Blue Bridge MSP, UAB: The Margin Is Not in the Compute, but in Being the Go-To Operator

Blue Bridge MSP, UAB: The margin is not in the compute, but in being the go-to operator

In a small European market, the margin problem for managed services is severe. Compute is priced globally. Storage is standardized. Cybersecurity tools are increasingly sold through global platforms. Microsoft, Amazon, Google, IBM, VMware/Broadcom, Cloudflare, and equipment vendors hold a large portion of the technology stack. A Lithuanian MSP cannot win by pretending to be a hyperscaler. The scarce product is not compute; it is responsible operations: a local person, reachable, contractually exposed, technically proficient, and trusted enough to keep a public sector database, a logistics system, a ticketing platform, or a municipal water utility's ERP running when the abstract cloud becomes a concrete outage.

Blue Bridge MSP, UAB appears to be built around that scarcity. Public evidence shows a Lithuanian IT services company that has combined managed infrastructure, private and hybrid cloud, SOC services, data management, application platform work, hardware maintenance, public procurement credibility, and its own routing footprint to create a business of significant scale in the local market. The company is not merely a directory entry. It is a legal entity with offices in Vilnius, Kaunas, and Klaipėda; a listed member of the RIPE NCC; an autonomous system operator; a public procurement entity; a supplier to state and regulated buyers; and a service showcase that emphasizes maintenance, security, cloud migration, databases, networks, and incident response rather than raw hosting. Its 2025 revenue was reported at €42.277 million, with a net profit of €2.322 million, implying a net margin of about 5.5%; Scoris separately reports the same 5.5% profit margin, 174 employees, and revenue per employee of approximately €243,000.

The thesis of this report is that Blue Bridge MSP's margin is produced by operational intermediation. The company sits between the demand of Lithuanian enterprises and the public sector on one side, and global technology suppliers on the other. Its business problem is that upstream suppliers are powerful and transparent; its business opportunity is that customers do not buy 'cloud' as an abstraction. They buy fewer incidents, fewer unplanned migrations, fewer procurement surprises, fewer licensing errors, faster local assistance, and a party that can be held accountable, called, audited, renewed, or replaced. Blue Bridge MSP monetizes that layer of responsibility.

Identity: a legal entity within a broader Blue Bridge brand

Disambiguation begins with the legal and brand surface. The company's own contact page identifies the entity as BLUE BRIDGE MSP, UAB, company code 301489547, VAT code LT100003708514, with service and office addresses in Klaipėda, Kaunas, and Vilnius. The same page gives the company's general contact channels, help-desk channels, and notes that existing customers can report outages through a self-service portal.

This matters because 'Blue Bridge' is not a single, clear public label. The official 'About' page describes the Blue Bridge Group as composed of several companies: Blue Bridge MSP, Blue Bridge Code, and Blue Bridge Baltic. Blue Bridge MSP is described as the group company providing cloud computing, IT infrastructure maintenance, cybersecurity, data management, and physical equipment maintenance services. Blue Bridge Code is presented as the software development branch for operators, accounting, and public services, while Blue Bridge Baltic is described as the group's management company.

This creates a normal but commercially important name ambiguity. A buyer, journalist, or analyst seeing 'Blue Bridge' in a tender or case study must ask whether the counterparty in question is the MSP, the code development entity, a group-level management company, or a consortium involving more than one Blue Bridge legal entity. This ambiguity is not necessarily a risk; it can be an advantage. A group can sell infrastructure operations, application work, and managed support as a combined local capability. But it also complicates attribution. Revenue, employees, certifications, liabilities, and customer satisfaction must be attributed to the right company, not to the brand as a whole.

The Rekvizitai company profile reinforces the basic identity. It lists Blue Bridge MSP, UAB with the same company code, VAT code, Klaipėda address, website, phone, and manager Dalius Butkus. It also reports share capital of €413,830, an age of over eighteen years, 174 insured persons, and an average salary in May 2026 of €4,058.16. Scoris gives the registration date as 13 December 2007, categorizes the company as private without foreign capital, and reports no outstanding SODRA or VMI debt in its comparative profile.

The public ownership picture remains incomplete. Scoris's 'private without foreign capital' signal is useful but does not amount to a full map of beneficial ownership. The official group page explains the brand structure, not the ultimate control economics. Commercially, deeper ownership detail would be important because the perception of local control can matter in sales to the public sector, critical infrastructure, and data sovereignty. A shift from local private control to strategic foreign ownership, private equity ownership, or telecom consolidation would alter the procurement narrative and the company's incentives.

Showcase evidence: it is a broad MSP, not a narrow hoster

The company's own website presents a broad service surface. The home/services navigation includes SOC services, IT infrastructure maintenance, cloud computing, data management, cybersecurity solutions, network solutions, data center infrastructure, and application platform services. The sub-services are granular: SIEM as a service, cybersecurity analysis, EDR, XDR, vulnerability management, hardware repair, workstation maintenance, operating system maintenance, virtualization platform maintenance, backup maintenance, SQL Server and Power BI work, penetration testing, DLP, Cloudflare web application security, DDoS protection, data center networking, enterprise networking, Wi-Fi, SD-WAN, server selection, disaster recovery, Kubernetes, observability, and containerized application deployment.

