The cybersecurity-as-a-service model: What MSPs should know

As a professional in the technology space, you are likely aware of the growing number of cyberattack attempts affecting companies today. For example, there has been a 62% rise in the amount of global ransomware attacks since 2019, including a 158% increase in North America. 

Consequently, organizations across all industries are starting to take cybersecurity more seriously: According to one report, the global cybersecurity services market was valued at $91.15 billion last year and is expected to grow to $192.70 Billion by 2028. 

When viewing these trends, you may ask yourself questions like, “Are my clients interested in enhancing their cybersecurity posture? Are small and medium-sized businesses (SMBs) willing to pay more for these services? How can my MSP enter this increasingly lucrative market?”

In the The State of SMB Cybersecurity in 2024 survey conducted by Vanson Bourne and commissioned by ConnectWise, 83% of SMBs said they are planning to increase their level of investment in cybersecurity throughout this year and beyond.

It’s apparent that the desire for better cybersecurity is strong among MSP customers. To help you find success in this area, let’s take a closer look at what cybersecurity-as-a-service means and how your business can get started selling these services to your clients. 

What is cybersecurity-as-a-service?  

Hopefully your company is already taking advantage of the “as-a-service” model of doing business. Bundling together the hardware, software, support, and services you provide for a monthly fee results in:

• Predictable recurring revenue
• Increased customer retention
• Accelerated business growth
• And more

Accordingly, cybersecurity-as-a-service refers to the practice of providing organizations with cybersecurity solutions and services on an ongoing basis. The exact scope and type of solutions and services that your MSP can provide largely depends on where you are in your own cybersecurity maturity journey and how prepared you are to extend your cybersecurity expertise onto their clients. That being said, some of the top cybersecurity-as-a-service offerings that we see MSP clients eager to adopt include:

• Endpoint monitoring
• Managed patching
• Threat detection and response
• Threat intelligence
• Security operations center (SOC) services
• Security information and event management (SIEM) 
• Backup and disaster recovery (BDR) 

You may be familiar with the term managed security services provider (MSSP). These companies usually aren’t interested in scaling other managed IT services, instead choosing to focus solely on security. MSSPs tend to serve large organizations, and they use enterprise-level tools in combination with a full staff of cybersecurity experts to offer the above services.

It’s possible for your business to transition into becoming an MSSP, however you may find that the high upfront costs and ongoing investment required to build and maintain in-house security infrastructure to be too much. That’s why we are seeing an increasing number of MSPs that want to offer these services look into becoming an MSP+, or a cybersecurity-first MSP. Here’s how your MSP can make that transition in order to adopt the cybersecurity-as-a-service model.

How can my MSP get started with cybersecurity-as-a- service? 

To become a cybersecurity-first solutions provider and begin offering cybersecurity-as-a-service to clients, there are a few phases that your MSP will need to progress through. Let’s take a look at the three key stages you should be planning for in this journey. 

Stage #1: Inspecting your systems

This is the launching point for most MSPs, and it’s entirely possible your business is here right now. In this stage, you want to start offering cybersecurity-as-a-service but aren’t quite sure where to start. While you may have strong IT practices and monitoring in place, you don’t have a strategic plan regarding cybersecurity and it’s likely that there are gaps in your own cybersecurity posture that need to be addressed. 

Action step: Conduct an internal cybersecurity risk assessment to determine how you can reduce risk within your own systems. After all, you won’t be able to effectively help clients until your house is protected.

Stage #2: Preparing for launch

At this point, your MSP is aware of the areas where it is incurring risk and is taking steps to reduce that risk. For example, you might use a set of well-respected best practices such as the NIST Cybersecurity Framework or the MSP+ Cybersecurity Framework to better understand your own environment and plug gaps that were found during your internal risk assessment.

During this stage you should also be tracking security-related tickets and resolutions to identify clients that clearly have a need in this area. When you are comfortable, you can begin initiating risk management conversations with these clients and thinking about the cybersecurity standards and services that you will recommend.

Action step: Conduct cybersecurity training for your staff to ensure everyone is on the same page and that they are aware of the best practices and procedures that should be followed moving forward. Additionally, you can utilize risk assessment software to start offering assessments for clients. 

Stage #3: Achieving liftoff

Now your MSP has instilled a cybersecurity-first culture and you have begun to educate clients about where their risks exist and how you can help them shore up their defenses. Note the importance of making sure clients understand that cybersecurity is a shared responsibility.

You are procuring cybersecurity solutions to help with automated endpoint monitoring, network security, threat detection and response, SOC-as-a-service, and more. You understand the profit margins on these services and how you will help clients unlock value from them by serving as their trusted cybersecurity advisor. 

At this stage you can start officially offering cybersecurity-as-a-service to interested clients, and you help them progress through the security roadmap that you have developed together. Your MSP is proactively researching and preparing for emerging threat environments and thinking about the security-forward conversations you can have with clients to keep them as protected as possible.

Action step: Provide quarterly cybersecurity performance reports to clients to demonstrate your commitment in this area and ensure that you are in sync in terms of next steps for bolstering security. 

Increasing scalability and profitability with cybersecurity- as-a-service

There is no doubt that the demand for cybersecurity services is strong and will continue to stay high in the coming years. Many SMBs are aware of their lackluster security posture and are willing to spend more to solve their problems — they just need a cybersecurity-first IT services provider to step up and initiate the conversation. The path toward offering cybersecurity-as-a-service to these businesses is a serious undertaking, but it’s not as daunting as it may seem. The question is: Are you willing to accept the mission?