The 25 Cross-Sell Categories Every MSP Should Be Pitching (and Why Most Stop at 5)

Walk into a typical MSP's sales playbook and you'll see five services: endpoints + patch management, Microsoft 365 licensing, backup and DR, basic cybersecurity (usually EDR + email), and sometimes voice. Maybe a hardware refresh. That's the entire pitch.

Then go ask the CFO of any MSP client what their company spends on technology and services annually. The number is almost always 4-10× what they're paying their MSP. The other 75-90% of that spend is going to vendors the MSP either ignores or doesn't think they can sell — internet, copiers, conference-room AV, security cameras, marketing software, web hosting, the agency that runs their Google Ads, the company that does their data warehouse, the consulting firm that helped with their AI strategy.

That's the cross-sell map. Every dollar your client spends on technology, communications, marketing, or operational tools is a dollar an MSP could legitimately deliver — directly, through a partner, or as a referral that pays a margin. The reason most MSPs stop at 5 categories isn't that they couldn't deliver the rest. It's that they don't have a systematic way to surface the opportunities before the QBR, so they show up with a Top 3 list that's actually a Top 1 list with two filler items.

This post lays out the complete 25-category cross-sell framework MSProspector uses on every report. Each category includes what it covers, the buying signals that indicate a prospect needs it, and a one-line pitch you can drop in your next QBR.

Why 25 (and not 5 or 100)?

We landed on 25 categories after auditing how Marketopia's network of MSP and VAR clients actually sell. Fewer than 25 misses real recurring-revenue surfaces (physical security, AV, marketing services). More than 25 creates overlapping bins that confuse reps and dilute the lists you give them. Twenty-five is the smallest number that covers every dollar of typical SMB and mid-market spend without forcing reps to remember sub-bins they'll never use.

If you sell across all 25, you don't need to add new logos to grow. The average MSP we work with has a current client book where each client is buying 3-4 categories. Going from 3.5 to 7 categories per client roughly doubles ARR per client — without needing to win a single new deal. That's the math behind the cross-sell motion.

The 25 Categories, Grouped by Theme

We organize the 25 into 7 themes. The grouping matters because most prospect conversations naturally flow into one or two themes at a time, not jumping between them. A CFO asking about ITIL service management probably wants to talk about everything in Data & Operations in the same meeting; bouncing them to AV & Collaboration mid-conversation breaks the thread.

Core IT Infrastructure (3 categories)

This is where most MSPs already sell. If you're not at least scanning these three on every client, you're leaving renewals on the table.

1. IT Hardware & Infrastructure — servers, endpoints, laptops, desktops, networking equipment, storage, physical infrastructure. Buying signals: warranty expirations, Windows OS still on 10, Wi-Fi coverage complaints, capacity constraints on the SAN. Pitch: "Your fleet has 47 endpoints past their 3-year refresh window — we can quote a managed refresh that's 20% under what you'd pay direct."

2. Software & Productivity — Microsoft 365, Google Workspace, ERP, CRM, line-of-business apps, licensing optimization. Buying signals: license sprawl, unused E3 seats, redundant tools (e.g., paying for both Asana and Monday), unsupported OS versions. Pitch: "We audited your M365 estate and found $4,200/month in unused premium licenses — let's right-size."

3. Cloud & Infrastructure Services — Azure / AWS / GCP, hybrid cloud, IaaS, PaaS, SaaS management, cloud cost optimization. Buying signals: on-prem servers approaching refresh, multi-cloud sprawl, no FinOps function, departmental shadow IT. Pitch: "Your AWS spend grew 38% last year with no policy controls — we can implement cost governance and save you 22-30% within a quarter."

AI & Emerging Technology (4 categories)

The fastest-growing category set. Two years ago this was experimental; today CFOs are asking about it directly.