The breadth is economically significant. Basic infrastructure companies tend to emphasize capacity, locations, and price. Blue Bridge MSP emphasizes operational categories. A customer buying one service can be cross-sold adjacent controls: cloud hosting leads to backup and disaster recovery; SQL modernization leads to licensing and performance work; network modernization leads to managed security; SOC leads to EDR, SIEM, vulnerability management, and incident processes. The margin does not lie just in a single service line; it resides in bundling knowledge of the customer's environment across multiple operational layers.

The official cloud page presents Blue Bridge as one of the first Lithuanian companies to have introduced cloud services over a decade ago, offering public, private, and hybrid cloud models. It also claims a monitored data center with security tools and a 24/7 SOC, and describes cloud work in practical terms: setup, migration, regular resource updates, disaster recovery, and infrastructure powered by AMD Gen IV processors, DDR5 RAM, and NVMe SSDs.

This is not hyperscaler language. It is local cloud language. The company does not say it has global regions or infinite elastic capacity. It says it can select, deploy, migrate, monitor, secure, and maintain infrastructure for Lithuanian customers who need practical continuity. That is the core business pattern.

The network footprint: small, real, and strategically useful

Blue Bridge MSP is listed in the RIPE NCC member directory for Lithuania. The RIPE NCC is the Regional Internet Registry for Europe, the Middle East, and parts of Central Asia, and its member records identify entities in the local Internet registry that receive and manage numbering resources.

Routing data gives a more specific operationally. BGP.tools identifies AS42774 as belonging to Blue Bridge MSP, UAB, with the website bluebridge.lt. The AS was registered in April 2007, is allocated under RIPE, and is shown with three IPv4 prefixes and no IPv6 prefixes in this view. The listed prefixes are 46.255.208.0/21, 185.141.160.0/22, and 194.110.220.0/24, all assigned to Blue Bridge MSP. BGP.tools also shows upstream providers, including UAB Bitė Lietuva and UAB Nacionalinis Telekomunikacijų Tinklas, and visible peers or adjacencies, including Cloudflare, Tele2, Gcore, Swisscom, Habr Europe, and BALT-IX participation at 10 Gbps.

This footprint is modest by global cloud standards, but it is not symbolic. An MSP with its own AS and IP resources can run hosted services, private cloud, customer connectivity, routing policies, abuse management, and peering relationships with more autonomy than a pure reseller. The network footprint supports the company's claim that it can offer virtual data center, backup and disaster recovery services, local monitoring, and customer-specific network designs.

The absence of visible IPv6 in this BGP.tools view is a watch point. It does not prove that Blue Bridge has no IPv6 capability anywhere, because public routing snapshots do not represent the full operational truth. But for a company selling networks, cloud, and data center services, the public IPv6 posture can become a credibility marker, especially as public sector and enterprise modernization requirements advance. Future expansion of IPv6 announcements, RPKI hygiene, peering, or upstream diversity would be a significant signal of investment in network maturity.

Virtual data center: where the product becomes accountable

The company's virtual data center page is one of the stronger showcase proofs because it explains not only what Blue Bridge sells, but how it tries to make a private cloud service economically legible. It states that customers can set up tens or hundreds of servers, create virtual networks, change bandwidth or server size, delete servers, and administer the infrastructure remotely through a self-service. It presents the value proposition as avoiding physical infrastructure purchases and backup/disaster recovery management.

The same page states that pricing is transparent and based on the volume of resources used. It describes Blue Bridge's work as analyzing the customer's systems and technologies, preparing a migration plan, migrating systems, formulating cost/security/performance recommendations, and keeping systems running after migration. It also claims that Blue Bridge is the only IT provider in Lithuania to have publicly presented data center availability metrics for over a decade, and publishes example availability metrics for Hyper-V and VMware environments around 99.98% to 100% for several quarters in 2022–2023.

The availability claim must be read with caution. It is published by the company, not by an independent audit in the sources reviewed here. But the fact of publishing availability metrics is commercially significant. It turns an invisible operational promise into a renewal instrument. A buyer can compare, complain, or demand a service conversation. This helps Blue Bridge sell trust without claiming hyperscaler reach.

The same page includes customer satisfaction scores and incident categories such as equipment failures, connectivity troubles, power disruptions, and customer references. These categories reveal the real MSP business. The product is not 'a server.' The product is the management of ordinary operational failures. In this business, incidents are not exceptions; they are inventory. The more customer environments the provider sees, the more reusable procedures, monitoring thresholds, vendor escalations, and playbooks it can accumulate.

Managed infrastructure: the margin is in memory, not just in labor

Blue Bridge's IT infrastructure maintenance page explains the economic engine of managed services more directly. It offers 24/7 maintenance and crisis support, IT audits, proactive maintenance, help desk-linked monitoring, periodic strategic advice, a dedicated IT manager, easy request logging, automated tools, and a configuration management database. It also describes security practices such as event log review, continuous software updates, equipment standards, password policy, secured administrator workstations, and an optional SOC connection.

This is where switching costs form. A customer that outsources support to an MSP initially buys labor. Over time, it entrusts the MSP with operational memory: asset inventories, administration practices, recurring incidents, undocumented integrations, database bottlenecks, backup exceptions, old hardware, network quirks, and procurement constraints. The CMDB and the help desk history become a second map of the customer's business. Replacing the MSP then becomes more costly than comparing hourly rates.

