Skip to content
Made in the UK

MSP Growth

How should MSPs price managed security and protect margin?

By , CRO, CybaVerse. Last reviewed

MSPs should price managed security as tiered, per-user or per-device monthly services that reflect the risk removed, not tool cost plus a mark-up. Build in licences, partner fees, onboarding and incident time, set a target margin per tier, and review prices yearly so margin holds as costs change.

This page is part of our MSP growth guide.

Why do MSPs lose margin on security?

Margin usually leaks through hidden effort rather than headline prices. Incident handling, onboarding new sites, tuning alerts and chasing remediation all take engineer time that is rarely priced in. Discounting security to win an IT deal makes it worse, because security costs grow with every device and every incident.

  • Unpriced incident and remediation time.
  • Licence and partner cost rises not passed on.
  • One-off discounts that become permanent.

Which pricing models do MSPs use?

Most MSPs choose between per-user, per-device and tiered bundles. Each has trade-offs for simplicity, fairness and margin. The table summarises them so you can pick the model that matches how your clients already buy IT services, which makes quoting and renewals easier for your sales team.

ModelBest forWatch out for
Per userCloud-first clientsShared devices and servers
Per deviceDevice-heavy estatesMobile and BYOD growth
Tiered bundleUpselling over timeToo many tiers confuse buyers
Add-on to IT contractFast attachHidden within IT discounting

How do you set a price, step by step?

A repeatable method keeps pricing consistent across your sales team. The steps below help MSPs reach a price that protects margin and can be explained to clients. Revisit the inputs whenever partner costs, licence prices or your average incident effort change significantly.

  1. Step 1: List all direct costs

    Licences, MDR partner fees and any tooling per user or device.

  2. Step 2: Estimate people time

    Onboarding, monthly reviews, incident support and remediation hours.

  3. Step 3: Set a target margin per tier

    Decide the margin you need and price each tier to reach it.

  4. Step 4: Benchmark the value

    Compare with the cost to the client of building the capability themselves.

  5. Step 5: Review yearly

    Adjust at renewal and pass on cost increases with notice.

Where does CybaOps fit in MSP security pricing?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. Because MSPs own the relationship and the price to their clients, they decide their own tiers. Partner commercial terms are shared directly through the partner programme, not published here.

  • CybaVerse sells only through partners: MSPs, resellers and distributors.
  • CybaVerse offers three MDR packages, CybaCore, CybaEdge and CybaOne, sold through MSPs and resellers.
  • MSPs can run CybaOps across all their customers from one multi-tenant platform.
  • Partners get a portal for deal registration, quoting, sales content and training.
  • MSPs can sell CybaOps under their own brand, so their clients see the MSP's name, not ours.

Pricing security

How to price managed security and protect margin

MSPs should price managed security as tiered, per-user or per-device monthly services that reflect the risk removed, not tool cost plus a mark-up.

01 You choose

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Pricing security

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Packages
  • CybaCore
  • CybaEdge
  • CybaOne
  • CybaVM
  • Cyber Essentials & CE+

What else do MSPs ask about pricing security?

Should security be a separate line item?

Usually yes. A visible line item shows value and protects it from IT discounting. It also makes it easier to report on what the security service delivers each month and to discuss upgrades with clients at review meetings.

Should I charge for incidents?

Define what is included and charge for major incident recovery separately, so scope is clear. Writing this down in the contract avoids disputes during a stressful incident and helps clients understand exactly what their monthly fee covers.

What is a typical price per user?

Figures vary widely by scope and region; benchmark against your own costs. Include the tools, partner fees, engineer time and margin you need, and make sure the service you offer is clearly defined so clients can compare value fairly.

What should you do next?

  1. Pick five clients and write down the security gaps you already know about.
  2. Decide which service tier you could offer them this quarter.
  3. Talk to CybaVerse about delivering MDR under your brand.

Become a CybaVerse partner | See CybaOps

Related: How can an MSP launch an MDR service line without building a SOC? and How do security services grow an MSP's recurring revenue?

See how MSPs deliver CybaOps as their own security service.

Book a CybaOps demo