How to add managed security to your MSP without becoming an MSSP.

Your clients are asking about security. Not in a vague “we should look at that someday” way. They’re asking because their insurer sent a questionnaire, because a tender wanted evidence, because someone on the board read about a business like theirs on the news, or because half their staff are pasting client data into ChatGPT and nobody can see it.

That’s new. For years the hardest part of selling security was convincing people they needed it. That part’s done. The demand showed up on its own.

The problem is what happens next. You go looking for how to answer it, and every path you get shown involves hiring analysts you can’t find, buying platforms you can’t justify, and standing up a roster nobody wants to work. So the conversation gets parked, and six months later a client asks again.

So here’s the point of this guide. You don’t have to become an MSSP to sell security properly. You just have to stop trying to do it with point solutions, and get clear on which of the three routes actually fits your business. This’ll take about ten minutes.

The demand is already sitting in your base

You don’t need to generate this. It’s there. Four things are driving it and none of them are slowing down.

Insurance. Cyber cover renewals have turned into audits. Insurers want to know you’ve got detection and response running, email protection in place, and evidence of controls. “We’ve got antivirus” doesn’t get a policy written any more.

Compliance. Essential Eight maturity and SMB1001 certification are turning up in tenders and supply chain questionnaires. Your client’s biggest customer is now asking them for proof, which means they’re about to ask you.

AI. The big one, and it landed faster than anything before it. Netskope’s research puts 94 per cent of organisations as lacking visibility into AI use in their business. Only 9 per cent have any inline prevention for AI and agentic actions. Meanwhile your clients’ staff are already using it daily. Every business owner in the country has now had a version of the thought “hang on, what are our people putting into these things?”

The attacks changed. CrowdStrike has 82 per cent of detections as malware free. Sophos puts 79 per cent of ransomware attacks down to a stolen identity, with 97 per cent of those victims already on MFA. IBM attributes one in five breaches to shadow AI. Verizon has edge devices at 22 per cent of exploitation breaches, up eightfold in a year.

Read that last one again, because it’s the one that should change how you think about your stack. Four out of five intrusions don’t involve malware at all. Nobody installs anything. They log in with a stolen credential, land in an inbox, move through cloud apps, and walk out with data. There’s nothing for an antivirus product to find.

Why point solutions stopped being enough

Most MSP security stacks look roughly the same. Endpoint protection, Microsoft 365 with whatever security came in the bundle, email filtering, backup, MFA. Each piece is fine. Several are very good.

The trouble is they were assembled over a decade, one product at a time, to solve problems as they came up. Nobody designed them as a system, and they all share the same blind spot: they watch things that happen on a device, or in a mailbox, or inside the Microsoft tenant. They don’t sit in the path of what your clients’ people actually do all day.

So when a staff member uploads a client list to a personal drive, nothing stops it. When they paste a contract into an AI tool, nothing sees it. When an attacker logs in with a valid credential from a stolen session token, nothing fires, because nothing malicious happened. Technically, a legitimate user did some ordinary things.

That’s not a gap you patch with another product. It’s a gap you close with a different layer, and that’s the shift from selling security products to delivering a security service.

Your clients can’t tell the difference between those two things. Their insurer can, their auditor can, and the attacker definitely can.

What an MSSP actually is, and why you probably don’t need to become one

An MSSP operates security outcomes. Not sells them, not deploys them. Operates them, around the clock, and answers for them when something goes wrong.

That’s the whole definition. Notice what’s not in it: owning the platforms, employing the analysts, running the SOC. Those are implementation details, and they’re the expensive ones.

Your clients have never once asked whether their provider is technically an MSSP. What they ask, in various forms, is much simpler. If something happens at two in the morning, who’s watching, and who rings me?

You need a good answer to that question. You don’t necessarily need to be the person holding the pager.

The three paths, honestly

There are three routes. All of them work for somebody.

Build it. Hire the analysts, stand up the operations capability, buy and integrate the platforms. When it fits, it pays off: you own the margin, the capability and the brand. It fits when you’ve got the scale to keep specialists busy and the appetite to run a roster. Realistically that means several thousand managed seats and a security led identity in the market. Below that you’re funding a very expensive capability across too few customers, and competing for analysts against banks.