The promise of a dedicated IT manager is also economically important. It gives the customer a responsible human interface. Hyperscalers can provide enterprise account teams, but a mid-sized company, a municipality, or a regulated Lithuanian entity may not have the budget, language, procurement simplicity, or internal staff to make that relationship effective. Blue Bridge monetizes proximity: the ability to send a technician, attend a procurement meeting, explain a license change, or translate a vague operational complaint into a work order.

SOC and security: selling mutualized paranoia to customers who can't manage it alone

Blue Bridge's SOC page presents the market problem in familiar but important terms: ransomware, disloyal employees, leaked personal data, missed updates, and a shortage of IT professionals. It sells continuous SOC services, real-time professional help, personalized support, reduced ransomware and security risk, reduced investigation costs, and advice on future threats.

The economic logic is scale through shared threat visibility. A single Lithuanian customer may not have enough incidents, logs, or security staff to justify a full internal SOC. An MSP can mutualize analysts, tools, detection logic, vendor relationships, and response templates across customers. The company's case study with Lietuvos paštas, the Lithuanian postal operator, makes this argument explicit. Lietuvos paštas is described as critical infrastructure handling sensitive information, and the case study states that Blue Bridge helped improve visibility and data protection through SIEM and cyber threat monitoring. The customer-side argument in the case study is that an external SOC is more effective because threat expertise is concentrated across multiple customers, allowing faster detection and proactive warnings.

This is not just a security story; it is a margin story. SOC services can become recurring revenue with relatively high switching costs if they are embedded in logs, escalation paths, incident triage, and compliance reports. The risk is that the security tools themselves become commoditized and global vendors capture more economic value. The defense is workflow and accountability: knowing which alert matters for a particular Lithuanian customer at 02:00, who should be called, which system can be shut down, and what risk to the regulator or board is involved.

The company also has a cybersecurity R&D signal. Its EU support page states that Blue Bridge MSP signed a funding agreement with the Lithuanian Innovation Agency on 9 August 2024 for a project entitled 'Development of a cyber security knowledge graph for behavioral analysis.' This does not prove a commercial product. It suggests the company is trying to shift some security work from labor and tool resale toward proprietary analytics or reusable intellectual property. If successful, this could improve margins. If it remains a grant-funded experiment, the commercial effect could be limited.

Data and application platforms: the discreet profit pool

The company's service menu and application platform pages show another margin source: data and application operations. Blue Bridge lists Power BI, SQL Server, database maintenance, Kubernetes, observability, and containerized application deployment among its services. Its application platform page states that it helps customers develop, update, and protect applications with containerized platforms, self-service portals for developers and DevOps teams, scalability, deployment strategies, security policies, and reduced operating system and resource licensing costs.

This is an important layer because many customer problems are not pure infrastructure problems. A company can migrate to the cloud and still suffer from poor SQL licensing, mediocre database performance, fragile integrations, unpatched operating systems, uncontrolled backups, and application version risks. Blue Bridge's strongest commercial position is where these layers overlap. It can tell a customer: we will host or help you choose the cloud, modernize the database, manage the network, secure the environment, monitor logs, repair hardware, and answer the phone.

The Vilniaus vandenys case study illustrates this operational layer. Vilniaus vandenys is described as Lithuania's largest water management company, with about a dozen systems used by 700 employees and a Microsoft Dynamics NAV environment facing SQL Server support and licensing issues. Blue Bridge states it won a public tender, worked in phases, managed legacy integrations and performance problems, completed the project within the planned five months, reduced licensed entities from 25 to 12, merged 16 servers into 5, reduced the number of cores, and standardized the SQL Server infrastructure.

This type of project creates margin because it converts complexity into savings. The value for the customer is not that Blue Bridge provides a cheaper server. It is that Blue Bridge can reduce licensed entities, simplify architecture, manage dependencies, and reduce disruption risks. A hyperscaler can provide infrastructure primitives; it will generally not redesign the legacy ERP integrations of a Lithuanian water utility in a local procurement and support context without a services intermediary.

Customers and procurement: public sector trust is a distribution channel

Blue Bridge MSP's public evidence is unusually procurement-focused. Rekvizitai's tenders page reports the number of public tenders won by year: 182 in 2021, 212 in 2022, 195 in 2023, 221 in 2024, 264 in 2025, and 86 in 2026 as of the source date. It also lists procurement competitors including INFO-TEC paslaugų centras, Telia Lietuva, and BTT Group, and buyers by number or value including the Government Chancellery, the Ministry of Foreign Affairs, Via Lietuva, the Information and Communications Department under the Ministry of the Interior, Sodra, the National Digital Solutions Agency, Kertinis valstybės telekomunikacijų centras, Ignitis Group's service center, and Plačiajuostis internetas.

These numbers should not be treated as revenue segmentation. The number of tenders varies widely in size and can include resale, maintenance, equipment, or service contracts. But they prove repeated exposure to institutional procurement. In Lithuania, this is commercially powerful. Public procurement creates visible references, recurring frameworks, compliance routines, and relationships with buyers whose risk tolerance is lower than that of startups. A supplier that understands how to bid, document qualifications, manage subcontracting, meet national security requirements, and survive competitor challenges can turn administrative competence into a moat.

