fundamentally different starting position for a sales conversation.

Stop waiting for referrals. Start searching.

The businesses that need managed IT services are already listed on Google Maps. Their outdated websites are broadcasting their IT maturity level to anyone who knows how to read the signals. The only question is whether you'll find them first, or whether another MSP in your territory will.

Pick a vertical. Pick a city. Run a search. Filter by the tech signals that matter. And reach out with proof, not promises.