Packaging and Pricing Managed Security Services

Security is the service MSPs sell most, and the one owners are least sure how to price. Vendor blogs tell you to bundle it, tier it or add it on, usually while selling you the security stack. None of them publishes margin data, and neither does anyone else. This guide shows what the surveys do say, four ways to package security, a cost worksheet, a pricing method that starts from your own numbers, and the places margin leaks.

Is security really a profit centre for MSPs?

Demand and revenue growth say yes. Margin data says nobody knows. In Kaseya's 2026 survey, 71% of MSPs reported year-over-year security revenue growth, and 52% ranked security among their top three revenue sources. We found no neutral public data on security gross margin, so "profit centre" is a claim to test against your own costs.

71%

Kaseya, 2026 State of the MSP Report, 2026Vendor surveyn=1,061Verified 2026-10-11

All of these are self-reported by respondents to vendor surveys. They show demand and adoption, not profit. Kaseya's own text also reports the friction: almost half of MSPs cite product complexity as a barrier to offering security, up from 38% a year earlier, and 31% cite the cost of managing too many different security tools. Those are margin problems as much as technical ones, and we return to them below.

How can you package security?

Four patterns cover most MSPs: bundle a baseline into every per-user price, sell tiers, sell add-ons à la carte, or sell security separately to clients with their own IT staff. N-able argues bundled packages beat à la carte. It sells security software, so treat that as a hypothesis to test.

N-able's reasoning is that bundling "eliminates the need for customers to opt in" to security. For clients who have no internal IT administrator, it says pricing should reflect that "the MSP assumes full responsibility for their cybersecurity risks", and for co-managed clients it says security can be sold separately. The post cites no data. The logic is sound, but we cannot tell you from public evidence which pattern earns more. The pricing models guide covers how bundles and tiers behave in general.

What does your security stack really cost per user?

Most owners cannot answer this quickly, and that is the first margin problem. List every security product by category, record what you pay per user, device or site, add the labour to deploy, monitor and respond, then add a share of overhead. The sum is your floor. Your price has to clear it.

The pricing calculator builds a whole per-user price from labour, tools and overhead, and how to price MSP services explains each step.

How should you price each tier?

Price from cost, then test against the market. Divide each tier's cost per user by one minus your target margin, round to a clean price, and check the gap between tiers is large enough that a client can see what the upgrade buys. Treat public price points as context only, because the ones available are old or vendor estimates.

22%

Kaseya, 2023 Global MSP Benchmark Survey (as published on Kaseya MSP pricing resource), 2023Vendor surveyn=1,091Verified 2026-10-11

Please do not read the second row as a benchmark. N-able labels its own figures "est" and gives no basis for them. We include them because owners will meet them online and should know what they are. Your price should come from your costs, your client mix and your target margin.

Three habits help. Make each tier's difference concrete, such as 24/7 monitoring, compliance reporting or a named response commitment. Price onboarding and assessment work separately, as the raising prices guide explains. And put an escalator in the agreement, because security tool costs change.

Where does security margin leak?

In four places: tool sprawl, alert handling, unbilled response work and unclear scope. Kaseya's survey shows the first: 31% cite the cost of managing too many security tools, and almost half cite product complexity. Every added product brings licence, integration and training costs the price must cover.

• Tool sprawl. Audit quarterly. For each product, name the tier it supports and the clients who pay for that tier. Drop or consolidate anything that supports no paid service.
• Alert handling. Kaseya lists responding to too many alerts as a barrier. Measure triage minutes per client per month, because alert volume is labour you rarely price.
• Unbilled response. Decide what an incident includes. Many agreements cover monitoring but leave remediation hours undefined, so large incidents become unpaid work or a dispute.
• Unclear scope. Write a matrix of what is included in each tier, including notification, remediation, restoration and reporting.

Staffing is part of the leak. Kaseya reports 39% of MSPs have difficulty hiring cybersecurity professionals, up from 29%.

16%

Kaseya, 2026 State of the MSP Report, 2026Vendor surveyn=1,061Verified 2026-10-11

Should you build 24/7 monitoring or buy it?

Round-the-clock coverage needs several skilled people and hiring them is hard, so partnering is the main alternative to building. Compare at least two providers, check who owns each, and read the response, escalation and liability terms before you resell anything. Kaseya reports SOC services revenue rose for 47% of MSPs, so demand is real.

We give no cost ranges because we found no neutral public source for them. Ask each provider for a written description of what happens when an alert fires at 3 a.m., and who owns the client communication.

How do you sell security to existing clients?

Lead with a client-specific risk assessment, not a product list. Show the gaps in their environment, propose the tier that closes them, and tie it to a renewal or a scheduled change so the price move has a reason. A repackaging also gives the price move a reason the client can see.

ScalePad finds compliance is an under-monetised growth lever. Nearly 70% of MSPs say compliance drives only 6-25% of their revenue, and only 12% say more than 25%. Among MSPs that offer compliance, the most common services are data protection (59%), risk assessments (54%) and awareness training (51%). A consultant quoted in the same report cautions that compliance sells only where clients are actually required to comply. If your client base is small retail, expect less pull than for regulated firms.

For wider tactics see growth strategies ranked by the evidence, and for winning accounts without referrals see how MSPs win clients without referrals.

What contract and liability points should you check?

Have a lawyer and your insurer review the agreement before you sell security as a defined service. The aim is that the promise you sell, the promise in the contract and the promise your insurer covers are the same promise. This is a list of questions, not legal advice.

• Does the scope say what you monitor, what you remediate and what is out of scope?
• Does it avoid promising that attacks will be prevented?
• Which client duties apply, such as adopting MFA or approving patch windows?
• How are incident response hours billed?
• Do your provider contracts flow through the same limits you give clients?
• Does your professional and cyber insurance cover the services you now describe?

A note on method

The Kaseya figures are as printed in the 2026 State of the MSP report (Figures 10, 16, 17, 18 and 21 and the security section), read in the PDF on 11 October 2026. The ScalePad figures are from the 2026 MSP Trends Report (trend 5 and Chapters 1 and 4). The N-able posts were opened on the same date, and the price bands are quoted as the vendor labels them. Our methodology page explains how we source and verify data.