A concrete procurement record shows Blue Bridge MSP as the winner of a 2024 Ministry of the Environment tender for Wi-Fi equipment and local network modernization services, with a contract value of €37,104.65 and a contract duration extending into 2025. The record also shows a 20% subcontractor, Kompiuterinis modulis, UAB, and notes no claims, no lawsuits, no conflict of interest findings, and that the bid was the most economically advantageous while meeting qualification and national security requirements.

This example is small, but it is useful because it reveals the ground-level mechanisms. MSPs do not only sell strategic cloud transformations. They win practical tenders for Wi-Fi, network modernization, hardware, support, and integration. They subcontract where necessary. They compete on procurement scoring, qualification compliance, and national security filtering. They accumulate many small and medium wins that build account presence and later cross-sell opportunities.

The company's customer case studies also show a mix of regulated, infrastructure, and commercial workloads. Lietuvos paštas used Blue Bridge for SIEM and threat monitoring. Kakava, a ticket distribution platform, used Blue Bridge's cloud computing and maintenance to avoid hiring in-house system administrators and to manage uneven load with 24/7 support. Datalogic, a commerce system handling over 15,000 orders from 30 countries per day, considered major cloud providers such as AWS but chose Blue Bridge after weighing price, quality, server location, accessibility, and risk-controlled migration; the case study states that the result was a 35% productivity increase without spending more, and that the offer was not the cheapest but could reduce long-term costs through flexible pricing and optimized workflow.

The case studies are published by the company and should be viewed accordingly. They are not independent customer reviews. But the named customers and operational details still matter. They show the sales argument that Blue Bridge wants the market to believe: local cloud and managed services can beat global cloud not by being cheaper per unit, but by being better aligned with the customer's risks, staffing constraints, data location preferences, and legacy complexity.

Competition: telecoms, integrators, state infrastructure, and hyperscalers

Blue Bridge MSP's competition is layered. In public procurement, Rekvizitai identifies competitors that have appeared in the same tenders, including Telia Lietuva, INFO-TEC paslaugų centras, and BTT Group. That is the visible local bidder set. More broadly, the company likely faces Lithuanian and Baltic IT integrators, telecom operators, public sector infrastructure providers, hardware resellers, cybersecurity shops, and direct or partner sales from global cloud providers.

The Datalogic case study is telling because it states that the customer evaluated major cloud providers such as AWS and found them technologically suitable. That is the baseline competitive reality: Blue Bridge is not protected from hyperscalers by technical superiority. Customers know that global cloud exists. The question is whether global cloud solves the entire business problem. For some workloads, it will. For others, the customer will prefer a responsible local party that can combine hosting, maintenance, migration, licensing, and support.

The court case involving the Lithuanian Radio and Television Centre and the Kaunas City Polyclinic data center services tender shows another competitive and regulatory dimension. The case involved a challenge to a tender awarded to a group involving Blue Bridge MSP and BLUE BRIDGE, with allegations about whether the data centers were connected or regulated for secured network users and public information resource rules. The appeals court ultimately dismissed the challenge and awarded costs to Blue Bridge MSP, while the record shows that the tender involved data center services such as information system resource rental, server rental, connection to the buyer's data network, and information system consulting.

This case is commercially important because it shows that public sector cloud and data center work is contested not only on price and technical merit, but also on legal eligibility and state infrastructure rules. Blue Bridge's ability to win and defend this type of work is a strength. But a change in Lithuanian rules requiring more workloads to use designated state data centers, secured networks, or sovereign cloud arrangements could reduce the addressable market for an MSP's private data center services. The same court record notes contractual conditions tied to legal requirements to use state data centers, highlighting that regulation can directly affect contract sustainability.

Vendor dependency: the partner stack is both a moat and a margin ceiling

Blue Bridge MSP sells trust, but does not own the underlying global technology stack. Its website references technologies and service categories related to Microsoft, VMware/Hyper-V, SQL Server, Power BI, Cloudflare, EDR/XDR tools, network equipment, and modern server hardware. Its contact page states that its technical service center is an authorized HPE and Fujitsu service center. IBM's PartnerPlus directory lists Blue Bridge MSP as a VAR/reseller/solution provider with competencies related to IBM storage and Terraform-related skills.

This vendor dependency is not a weakness in a simple sense. Partner status can help win tenders, obtain vendor support, access discounts, gain certifications, and reassure conservative buyers. It also allows Blue Bridge to sell solutions rather than invent every layer. The danger is that upstream vendors can squeeze resale margins, change licensing terms, shift services toward direct cloud offerings, or favor larger regional partners. VMware/Broadcom licensing changes, Microsoft's cloud incentives, IBM's storage strategy, Cloudflare's channel terms, HPE/Fujitsu warranty economics, and telecom connectivity pricing can all affect Blue Bridge's economics.

The company's response is bundling. A reseller margin on hardware or licenses is vulnerable. A managed service around that hardware, plus migration, monitoring, CMDB, help desk, SQL optimization, backup, SOC, and procurement documentation is less vulnerable. The more Blue Bridge's revenue comes from recurring managed operations rather than pure equipment and software resale, the stronger the quality of its margin. The public sources reviewed here do not provide a revenue breakdown by resale, projects, cloud subscriptions, SOC, and maintenance. This unresolved fact is one of the most important commercial unknowns.

