The night before the review
Your account lead has a quarterly service review with a managed client tomorrow morning. The pack is not ready. They log into the SIEM for alert volumes, the EDR console for detections and endpoint coverage, the scanner for the vulnerability trend, and the PSA for tickets and response times. Each gives a slightly different date range by default. Charts are screenshotted and pasted into last quarter's slides.
Halfway through, they notice endpoint coverage has dropped: a batch of new laptops at the client never got the agent. That is worth raising. It is also the kind of thing that should have been noticed weeks ago, not the night before a meeting.
They have four more reviews this month.
And because every pack is built by hand, each account lead builds theirs differently. A client who changes account lead gets a different-looking pack with different figures, and wonders whether the service itself has changed.
Why packs take so long
- Data lives in several security tools and the PSA, each with its own reporting.
- Contract details (what is covered, target response times, number of endpoints) are in a PDF or the CRM, not next to the data.
- Comparisons with last quarter mean finding last quarter's pack.
- Every client gets a slightly different pack, built from a copy of their last one.
- The things worth discussing (coverage gaps, recurring alert sources, response times missed) only show up when someone looks closely.
What manual packs cost
| Problem | Result |
|---|---|
| Days building packs | Account leads' time off client work |
| Issues found the night before | Should have been raised weeks earlier |
| Inconsistent figures | Client questions the numbers |
| Contract not compared | Scope creep and coverage gaps go unnoticed |
| Rushed commentary | Review feels like a data dump, not advice |
The time adds up fast. A few hours per pack, across every managed client each quarter, is a large block of your most client-facing people's time spent in screenshots and slide templates.
The service review is where a managed security client decides whether you are worth renewing. It deserves the account lead's thinking, not their copy and paste.
The review pack generation we build
- Figures for the period are pulled per client from your tools by API: alert and incident volumes from the SIEM, detections and endpoint coverage from the EDR platform, vulnerability trend from the scanner, tickets and response times from the PSA.
- Contract details are held per client (services, endpoint counts, target response times) and each figure is compared with them: coverage against contracted endpoints, response times against targets.
- Each figure is compared with the previous review, and notable changes are highlighted.
- Items worth discussing are drafted as a list for the account lead: coverage gaps, noisy sources, response targets missed, open actions from the last review.
- A draft pack is produced in your template, per client, with space for commentary and recommendations. The account lead edits and finalises it.
- Actions agreed in the meeting are recorded and appear at the start of the next pack.
The same data can feed a monthly early warning to the account lead, so a coverage gap is raised when it appears, not at the next quarterly meeting.
Reviews with the pack ready
Account leads open a draft with the figures right and the talking points listed. Their time goes on what the client should do next. Figures are consistent across clients, periods and account leads. Actions from the last review are tracked, so the conversation picks up where it left off. And issues like a coverage gap reach the client when they happen, which is what they are paying you for.
Renewal conversations change too. Instead of a general sense that the service went well, the account lead can point to a year of consistent packs: coverage maintained, response targets met or explained, actions agreed and closed. That is a much stronger basis for a renewal, and for a price review if the client's estate has grown.
Are your service reviews like this?
- Packs are built by hand from several consoles.
- Account leads spend days a month on review packs.
- Issues are discovered while building the pack.
- Figures are not compared with the contract.
- Actions from the last review are not tracked.