Resell a platform. Buy a channel friendly security platform and sell it across your base. These platforms are good, and they’ve made serious detection affordable for small business in a way nothing else did. Just be clear about what you’re buying. You’re buying capability, not coverage. The alerts come to your team. The triage is yours, the response is yours, the Saturday night is yours.

Partner for delivery. Someone else runs the platforms and the operations. You sell it, you own the client, you stay the relationship. You move in weeks, carry no build cost, and you’re not hiring into the tightest talent market in the country. The trade is real: less control over the stack, and you’re relying on your partner to be good. Which makes choosing the partner a serious decision rather than a procurement exercise.

If you’re under a few thousand seats and you want to be selling security this quarter rather than next year, the third option is the one that fits. That’s not a consolation prize. An MSP that partners well delivers a better outcome than an MSP that builds badly, and the client experiences the outcome, not your org chart.

The four layers any real offer needs

Whichever route you take, the offer needs the same four pieces. Most stalled security practices are missing two of them.

Detection and response across endpoint and identity. Something watching devices and accounts, with someone acting on what it finds. Identity matters as much as endpoint now, because that’s where the intrusions start.

Inline control over cloud and AI. The layer most MSPs don’t have, and the one all those numbers point at. Detection tells you what happened. Inline control sits in the traffic and stops it happening: sensitive data heading into an unapproved AI tool, access granted to applications instead of whole networks, the cloud and SaaS traffic no endpoint agent ever sees. If you add one layer this year, make it this one. It’s also the easiest conversation to open, because your clients are already asking about AI.

Dedicated email security. Email is still where most incidents start, and native filters increasingly wave through AI written phishing that reads perfectly. A dedicated layer stops the message at delivery and pulls it back out of mailboxes afterwards, which native filtering can’t do.

Someone operating all of it. The unglamorous one that decides whether the other three are real. Tools nobody watches don’t detect anything. This is also the layer that decides whether you need staff, a platform, or a partner.

Three of our guides go deeper on the first three, and they’re free: the AI one, the Microsoft one, and the one on why detection isn’t protection.

A ninety day plan

This assumes the partner route, because that’s the one with a ninety day shape to it.

Weeks 1 and 2. Pick one service and ten clients. Don’t launch a portfolio. Launch one thing, to the ten clients most likely to say yes. The AI conversation is usually the easiest opener because they raise it themselves. Your ten are the ones with compliance pressure, an insurance renewal coming, a recent near miss, or a board that’s started asking questions.

Weeks 3 and 4. Package it and train the people who’ll sell it. Decide what it’s called on your invoice, what’s in it, and what the conversation sounds like. Train the people who’ll have that conversation, and that’s not just you. An offer only the owner can explain doesn’t scale past the owner’s calendar.

Weeks 5 to 8. Get two or three live. Resist perfecting the proposition first. The first customer will teach you more than any internal workshop. Write down what they asked, what they pushed back on, and what made them sign.

Weeks 9 to 12. Add the second layer and build the reporting rhythm. Go back to the clients who took the first service and add the next one. Get a monthly or quarterly report in front of them that they can hand to their insurer or their board. That’s what turns a security service from a line item into the reason they stay.

The mistakes worth avoiding

Leading with the product. Clients don’t buy detection platforms. They buy not having a terrible week. Open with the outcome, not the stack.

Building everything before selling anything. Perfect packaging, perfect pricing, perfect documentation, no customers. Sell one, learn, then build the machine around what actually happened.

Selling detection and calling it protection. The most common technical gap, and the most expensive one to find out about later.

Skipping email. It’s the least interesting layer and the most common way in. Clients understand it instantly, which makes it the easiest first sale you’ll have.

Not having an onshore answer. Australian clients in regulated sectors will ask where their data goes and who’s looking at it. “I’ll find out” is a bad answer in a tender.

How Fifteen fits

Frequently asked questions