Pricing power: 'not the cheapest' is the key phrase

The clearest evidence of pricing power appears in the Datalogic case study. The customer reportedly considered AWS and other major cloud options, weighed server location and accessibility, and chose Blue Bridge even though the offer was not the cheapest and required higher upfront costs. The stated reason was lower long-term cost through flexible pricing and optimized workflow, with a 35% productivity increase without spending more.

The company-published case studies may be promotional, but the economic structure is credible. Blue Bridge's pricing power is likely strongest where the customer's alternative is not 'pay less for compute' but 'hire scarce internal administrators, manage vendors, handle migration risk, and bear responsibility for outages.' The Kakava case study indicates that the ticket distributor wanted cloud plus maintenance rather than hiring its own system administrators, and valued the 24/7 competence during uneven traffic loads. This is a classic MSP niche: the customer is not buying infrastructure; it is buying a fractional expert team.

Pricing power is likely weaker in pure equipment resale, simple licensing, and tenders for highly specified commodity goods. The Ministry of the Environment Wi-Fi tender, for example, was awarded as the most economically advantageous bid under a formal process; such contracts may be useful for access and account presence, but may not carry high margin. The profit pool is more likely in blended contracts where Blue Bridge can price risk, integration knowledge, response time, and continuity.

The 2025 financial profile supports this interpretation. A 5.5% net margin is respectable but not software-like. It suggests a blended business with labor, hardware/software resale, support obligations, and competitive bidding. The reported 33% revenue growth and approximately €243,000 revenue per employee are strong signals in the local market, but the wage base is also significant: Scoris reports an average wage at 105% of the sector average, and Rekvizitai reports a May 2026 average salary above €4,000. The company employs skilled people, and skilled people are expensive. Automation, recurring revenue, and tool reuse determine whether growth translates into higher margins.

Switching costs: operational embeddedness outweighs contract duration

Switching costs in this business are not just legal. They are informational and procedural. A customer that has used Blue Bridge for cloud, maintenance, SOC, network support, and database work has effectively outsourced some of its institutional memory. Blue Bridge knows the customer's legacy systems, monitoring alerts, maintenance windows, backup expectations, vendor warranties, license pitfalls, and internal decision-makers. This knowledge is not fully transferable.

The company's own maintenance page points to these switching cost mechanisms: help desk integration, monitoring, CMDB, dedicated IT manager, automated tools, and periodic strategic advice. The virtual data center page adds migration planning, systems analysis, cost/security/performance recommendations, and ongoing system operation. SOC services add another layer: log source selection, SIEM rules, incident criticality, escalation paths, and response procedures. The Lietuvos paštas case study indicates that Blue Bridge optimized log sources by about 30% while monitoring more entities, which is exactly the type of environment-specific tuning that becomes costly to transfer.

These switching costs are commercially valuable, but they also impose obligations. If Blue Bridge suffers a major outage, a security incident, or a decline in support quality, the same embeddedness that protects revenue can intensify customer anger and regulatory scrutiny. An MSP is paid to absorb the operational blame. That is the product.

Margins: a services business with some infrastructure economics

The reported 2025 financial data are useful because they anchor the narrative. Rekvizitai reports 2025 revenue of €42.277 million and a net profit of €2.322 million. Scoris reports the same revenue, a 33% annual increase, 5.5% profit margin, 174 employees, 5% annual workforce growth, an average wage near €3,963 in its profile, and 8.3% staff turnover.

A 5.5% net margin is neither distressed nor spectacular. It is consistent with a business that blends higher-value managed services with lower-margin procurement, equipment, licensing, and project work. The favorable scenario is that Blue Bridge can grow recurring revenue from SOC, managed cloud, Kubernetes/platform, and data management faster than headcount and resale costs. The unfavorable scenario is that growth comes from tender volume and resale, producing revenue without margin expansion.

The vehicle count reported by Rekvizitai — 55 vehicles, of which 28 are owned and 27 are leased or under lease-purchase — also fits the operational profile. It is not a pure remote SaaS company. It likely has field service obligations, hardware repair, on-site customer work, and regional coverage needs. This field capability can support local trust and OEM service authorization, but it also adds fixed costs and operational complexity.

Exposure to abuse, fraud, and security: the provider inherits customer risk

Any company that operates an AS, hosts customer systems, provides cloud services, maintains infrastructure, and sells SOC services has a dual-sided security exposure. On one side, it is a defender: it monitors logs, responds to ransomware risks, manages vulnerabilities, and helps customers reduce incident costs. On the other side, it is an infrastructure operator: customer systems can be compromised, hosted assets can generate abuse, and routing or data center outages can affect multiple customers at once.

Public routing evidence shows Blue Bridge MSP as an AS operator with its own IPv4 resources and an abuse contact role in the BGP.tools view linked to RIPE. The official SOC page emphasizes ransomware, leaked data, missed updates, and IT staffing shortages as customer risks. These risks also define Blue Bridge's liability surface. If the company's SOC detects a threat late, if hosted workloads are abused, if a backup fails, or if a customer's regulated data is exposed, the reputational damage can exceed the immediate contract value.

The public trails reviewed did not surface a major public scandal, a broad pattern of customer complaints, or distinctive operator forum chatter strong enough to change the assessment. This absence should not be overinterpreted. Many MSP incidents are resolved privately, hidden in customer contracts, or visible only through procurement correspondence, insurance claims, CERT channels, or closed professional communities. For business analysis, the absence of visible complaints is slightly positive, but does not constitute proof of operational excellence.

