Guest blog courtesy of LimaCharlie.
The 2024 MSSP Pricing Benchmark Report highlights opportunities for service providers to improve their performance, prices, and capabilities.
While many of us were enjoying holiday festivities, the researchers at MSSP Alert were analyzing how MSSPs and MDRs determine the value of their services. Specifically, they reviewed the pricing models and categories of services offered by security providers across the globe. Their findings, published in the 2024 MSSP Benchmark Pricing report, offer valuable insights to MSSPs who are planning for a new year.
The key findings of the report include:
- The average monthly MSSP price for basic services is $45 per endpoint
- Premium MSSP services average $73 per endpoint, per month
- Many MSSPs offer discount pricing at 100 and 500 endpoints
- All surveyed MSSPs offer SOC services; the vast majority (98%) provide MDR
- Many do not offer backup and disaster recovery (43%) or application security (55%)
The report also offers insights on popular MSSP add-on options and includes a similar analysis of MSP services and pricing. It is a great reference for service providers who want to know how their business model compares to others in the field.
What the report does not cover is what high-performing MSSPs do differently from those that are merely getting by. While the average monthly MSSP price for basic services is $45 per endpoint, top earners are charging $200. Some MSSPs only offer a few services to their clients, while others boast an impressive array of capabilities. If you have ambitions for expanding your reach and improving efficiencies in 2025, now is the time to plan ahead.
Trapped Between Vendors and Customers
While MSSPs offer more to customers than value-added resellers (VARs), both business models are heavily impacted by the decisions of third-party vendors. If your primary EDR vendor decides to raise licensing costs, prices for your customers increase as well. If they decide to enter the security services space as competitors, as some have, then you face a real problem.
Vendor lock-in also poses challenges for MSSPs whose clients are growing (or shrinking) at an unexpected pace. Guessing the correct number of licenses to buy for a client is an inexact science where mistakes can prove costly. This problem is compounded by clients who have multiple specific tools and solutions they want supported in their environment. How can MSSPs circumvent these issues, save money, and remain competitive with their peers?
Independence and Innovation With the SecOps Cloud Platform
Innovative MSSPs are finding new ways to improve their service offerings and reduce their costs by taking greater control of their business. The SecOps Cloud Platform (SCP) offers MSSPs several advantages similar to those IT services gained from AWS. It is not a security product in the traditional sense of offering an EDR agent, network security, and so on. Rather, it is a platform upon which you can centralize and integrate countless security tools or build your own.
For example, suppose you have a customer who insists on using a dozen specific security tools. You can accommodate this customer by integrating the telemetry, communication, and automation of these tools on the SCP via APIs. This approach delivers immediate value by reducing the number of analysts and interfaces required to maintain the security posture.
Alternatively, if you need to create a bespoke solution for a customer, the SecOps Cloud Platform provides everything you need to tackle the job. The SCP can deploy low-friction agents to endpoints that provide the platform with high visibility of device operations. Next, it provides an extensive library of extensions, managed rulesets, and integrations to perform any security task your clients need.
The multi-tenancy capabilities of the SCP make it easy to spin up instances of entire organizations at will. Everything from endpoints, to users, to organizations, is extremely scalable and delivered in a pay-for-what-you-use format. When resources are no longer needed, removing them is equally simple. The scalability and configurability of the SCP are game-changers for MSSPs, boosting the efficiency of their operations and offering them freedom from vendor control.
Real World Results: A Customer Success Story
Recon Infosec, an MDR provider serving small and medium businesses, demonstrates the transformative impact of the SecOps Cloud Platform:
- Achieved $100K annual cost savings despite already having a highly optimized stack
- Improved response times by 98%—from minutes to milliseconds
- Gained new capabilities while maintaining complete control of their security operations
- Eliminated infrastructure maintenance overhead, allowing their team to focus on security
- Scaled customer onboarding with confidence using multi-tenant architecture
"We wouldn't be as successful as we are now if we had to abdicate our effectiveness to another security provider; if we were only middlemen to a bigger vendor. There's just so much control within the SCP to develop your own vision for how security operations should work." - Andrew Cook, CTO at Recon Infosec.
The real-world impact was immediately evident during incident response operations. In one case, Recon Infosec detected SocGholish malware behavior, quarantined the compromised machine, and began remediation within minutes—preventing what could have become a much larger incident with just 15 minutes of additional delay.
Final Thoughts
When your core business offering is a product or service that is owned by someone else, it becomes extremely difficult to differentiate yourself from competitors. Customers want the best price they can find, and the license fees for third-party solutions are a set cost. This leaves MSSPs scrambling for ways to add measurable value or take losses in other aspects of their business to improve pricing. Competing on better prices or stronger security services in 2025 will be difficult for MSSPs whose business models are heavily reliant on vendor cooperation.
However, those who reassert control over their operations by adopting the SecOps Cloud platform will have a multitude of options. Rather than struggling as consumers of other vendors’ products, they will flourish as creators of their own security ecosystems. To learn more about the capabilities, benefits, and potential of using the SCP for your MSSP, visit LimaCharlie.