4. AI Projects & Implementation — AI strategy, machine learning, predictive analytics, NLP, computer vision. Buying signals: manual data analysis the prospect calls "painful", customer-service teams drowning, executive newsletters mentioning AI, recent board appointment of an AI advisor. Pitch: "Your support team handles 1,200 tickets/month — 40% are repetitive. We can stand up an AI deflection layer in 6 weeks."

5. Agentic AI & Autonomous Systems — AI agents, copilots, multi-agent workflows, AIOps. Buying signals: complex multi-step workflows still done manually, sales teams using ChatGPT freelance, IT operations buried in repetitive incident response. Pitch: "Your incident-response queue is 80% pattern-matched problems an AI agent could resolve in seconds. We can pilot one workflow in 30 days."

6. Software Development & DevOps — custom development, application modernization, CI/CD, low-code platforms, API integrations. Buying signals: legacy LOB apps holding the company back, manual integrations between systems, "we've been meaning to build a portal for years." Pitch: "We have a development partner who can modernize that legacy intake app in 90 days for less than your current annual maintenance bill."

7. AI-Enabled Robotics & IoT — RPA, robotics, IoT sensors, smart building systems, industrial automation. Buying signals: physical operations (warehouses, manufacturing, healthcare facilities), large in-person workforce, complaints about repetitive physical work. Pitch: "Your warehouse runs 12 hours of manual inventory counts a week — IoT sensors + automated counts cuts that to under an hour."

Security & Compliance (2 categories)

These are sold reflexively but rarely sold well. Most MSPs pitch "we'll do cyber" without a framework. The frameworks are where the budget unlocks.

8. Cybersecurity — EDR/XDR, SIEM/SOC, MFA, zero trust, email security, IAM/PAM, vulnerability management, incident response, security awareness training. Buying signals: NIST CSF gaps, weak email authentication (no DMARC, soft SPF), dark-web exposure on key employees, breach in their industry, cyber insurance renewal coming up. Pitch: "Your cyber-insurance carrier is going to ask about MFA on email, EDR on endpoints, and incident-response readiness. You're at risk on 2 of 3 — let us close those before renewal."

9. Compliance & Governance — HIPAA, PCI-DSS, SOC 2, CMMC, GDPR, CCPA + newer state privacy laws, CAN-SPAM, TCPA. Buying signals: regulated industry (healthcare, finance, defense, retail), customer contracts demanding SOC 2, recent failed audit, no documented policies. Pitch: "You're 9 months from your SOC 2 audit and don't have policies in place. We've taken three of your peers through this — we'll get you audit-ready in 6 months."

Web, Marketing & Sales (7 categories)

This is the giant uncaptured surface. Most MSPs don't sell anything in this group — and it's typically the largest single line of vendor spend in their clients' P&L. If you do, you double your wallet share overnight. If you don't, partner with someone who does (this is literally why Marketopia exists — to give MSPs a marketing arm without forcing them to hire one).

10. Website & Web Applications — design, redesign, CMS, e-commerce, performance optimization, technical SEO, GEO (getting cited in ChatGPT / Perplexity / Google AI Overviews), ADA accessibility. Buying signals: site loads in >4 seconds, last redesign was 2018, no schema markup, not appearing in AI answer engines. Pitch: "Your homepage takes 6.2 seconds to load — you're losing 30% of mobile visitors before they see the hero. A modern rebuild pays itself back in 6 months on conversion alone."

11. Marketing Technology (MarTech) — marketing automation platforms, CRM, ABM tools, email marketing, marketing analytics, customer data platforms (CDP). Buying signals: marketing team using HubSpot Free 4 years in, no lead-to-revenue attribution, sales and marketing on different systems. Pitch: "You can't tell which marketing channels drove revenue last quarter. We can rationalize your stack and stand up attribution in 60 days."

12. Digital Marketing Services — SEO, GEO, SEM/PPC, social, content, email campaigns, video, online reputation. Buying signals: not appearing for their own product keywords, no recent blog posts, no presence on AI search engines, paid-ad waste. Pitch: "You're spending $40k/month on Google Ads with no negative keywords and 18% of clicks going to a 404. We can recover 25% of that spend in 30 days."