The most important point is that security exposure is endogenous to Blue Bridge's strategy. The company deliberately moves toward the customer's operational core. This increases switching costs and margin potential, but it also increases the blast radius.

Public praise and market signals: mostly controlled, but still informative

The visible customer praise is primarily company-controlled case study material. Lietuvos paštas, Kakava, Datalogic, and Vilniaus vandenys are useful named references, but they are not independent reviews. They show the sales narrative and customer categories more than they prove objective satisfaction.

The non-official signals from business directories and procurement are more independent. Rekvizitai and Scoris report financial data, headcount, wages, risks, and tender statistics; public procurement registers show actual contracts and entities; court records show contested public sector work and legal outcomes. These sources are not perfect. Directories can have lag, tender statistics can aggregate different contracts, and court cases reflect disputes rather than day-to-day performance. But together they are stronger than a simple registry lookup.

The HR surface and social channels are less decisive. Rekvizitai lists Facebook and LinkedIn links, and employer/labor market marketing snippets describe Blue Bridge Group as a large Lithuanian IT group with activities from cybersecurity and cloud computing to critical systems maintenance. This supports employer branding but does not prove hiring velocity, skill depth, or retention beyond the already cited directory statistics.

Geography: Lithuania is small enough for trust to matter and large enough for complexity

Blue Bridge MSP's geography is commercially coherent. Its contact page lists a service presence in Klaipėda, Kaunas, and Vilnius, with support contacts and repair/help center details. This covers Lithuania's main business geography. The company can credibly serve national public sector institutions, regional enterprises, and customers needing on-site support.

Lithuania is small enough that reputation, procurement familiarity, and local-language trust matter. It is also complex enough to have banks, utilities, logistics companies, government agencies, telecom infrastructure, EU-regulated data, and cyber requirements that exceed the capacity of many internal IT teams. That is the structural niche for an MSP like Blue Bridge: too local and operational for hyperscalers to handle directly with small contracts, but too complex for customers to self-manage cheaply.

The company's customer examples show this niche: a postal operator classed as critical infrastructure, a municipal water utility, a ticket distributor with uneven load, and a commerce platform with international orders. These are not identical customers, but they share a need for reliability under constraints.

What unresolved facts would change

Several important commercial facts are not resolved by the public trails.

The first is the composition of revenue. The difference between €42 million in revenue with a 5.5% margin coming from recurring managed services and €42 million with a large low-margin hardware/software resale component is enormous. The former would warrant a higher-quality valuation; the latter would be more exposed to procurement cycles and vendor terms. The public service pages and case studies show managed service capability, but not revenue by segment.

The second is customer concentration. Rekvizitai's tender data identify top public buyers by value since 2015, including the National Digital Solutions Agency, Kertinis valstybės telekomunikacijų centras, Sodra, Ignitis Group's service center, and Plačiajuostis internetas. But this does not show current revenue concentration or renewal risk. A few large state or regulated buyers could make revenue more predictable, or more dependent on political and procurement cycles.

The third is data center ownership and certification depth. Blue Bridge publicly discusses its data center, availability metrics, and cloud services, but the sources reviewed do not fully establish ownership versus colocation arrangements, the full certification stack, power redundancy architecture, or audited SLA performance. These details would change the assessment of capital intensity and resilience.

The fourth is ultimate ownership and governance. The public sources reviewed here identify the company, the manager, the group structure, and the private without foreign capital status, but not a complete beneficial ownership and control chain. This matters for sensitive customers, acquisition risk, and strategic direction.

The fifth is the security incident record. The absence of a visible major scandal is helpful but incomplete. An MSP's true security record can lie in private customer communications, CERT reports, cyber-insurance files, or non-public incident response. If evidence emerged of a serious hosted customer breach caused by Blue Bridge's negligence, the trust thesis would materially weaken. If independent audits, certifications, and customer references showed strong incident performance, the margin thesis would strengthen.

The sixth is automation. With 174 employees and high wage levels, margin expansion depends partly on Blue Bridge's ability to automate monitoring, ticket management, SOC triage, patching, reporting, and infrastructure provisioning. The 2024 cybersecurity knowledge graph project is relevant here, but its commercial outcome is unproven.

Assessment

Blue Bridge MSP, UAB is best understood as a Lithuanian responsibility-layer company. Its visible assets are not just servers, IP addresses, or vendor authorizations. They are the procurement history, local trust, staff capacity, customer operational memory, field service, network autonomy, security processes, and the ability to translate global platforms into functional Lithuanian enterprise operations.

The central economic puzzle — how an MSP earns margin when hyperscalers own the platforms — finds an answer in the company's evidence pattern. Blue Bridge does not need to own the global cloud layer to make money from the cloud. It makes money where customers cannot or will not operate the layer themselves: migration planning, hybrid design, data localization, SQL licensing, network modernization, 24/7 response, SOC monitoring, hardware repair, disaster recovery, and public procurement compliance.

