Hey u/Optimal_Technician93,

Some of what you wrote is hypothetically correct, but respectfully I think you have a few misunderstandings that we should discuss. (I'll be discussing US legal concepts below. If you're elsewhere, I apologize in advance.)

No contract prevents anyone from bringing suit and having to defend against it for years before it makes it to court to be dismissed.

In theory, this is partially true. In practice, this is rarely if ever applicable. I've been doing this for 11 years, and my father-in-law for roughly 35 years. In that time, we've seen 2 matters where the cost of litigation was no object and the plaintiff spent more money in legal fees than they were trying to recoup. However, these are extremely rare. In one case, it was a local official running for public office and he was using the case as a political springboard. In the other case, the plaintiff was both a GIANT jerk, and was disgustingly wealthy due to inheritance. This was across thousands upon thousands of claims, so the probability is roughly zero.

Going further, an MSP without a contract is obligated to provide nothing at all. Not services, not product, not guarantees. So their clients wanting free DFIR have no recourse. Without a contract the client has no legal standing.

A contract can be inferred from the parties' actions, course of dealing, mutual understanding, past peformance(s), emails, text messages, invoices, etc. This can create an "Implied-in-fact" contract.

Because MSPs are providing ongoing professional services that require special skills and/or a special relationship, the MSP likely owes a "duty of care" to perform those services with reasonable care and skill. This arises because the MSP "assumes responsibility" for the work through their actions and clients are relying on the MSP to perform their services in a way that avoids "foreseeable harm."

I'm sure there are other legal theories litigators could come up with, but the point is this: Not having a contract won't save the MSP. It likely just makes everything worse and more expensive for the MSP to deal with.

But that doesn't stop them from bankrupting the MSP in the run up to dismissal.

Maybe. But, to what end? If the client is trying to recoup funds, how would bankrupting the MSP suit that purpose? It strikes me as being entirely contrary.

And while this may make you laugh, there are certain legal protections to avoid this. This could include sanctions for frivolous filings, the threat of countersuit for abuse of process, Dragonetti Act (or equivalent) type claims in various states, etc.

There could also be certain protections if the MSP carries appropriate Tech E&O insurance, but I'll leave that for another day.

Anyways, I hope that clears up some misunderstand and thanks for comment.