What IT decision-makers ask an assistant before they shortlist an MSP

The questions an IT buyer types before shortlisting

The buyer is rarely an IT specialist. It is the owner of a 20-person accounting firm, the office manager at a clinic, the operations lead at a distributor whose one IT person just left. The question carries their situation: "managed IT provider in Raleigh for a 20 person accounting firm", "IT support company near Columbus that does after hours monitoring and has a SOC 2 report", "msp in Ottawa that works with dental offices", "IT company that can take over from our current provider without downtime".

Then the fact questions about one firm: "how fast does this provider respond to a ticket", "do they cover backups and security or only the help desk", "do they have a minimum number of users". An AI assistant answers these by fetching the provider's own pages and reading for the fact. Where the page does not state it, the assistant hedges, or takes the answer from a directory profile written years ago.

The shortlist question and the fact question are answered from the same material: text the assistant can retrieve at the moment of asking. Your site competes with review directories, partner listings and the sites of every other provider in the metro. The one that states the buyer's constraints in plain sentences is the one that gets matched to them.

What your site controls in an answer about your firm

Three things, in this order: whether the assistant can fetch your site at all, whether the page states the facts the buyer asked about, and whether the firm reads as one entity across its pages and listings. IT firms are exposed to the first in a way most trades are not, for a reason that is to their credit: they run security tooling, and it does not distinguish an assistant's fetch from an attack.

The facts are specific to this trade. Response time as a stated commitment by severity, in hours. Coverage as a list of what a managed agreement includes (help desk, monitoring, patching, backup, endpoint security, vendor management) and what is billed as a project. The certifications and attestations you hold, named the way the certifying body names them. The industries you work in and the company sizes you take. Whether you are remote-only or on-site, and where. Who answers the phone, and when.

Where a site says "proactive", "trusted partner" and "peace of mind" in place of those facts, an assistant reading for "response time" finds the word "fast", which it cannot quote as an answer to "how fast". The citability of the page is decided by whether the specific sentence exists at all.

What the site has to state

Each row is a buyer's question, the fact that answers it, and where the fact belongs. Where price comes up, publish the model and, if you have one, the number. An assistant cannot quote a figure that is not there, and "contact us for pricing" matches nobody's question.

There is no IT-specific type in schema.org's LocalBusiness tree, so an MSP uses LocalBusiness for the firm (the ProfessionalService subtype is marked deprecated) and describes each offering with a Service node, which carries serviceType, provider, areaServed and audience. That last property is where "accounting firms with 10 to 50 users" belongs in machine-readable form. The properties Google reads for a local business (name, address, telephone, opening hours) go on the firm node, and every one repeats what the visible page says.

Your own security tooling may be turning the assistants away

In our audit of 9,483 small business websites across 40 trades and 90 metros in the US, Canada, Europe and the UAE, run between late August and early September 2026, 7.2% served our crawler a challenge page instead of the site. The crawler identified itself, ran no JavaScript and obeyed robots.txt; the challenge came from a CDN or a security plugin that never consulted the file. For an IT firm, whose site sits behind the same bot management it sells to clients, this is the first thing to check.

A challenge page stops an assistant's fetch as completely as a Disallow line, and nobody decided it. The AI crawlers that matter for being named are the answer-side ones: OAI-SearchBot and ChatGPT-User for ChatGPT, Claude-SearchBot and Claude-User, PerplexityBot and Perplexity-User, Googlebot for AI Overviews. OpenAI's crawler documentation says disallowing OAI-SearchBot removes a site from ChatGPT search answers and disallowing the training crawler GPTBot does not. Many bot management products let you allow verified crawlers by name. Do that for the answer-side tokens, and decide separately what to do about the training-side ones.

Then robots.txt. Under RFC 9309 a crawler obeys the group addressed to its own token and otherwise the group for everyone, and a managed robots file added by a CDN can insert a block you did not write. The crawler access check reads your file the way each of the 19 tokens would, and the robots.txt article has a file to copy. A further 3.0% of audited sites rendered their content only in JavaScript. A site built as a single-page app hands a non-rendering fetcher an empty shell, and Google's own documentation treats rendering as a separate, deferred step.

What else the crawl found

61.5% of the sites had no question-and-answer content of any kind. For an MSP that is the sales call left untranscribed: the buyer asks the same eight questions every time, and the site answers none of them where a machine can isolate the answer. 50.7% had at least one heading phrased as a question with nothing under it a machine could lift, such as a "Why choose us?" heading followed by three icons.

17.8% carried no schema.org markup, and most of what the rest carried described the website rather than the business. A firm that sells documentation as a discipline should find that easy to put right: one LocalBusiness node, one Service node per offering, stating what the pages state. And 43.1% were inconsistent about who and where they are across their own three main pages, and for a firm that has acquired or rebranded, an old name left in a footer is enough to count.

What to fix first, in order

1. Fetch your own homepage as an answer-side crawler would (a request sent with the OAI-SearchBot user agent, reading the status code, not the page) and run the crawler access check. Fix the bot wall and the robots file before touching a word of copy, because copy behind a challenge page is never read.
2. Open the managed services page with scripts off and confirm the text is in the HTML. If the site is a single-page app, render the service pages on the server or pre-render them.
3. Settle the identity: one firm name, one address, one main number, in the footer of every page and in every listing and partner directory you control. Retire the pre-rebrand name everywhere it survives.
4. Write the facts into the pages: response targets by severity, the coverage list and the project list, the certifications by exact name, the industries and the seat range, the pricing model. One question per heading where the buyer would ask it, the answer under it. This is the answer page your sales team already delivers by phone.
5. Add the markup as JSON-LD: the firm node with address, telephone, opening hours and areaServed, and one Service node per offering with serviceType and audience, matching the visible text. Google's introduction to structured data says the markup describes what a visitor can see, so it comes last.
6. Put client evidence on the page as text: named clients only with their permission, otherwise described by industry and size with what you run for them; reviews quoted with attribution; a rating count from where clients left it.

What not to do

Do not write your own reviews or mark up reviews you wrote; Google's review snippet rules say a business may not, and a firm that sells trust cannot afford it. Do not put a client's logo on the page without permission, and do not describe an engagement the client has not agreed to have described.

Do not stuff pages with "IT support Raleigh, managed IT Raleigh, Raleigh MSP". Google does not read the keywords meta tag, as its list of supported meta tags shows, and an assistant reading prose wants the sentence with the hours in it. Do not claim to be the top provider in the metro; a ranking nobody published is a sentence an assistant cannot verify and will not repeat.

And do not accept a promise of placement. No agency has a lever inside ChatGPT, Claude, Gemini or Perplexity, this one included. What can be measured is how often your firm is named on a fixed set of buyer questions, before and after the fixes above; how we measure it is written down in full.