The company's reported 2025 financial data show a significant business, not a software-like margin machine. A 5.5% net margin is compatible with a competitive, labor-intensive, vendor-dependent IT services model. But the same data also show scale, growth, and employee productivity that are significant for a local MSP. The upside potential is margin expansion through recurring SOC, cloud operations, platform engineering, and reusable security analytics. The downside risk is margin compression from tendering, simple resale, rising labor costs, direct hyperscaler competition, and vendor licensing changes.

Blue Bridge's moat is therefore practical rather than spectacular. It is not a monopoly. It is not insulated from Telia, state infrastructure, hyperscalers, or other integrators. It is not proved by its own marketing. But it occupies a commercially durable position: the local go-to operator for organizations that need someone to be responsible when infrastructure, applications, data, and security meet.

Evidence register

1. Blue Bridge contact page — URL:https://bluebridge.lt/en/contacts/— Source type: official company source. Proves: legal name BLUE BRIDGE MSP, UAB; company code 301489547; VAT code; offices/service points in Klaipėda, Kaunas and Vilnius; support contacts; self-service outage reporting; claim of authorized HPE and Fujitsu service center. Does not prove: ownership chain, revenue composition, customer satisfaction, audited service quality. Commercial significance: establishes the operational entity, geographic scope and field support posture behind the MSP claim.
2. Blue Bridge 'About' page — URL:https://bluebridge.lt/apie-mus/— Source type: official company/group source. Proves: Blue Bridge is a group brand with Blue Bridge MSP, Blue Bridge Code and Blue Bridge Baltic; MSP is positioned around cloud, infrastructure maintenance, cybersecurity, data management and equipment services. Does not prove: legal ownership percentages or consolidated financial data. Commercial significance: explains the name ambiguity and shows how infrastructure operations can be bundled with software and group-level functions.
3. Blue Bridge home/services navigation — URL:https://bluebridge.lt/en/— Source type: official showcase. Proves: broad service menu covering SOC, infrastructure maintenance, cloud, data, cybersecurity, networks, data center infrastructure and application platforms. Does not prove: revenue by service line or delivery depth in each category. Commercial significance: shows that Blue Bridge's strategy is a multi-layer MSP play, not narrow hosting.
4. Blue Bridge cloud computing page — URL:https://bluebridge.lt/en/services/cloud-computing/— Source type: official product/service page. Proves: public/private/hybrid cloud positioning, data center and SOC integration claims, migration/setup support and hardware modernization messaging. Does not prove: audited data center capacity, availability or certification. Commercial significance: supports the thesis that Blue Bridge sells local cloud operations and integration rather than raw hyperscale compute.
5. Blue Bridge virtual data center page — URL:https://bluebridge.lt/en/services/cloud-computing/virtual-data-centre-virtual-server/— Source type: official service page. Proves: self-service virtual servers/networks, resource-based pricing claim, migration and ongoing operations work, publication of availability and satisfaction metrics. Does not prove: independent SLA performance or customer-level failure history. Commercial significance: shows how the company packages infrastructure as responsible private cloud operations.
6. Blue Bridge IT infrastructure maintenance page — URL:https://bluebridge.lt/en/services/it-infrastructure-maintenance-runtime/— Source type: official service page. Proves: 24/7 support, proactive monitoring, help desk integration, CMDB, dedicated IT manager, security maintenance practices. Does not prove: realized retention, ticket quality or staff ratios. Commercial significance: identifies the mechanisms that create switching costs and recurring managed service revenue.
7. Blue Bridge SOC page and Lietuvos paštas case study — URLs:https://bluebridge.lt/en/services/soc/andhttps://bluebridge.lt/en/2022/08/31/lietuvos-pastas-soc/— Source type: official service page and company-published customer case. Proves: SOC positioning around ransomware, leaked data, missed updates and IT staffing shortage; named critical infrastructure customer using SIEM and cyber threat monitoring. Does not prove: independent security effectiveness or incident outcomes. Commercial significance: supports the recurring security services margin thesis and the 'mutualized expertise' argument.
8. Rekvizitai company profile — URL:https://rekvizitai.vz.lt/en/company/blue_bridge_msp/— Source type: Lithuanian business directory. Proves: company identifiers, manager, headcount, wage data, 2025 revenue and net profit, share capital, tax/social insurance signals, vehicle count. Does not prove: audited segment margins or current order book. Commercial significance: anchors scale and profitability; supports the conclusion that Blue Bridge is a significant local MSP with moderate net margins.
9. Scoris company comparison profile — URL:https://scoris.lt/en/palyginti-imones?id1=301120532&id2=301489547— Source type: business analysis/credit directory. Proves: registration date, private-no-foreign-capital classification, revenue growth, 5.5% margin, revenue per employee, employee count, wage vs sector, staff turnover and no outstanding SODRA/VMI debt in the profile. Does not prove: beneficial ownership details or earnings quality. Commercial significance: reinforces the financial and operational scale assessment.
10. RIPE NCC member list for Lithuania and BGP.tools AS42774 page — URLs:https://www.ripe.net/membership/member-support/list-of-members/lt/andhttps://bgp.tools/as/42774— Source type: regional Internet registry member listing and routing intelligence source. Proves: Blue Bridge MSP appears as a Lithuanian RIPE member; AS42774 is assigned to Blue Bridge MSP; visible IPv4 prefixes, upstream providers, peers and BALT-IX presence. Does not prove: full network performance, private connectivity or internal architecture. Commercial significance: confirms a real network operator capability behind the cloud/data center story.
11. Rekvizitai tender statistics and CVPP public procurement record — URLs:https://rekvizitai.vz.lt/en/company/blue_bridge_msp/tenders/?year=allandhttps://cvpp.eviesiejipirkimai.lt/ReportsOrProtocol/Details/2024-640613?formTypeId=1— Source type: business/public procurement directory and official procurement record. Proves: repeated public tender wins, named buyers and competitors, and a specific Ministry of the Environment Wi-Fi/network modernization contract awarded to Blue Bridge MSP. Does not prove: profitability of these contracts or customer satisfaction after delivery. Commercial significance: shows public sector distribution, the competitive set and procurement capability.
12. LITEKO court decision on a data center services procurement — URL:https://liteko.teismai.lt/viesasprendimupaieska/tekstas.aspx?id=09aea554-9c3d-4873-b2b6-d7d9dc421816— Source type: Lithuanian court record. Proves: contested data center services tender involving a Blue Bridge MSP/BLUE BRIDGE group; legal arguments over secured network/public information resource rules; challenge dismissed. Does not prove: general legal risk level or future procurement eligibility. Commercial significance: shows both strength and risk in public sector private cloud/data center work.
13. IBM PartnerPlus directory — URL:https://www.ibm.com/partnerplus/directory/company/8894— Source type: official vendor-partner directory. Proves: Blue Bridge MSP appears as an IBM partner/reseller/solution provider with storage and Terraform competencies in the directory result. Does not prove: revenue from IBM products or margin terms. Commercial significance: illustrates vendor channel dependency and partnership credibility.
14. Customer case studies: Kakava, Datalogic, Vilniaus vandenys — URLs:https://bluebridge.lt/en/2022/08/22/kakava-case-study/;https://bluebridge.lt/en/2022/08/22/datalogic-case-study/;https://bluebridge.lt/en/2022/08/22/vilniaus-vandenys-case-study/— Source type: company-published customer references. Proves: named customer narratives around cloud and maintenance, comparison with AWS/global cloud, productivity, local server location/accessibility concerns, SQL consolidation and ERP/database modernization. Does not prove: independent satisfaction or recurring revenue. Commercial significance: shows why customers may choose a local MSP over pure hyperscale alternatives.