13. Lead Generation & Sales Enablement — pipeline programs, intent data, sales engagement platforms, sales enablement assets, sales process optimization. Buying signals: sales team complaining about lead quality, no MQL→SQL definitions, missing pipeline targets. Pitch: "Your sales team is creating their own collateral because what marketing built doesn't fit the conversation. We can audit + rebuild that library in 4 weeks."

14. Brand & Creative — brand identity, visual design, logo refresh, brand voice consistency, video, photography. Buying signals: 5+ years since last brand refresh, inconsistent visual assets across channels, no brand guidelines, recent merger or pivot. Pitch: "Your investor deck, website, and trade-show booth all look like they were designed by three different agencies. A brand-system refresh fixes all three in one project."

15. Outsourced BDR / Sales Development — appointment setting, BDR-as-a-Service, list building, outbound execution. Buying signals: empty calendars for AEs, no outbound motion, sales team doing their own prospecting and complaining about it. Pitch: "Your AEs spend 60% of their time prospecting instead of selling. Outsourced BDR with us puts 8-12 qualified meetings/month on each AE's calendar."

16. Marketing Strategy & Execution — fractional CMO, marketing operations, demand generation, content strategy, ABM, marketing/sales alignment, attribution reporting. Buying signals: no marketing leader, founder doing marketing themselves, marketing budget exists but no plan. Pitch: "You're spending $20k/month on marketing tactics with no underlying strategy. A fractional CMO arrangement gives you a real strategic leader for less than half a senior FTE."

Communications & Connectivity (3 categories)

The recurring-revenue backbone. Every prospect already pays a vendor in each of these; the question is just whether they pay you.

17. Internet, ISP & Connectivity — internet service, fiber, SD-WAN, MPLS, redundant connectivity, bandwidth, WAN management. Buying signals: single ISP with no failover, complaints about VoIP quality, branch offices on consumer-grade cable. Pitch: "Your headquarters has a single fiber circuit with no diverse failover — a single backhoe takes you offline. Let us layer in SD-WAN with carrier diversity."

18. Telephony & Unified Communications — VoIP, UCaaS, contact center (CCaaS), PBX replacement, Microsoft Teams voice, video conferencing. Buying signals: legacy PBX still on-prem, multiple disconnected systems for voice/chat/video, complaints about call quality. Pitch: "You're paying three vendors for phone, video, and chat — Teams Voice consolidates all three for less than what you pay the phone vendor alone."

19. Printers, Copiers & Document Management — managed print services (MPS), MFP fleet, document workflow automation, scanning, paper-to-digital. Buying signals: high print volume, manual document workflows, complaints about toner costs, paper-heavy industries (healthcare, legal). Pitch: "Your print costs are running 30% above industry benchmark. A managed-print agreement cuts that in half AND fixes the workflow on contract intake."

Data & Operations (3 categories)

Where mature prospects are heading next. If your client just hired their first data analyst or just finished a SOC 2, they're now ready for these conversations.

20. Data & Business Intelligence — business intelligence, data warehousing, dashboards, data visualization, ETL pipelines. Buying signals: leadership team flying blind on operational data, every report built in Excel, multiple disconnected systems no one's analyzing. Pitch: "Your executive team is making decisions on month-old data because the reporting is manual. A modern BI stack with daily refresh changes that in 90 days."

21. Backup, DR & Business Continuity — backup, disaster recovery, business continuity planning, high availability, data protection. Buying signals: no documented recovery time objective (RTO), never tested a restore, single backup target, no BCDR runbook. Pitch: "Your backups exist but you've never tested a recovery. If you got hit with ransomware tomorrow, you'd find out in the worst possible way that your restore takes 72 hours, not 4."

