Adding cybersecurity services: 5 things MSPs need to know

November 15, 2021 by

Drew Robb

Security is the bane of businesses large and small. Their main goal, typically, is developing, marketing and selling products. They initiate IT programs to build systems and applications to digitally transform and boost efficiency to support this. Yet, such benefits are often submerged under an avalanche of security threats. They find themselves jumping from firestorm to cybersecurity firestorm. 

That’s why there is so much interest in handing off security duties to MSPs. Those already in the MSP business for areas such as backup, data protection and help desk are increasingly being asked to augment those services with various security safeguards. In many cases, this may lie outside the MSP’s comfort zone. However, failure to offer such services could result in losing customers to another provider more willing to address cyber threats. 

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

The tips below will help you add services such as ransomware protection, encryption, threat detection/hunting, managed detected and response (MDR), security information and event monitoring (SIEM), access controls, patch management and security awareness training in a smooth, efficient and cost-effective manner.

1. Partner for success

How can an MSP without a strong security background hope to compete with the big names in security, many of which have launched their own managed security services? By partnering with security specialists that offer plug-and-play security services, the MSP can fold into their own offerings. 

Some IT and security vendors provide these services at a big enough discount to MSPs to make it profitable to deliver them to others. Instead of building the service, the MSP rebrands a security service from an established IT security firm. Thus, an MSP in the telecommunication sector, for instance, can add security training or ransomware protection to supplement its existing VoIP, networking and desktop-as-a-service offerings. 

Take the case of H2Cyber, a cybersecurity executive management firm offering virtual Chief Information Security Officer (vCISO) services and cybersecurity and risk management. The company also offers white-labeled services for cybersecurity compliance, antivirus and cyber security services that come from a collection of other MSPs. Syxsense, for example, provides patch management and vulnerability scanning to remediate software and OS vulnerabilities.

“We partnered with a vendor that can automatically patch Windows, Linux and Apple systems, as well as vulnerability scanning of our systems,” said Paul Horn, founder and CEO of H2Cyber.   

2. Focus on your strengths

The MSP market has grown up so fast because traditional IT and security vendors are better at selling hardware and software, not in servicing customers. Some may have recently entered the MSP space, but they rarely excel there. 

The entire MSP business model, on the other hand, is based on being good at dealing with customer service, IT support and looking after the diverse needs of organizations. Increasingly, this skill is called upon by customers who want the MSP to be the intermediary between a large vendor ecosystem and the services they need. 

“Our customers want to know what works; they don’t have time to research and evaluate the different solutions out there, so they expect us to find the best MSP services that they need,” said Horn. 

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

3. Stick to your niche

MSPs often spring up to service certain types of business, geographies or verticals such as financial services or education. Fast service, responsive support and a caring attitude toward the needs of a specific market niche distinguish the MSP from tech vendors and the mega-service providers that attempt to serve everyone. 

Equity Methods, for example, operate in a niche within financial services known as equity compensation. It has assembled a collection of tools from MSPs and security vendors that it can profitably offer to its own clients. 

“Making sure phishing and spearphishing attempts are stopped before they make it into our inboxes is very important, especially as attackers are becoming increasingly sophisticated,” said Paul Leisey, CIO of Equity Methods. “We leverage the expertise of our partners to pick the right products with the right features for the right price so that we can offer them effectively and add value to our primary services.” 

4. Avoid overselling 

MSPs moving into managed security services should be realistic about their capabilities. It is best to choose a provider whereby MSPs can deal directly with simple, everyday issues and escalate real challenges to the actual software or service provider. 

“The majority of our clients are in regulated industries and have unique business requirements,” said Adam Rusak, managing director of data center services MSP adryTech. “We often become an extension of their technology team.” 

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

5. Turn inquiries into opportunities 

Customers will inevitably ask MSPs what they are doing to protect their systems, defeat ransomware and make their users more aware of the dangers of malicious phishing links and attachments.

These customers already have a relationship with you as an MSP. In all likelihood, they would prefer to have you provide additional security services rather than dealing with another provider. Instead of fumbling such inquiries, turn them into upsell opportunities by having to hand a series of security offerings as part of your portfolio.