Watch points: 12-36 month signals that would change the assessment

1. Revenue quality versus revenue growth. If revenue continues to rise but net margin stays near 5% or falls, the business may be growing through low-margin resale or competitive bidding. If revenue rises with margin trending toward high single digits, the recurring managed services thesis strengthens.
2. Segment disclosure or credible proxies. Any evidence separating hardware/software resale, cloud subscriptions, SOC, infrastructure maintenance, project services and public procurement would materially improve the assessment of earnings quality.
3. Retention or loss of large public buyers. Renewals or losses involving the National Digital Solutions Agency, Kertinis valstybės telekomunikacijų centras, Sodra, Ignitis-related entities, Via Lietuva or ministries would matter more than small tender counts.
4. Regulatory moves toward state data centers or sovereign cloud. Lithuanian rules requiring more public workloads to use designated state infrastructure could shrink Blue Bridge's private data center opportunity; rules allowing certified private operators could expand it.
5. AS42774 network modernization. New IPv6 announcements, greater upstream diversity, stronger peering, visible RPKI hygiene or increased BALT-IX capacity would signal infrastructure investment. Shrinking prefixes, degraded peering or persistent lack of modernization would be negative.
6. Availability transparency beyond 2023. Continued publication of data center availability and incident categories would support the trust thesis. Gaps, withdrawn metrics or unexplained deterioration would be a red flag.
7. Security incident record. A major ransomware, backup failure, SOC miss, hosted abuse or customer data incident tied to Blue Bridge would directly attack its core asset: responsibility. Conversely, independent certifications, audits and credible incident response successes would strengthen the moat.
8. Cybersecurity knowledge graph R&D commercialization. An industrialized detection platform, SOC productivity gain, patentable method or customer adoption would suggest margin expansion through IP. A silent project end would imply limited commercial effect.
9. Vendor-partner status changes. Loss or downgrade of IBM, HPE, Fujitsu, Microsoft, VMware/Broadcom, Cloudflare or network equipment relationships would pressure credibility and margins. New elite-level partnerships could broaden addressable tenders.
10. Labor productivity and retention. Revenue per employee, wage inflation and staff turnover are key. Rising revenue per employee with stable service quality would imply automation and operational leverage. Rising wages with flat productivity would squeeze margins.
11. Independent customer signals. Praise, complaints, outage reports, procurement penalties or renewal commentary not published by the company would be more probative than official case studies.
12. Ownership or consolidation event. Acquisition by a telecom, Baltic integrator, private equity buyer or foreign strategic partner would change the local-control narrative, vendor bargaining power, capital availability and public sector perception.
13. Data center capex or architecture shift. Evidence of new facility investment, colocation expansion, power contract changes, certified redundancy or migration toward hyperscaler-backed hybrid services would clarify whether Blue Bridge is doubling down on owned/local infrastructure or becoming more asset-light.
14. Competitive displacement in tenders. Repeated losses to Telia, state infrastructure providers, Atea/Novian-type integrators, cybersecurity specialists or hyperscaler partners in cloud/SOC/network tenders would indicate erosion of Blue Bridge's procurement moat.