22. IT Service Management (ITIL) — service desk, incident management, problem management, change enablement, CMDB, IT asset management (ITAM), service-level management, monitoring, knowledge management. Buying signals: no ticketing system or one that nobody uses, repeated incidents with no root-cause analysis, IT team firefighting daily. Pitch: "Your IT team handles 600 tickets/month with no problem-management process, so the same 15 issues recur. ITIL practices we put in place reduce that volume by 40% in 6 months."

People & Physical (3 categories)

The last bucket. Often the easiest sale because the budget already exists and the prospect is openly looking.

23. IT Staffing, Consulting & Managed Services — managed IT, vCIO / vCISO, co-managed IT, help desk outsourcing, IT staffing, project consulting, technology advisory. Buying signals: IT team overwhelmed, recent IT staff departures, no strategic IT leadership, project backlog. Pitch: "Your IT director is buried in tickets and can't get to strategic work. Co-managed IT layers us in to take 60% of operational load so they can focus on the roadmap."

24. Physical Security & Access Control — video surveillance, access control, visitor management, alarm systems, integrated physical/cyber. Buying signals: multiple physical locations, recent incident or near-miss, outdated key-card system, no centralized monitoring. Pitch: "Your three locations each have separate physical-security systems with no unified view. A modern integrated platform gives the COO a single dashboard and saves 30% on the monthly monitoring bill."

25. AV, Collaboration & Meeting Rooms — conference room AV, video conferencing rooms, digital signage, collaboration platforms, hybrid work enablement. Buying signals: post-COVID return-to-office, complaints about hybrid meeting quality, multiple unused conference rooms, signage in lobby that's been "we're hiring" for 2 years. Pitch: "Your team is calling into hybrid meetings from laptops because the conference-room AV doesn't work. Modern Teams Rooms in 4 conference rooms is a 30-day project that fixes hybrid productivity."

How to Actually Surface These on a Real Prospect

Here's the harder problem: knowing the 25 categories exist isn't the same as knowing which apply to this specific client before this specific QBR. The signals are scattered across the company's website, their LinkedIn, their job postings, their security posture, their tech-stack fingerprints, their employee data, their marketing footprint, their content output.

A human BDR can investigate one category per hour. That gives you maybe 4-6 categories of depth in a half-day of research per prospect. Walking into a 60-person meeting with 4 cross-sell opportunities is not the same as walking in with 80. The first conversation is "we have a couple ideas"; the second is "we did 4 hours of work on your account before this meeting."

This is exactly the work MSProspector automates. Every report runs all 25 categories in parallel against the prospect's complete digital footprint — scraped pages, DNS, TLS, page-speed, Apollo firmographic data, ATS job postings, Meta Ads Library, retargeting pixels, dark-web exposure, SEMrush digital-marketing posture, and a NIST CSF 2.0 baseline. Each category produces ranked, evidence-anchored opportunities with specific dollar impact estimates and the talking points to pitch them.

The first 2 reports are free — pick a real prospect you have coming up and a real existing client whose QBR is approaching. You'll see the difference between "we have a couple cross-sell ideas" and "we identified 80+ opportunities across 25 categories and ranked the top 12 for this meeting."

Run your first report at msprospector.com →

A Closing Note on the 4-10× Wallet-Share Math

The math at the top of this post — most MSP clients spend 4-10× what they pay the MSP across the rest of the categories — comes from Marketopia's analysis of 1,200+ MSP-client engagements over the last decade. Whatever your current wallet share, the cross-sell opportunity is bigger than you've measured. The 25-category framework is how you actually capture it: identify which categories the client is buying elsewhere, decide which you can deliver directly (or via partner / referral), and walk into every QBR with a ranked map of the opportunities that exist in their world.

This is not about pitching everything to everyone. It's about knowing what's there to pitch. The QBRs you've been running on guesswork and intuition can be run on data that took 12 minutes to produce.

The 25-category opportunity scan is in every MSProspector report. See the full capabilities list, or run your first two reports free.