Why Security Pricing Is Different for an MSP
Security is now the service clients worry about most and one of the fastest-growing lines for MSPs. In Kaseya's 2025 Global MSP Benchmark Report, 76% of MSPs said their clients are most concerned about security, and 67% said security is one of their five fastest-growing revenue categories. That demand makes security easy to sell and easy to underprice.
It is priced differently from help desk work for three reasons. The tool cost is real and rises every year, so a thin markup disappears at the next vendor increase. The labor is uneven: most months are quiet, and one incident can consume a week. And the risk is yours, because a client who gets breached on your watch will look to your contract and your insurance before anyone else's.
Good security pricing covers all three: it recovers the stack, pays for the people who watch it, and carries a margin wide enough to absorb the bad month. The general models are covered in how MSPs price their services; this answer is about the security layer on top.
Start From Your Fully Loaded Cost
Build the price from the bottom up, per seat or per device, before you look at what competitors charge. List every component and its real monthly cost for one protected user.
- Tool licenses: EDR or XDR, email security, DNS filtering, backup for cloud apps, password management, security awareness training.
- Monitoring: the per-seat fee for an outsourced SOC or MDR service, or the share of your own analysts' cost.
- Labor you run internally: alert triage, policy changes, onboarding and offboarding, monthly reviews and reporting.
- Incident time: a reserve for the hours a real incident takes, averaged across your client base.
- Overhead that grows with security: cyber insurance for your own business, compliance tooling, and the time spent keeping your own house in order.
Add those together and you have your floor. Then set the price to hit your target margin on top of it, not a fixed markup on the tool cost alone. Our answer on what gross margin to target and the managed services pricing calculator help you work backward from the margin you need to the price you charge.
Choose a Packaging Model
Once you know the cost, decide how the client sees it. Security is usually packaged in one of four shapes, and many MSPs combine two.
| Model | How It Works | Strength | Weakness |
|---|---|---|---|
| Baked into every plan | Security baseline included in the all-in seat price, no opt-out | Every client protected, simplest to sell | Price looks higher next to plans that strip security out |
| Tiered bundles | Good, better, best plans with more security at each level | Clients self-select, clear upgrade path | Clients may pick the lowest tier and expect the highest protection |
| Security add-on | Separate line item on top of a support plan | Visible value, easy to raise independently | Invites clients to decline it |
| Per-service a la carte | Each tool or service priced individually | Precise cost recovery | Hard to sell, clients compare line by line against retail |
A common approach is a mandatory baseline inside every plan, with advanced layers sold as tiers. The baseline protects your own risk: you cannot defend a client you are not allowed to monitor. Pricing it into the all-in seat price also stops the conversation where a client buys support and declines protection to save money.
Price the Layers Separately From the Baseline
Above the baseline, price each advanced layer on its own cost and value. These are the services that vary most between clients and are worth quoting deliberately.
Monitoring and Response
Round-the-clock monitoring is the most expensive layer, because someone has to be awake to act on an alert. Many MSPs would rather not staff it themselves: in Kaseya's 2024 MSP Benchmark Survey, 26% of respondents named a security operations center as the service they most wanted to outsource. If you resell a partner's MDR, price it with your own triage and client communication time added, not at the partner's fee plus a thin markup. Our answer on whether you need a SOC covers the build versus buy decision.
Compliance and Advisory Work
Compliance support is labor, not software, so price it by the time it takes. Framework mapping, policy writing, evidence collection for an audit and questionnaire responses for a client's insurer are recurring work for regulated clients. The same Kaseya 2025 report found 64% of MSPs said clients want guidance on best practices, not just tools. Sell that guidance as a monthly advisory fee or a vCIO engagement rather than giving it away at a review.
Assessments and Remediation
Risk assessments, penetration tests and remediation projects are one-time work. Quote them as fixed-fee projects with a defined scope, and use the findings to justify the recurring tier the client actually needs.
Explain the Price in Terms the Client Understands
Clients do not buy EDR; they buy staying open after an attack. Anchor the conversation on the cost of a breach, not the cost of tools. IBM's 2025 Cost of a Data Breach Report put the global average cost of a breach at USD 4.44 million, and found organizations took a mean of 241 days to identify and contain one. Most of your clients are far smaller than the organizations in that study, so use the figures to show scale and time, not to predict their exact loss.
Report on what the money buys. Show MFA coverage, patch compliance and the phish-prone percentage at every review, and trend them over time. A client who can see protection improving renews and upgrades; a client who only sees an invoice asks for a discount.
Common Security Pricing Mistakes
Most security pricing problems come from pricing the tool instead of the service. These are the mistakes that most often show up when an MSP reviews client profitability.
- Marking up the tool cost and forgetting the labor. The license is the cheap part; the time spent tuning policies, triaging alerts and answering the client is where the cost lives.
- Pricing to match the lowest competitor. A rival who strips out monitoring can always undercut you, and matching them means delivering less or earning nothing.
- Giving advanced tools to every client at baseline prices. Rolling a new layer out across the base without repricing turns a sensible upgrade into a margin cut.
- Leaving incident time unpriced. One ransomware recovery can consume more technician hours than a year of routine work for that client.
- Never revisiting the price. A stack that cost a certain amount when you built the tier rarely costs the same two renewals later.
Each of these shows up first in your managed services gross margin, so watch it by client, not only across the business.
Protect Your Margin Over Time
Security vendors raise prices regularly, and a flat fee locked for a multi-year term turns every increase into lost margin. Write a pass-through clause into your agreement that lets you adjust when a security product's cost changes, and review your security stack cost against your price every year. When you need to raise it, the price increase letter is a starting point.
- Recalculate the fully loaded cost per seat each year.
- Compare it to your price and check the margin still clears your target.
- Check per-client profit with the client margin calculator, because heavy incident clients hide inside averages.
- Raise prices or move clients to a higher tier where the numbers no longer work.
Finally, get a signature when a client declines a recommended layer. A written waiver records that you advised the control and the client chose not to buy it, which matters to your insurer and to you if that client is later breached.
Common Questions
Should I show security as a separate line item?
Showing it separately makes the value visible but invites clients to remove it. One common approach is to keep the baseline inside the seat price and list only optional advanced layers separately.
Can a client opt out of my security baseline?
You can allow it, but only with a signed waiver and ideally a higher support rate, since an unprotected client costs more to support. You can also simply decline to serve clients who refuse the baseline.
Do I charge extra for incident response?
One common approach is to include a limited amount of incident response in the security tier and bill major incidents hourly or through a retainer. State the limit clearly in the agreement so there is no surprise.
Should security be priced per user or per device?
Match the unit to how the tools bill you. Identity and email tools usually bill per user and endpoint tools per device, so per-user pricing with a device allowance often recovers cost most cleanly.
How do I price security for a co-managed client?
Price only the layers you run and state which ones the internal team owns. Shared responsibility needs a written split so gaps are not assumed to be covered.
Should I discount security for large clients?
Discount the support labor if volume lowers your cost, but keep tool and monitoring costs at full recovery. Those costs scale with seats, so a volume discount on them erodes margin directly.