Security and compliance MSP: why tick boxes no longer save you
AuthorMSP Late NightPublished on:Security and compliance at an MSP is no longer an ISO tick box, no policy PDF, and certainly not an awareness training you run through once a year. Yet 80% of the market still runs on exactly that. And that is exactly why the end client now calls someone else for a second opinion instead of you. The mature buyer has worked out that “we do security” has become an empty catch-all, and that behind the four most popular dashboards there is often nobody watching after half past five.
Almost 1 in 5 Dutch companies faced a cyber incident in 2025. At the same time you as an MSP have to meet NIS2, ISO 27001 and clients asking more for less budget. And then on Monday morning you sit in a meeting about whether to onboard that client with 40 seats or not, because for thirty euros a user you cannot carry certifications, good engineers and 24/7 monitoring.
What you see happening meanwhile: end clients bringing in a specialist themselves for a second opinion on your tenant. Insurers hooking up MSSPs directly, around you. And technicians on your own floor working as generalists from Endpoint Manager to Sentinel to Defender, and therefore expert in no single part of it. One forgotten tick box in Exchange means no emoji. One forgotten tick box in Defender means the end client is in the national press tomorrow and you are on the other side of the liability question.
What really works: tenant hardening as the floor, not the ceiling
The MSPs that are growing in security this year do two things at once that at first hearing sound contradictory. They build a golden standard for tenant hardening where they know exactly what every setting does, and they deliberately outsource the 24/7 part to partners with a hyperfocus on it. Not flat outsourcing, but doing it together. Because you have to keep understanding what happens in your client environments, otherwise you are the baker who no longer knows why the rolls will not come out of the oven.
What does not work: buying a synchronisation tool in which you roll out your generalist knowledge at greater scale. Then the same MSPs push the same incomplete configurations to a hundred tenants at once, without knowing why those templates are built the way they are. That is not economy of scale, that is scale risk. The democratisation of enterprise security down to mid-sized business only works if the MSP itself conceptually understands what hardening, least privilege and configuration drift management involve. Otherwise you are buying a Ferrari for someone who has just passed their test.
The four layers most MSPs mix up
If you sit three MSP owners down today and ask what their security proposition is, you get three completely different answers on the same four layers. That is the real problem. The client hears “security” and thinks of one thing. You sell four things at once without distinguishing between them. Layer one: tenant hardening and baseline configuration. That is your work, full stop. Layer two: managed detection and response, 24/7 monitoring. That is specialist work. Layer three: incident response and forensic investigation when it goes wrong. That is top-tier forensics work. Layer four: compliance registration towards the NIS2 duty of care. That is process, not technology.
“Nothing is more dangerous than an IT person who thinks they know”
Why that separation matters commercially
Below 200 seats the business case for full internal security delivery does not add up. From 200 it does, and even then serious MSPs of 150 people say explicitly: we do not build our own SOC, because those engineers would rather work at a pure security outfit. Anyone building their own SOC without that scale is tinkering. And as the people who have been doing this for twenty years say: tinkering in security is wrong, because there is nothing more dangerous than an IT person who thinks they know, but does not quite know.
A concrete framework we see working in practice: offer layer one as a non-negotiable part of your base subscription, not as a premium. Security is not a 15 euro upsell on a 30 euro workplace. Layer two you buy in from a partner and resell under your own contract, so that you keep the orchestration of the client. Layer three you arrange with a very small retainer contract at a specialised incident response firm, so the client only pays by the hour when it goes wrong. That is the split purchasing that lets you put down a competitive offer without selling your margins or your responsibility. Layer four finally, the NIS2 duty of care, is the layer most MSPs still walk away from. While that is exactly the layer that will put the first Dutch director in front of a judge. That day is coming. Probably within 18 months.
The operational reality: what does this really cost internally?
Let us talk in people and hours, not in models. A decent tenant hardening on a new 50-seat client costs a senior engineer between 16 and 24 hours to set up initially, provided you have a documented golden standard. If you do not, you are at 40 to 60 hours and still delivering inconsistent work. After that, keeping up with configuration drift, new Microsoft defaults and policy updates costs on average 2 to 4 hours per client per month. That is your real cost price for layer one. If that is not in your rate, you are subsidising security out of your service desk margin. And that service desk margin was already under pressure.
For layer two, MDR, a different calculation applies. A good partner charges between 8 and 18 euros per endpoint per month, depending on log volume and response SLA. Pass that straight through to the client and you lose margin and are more expensive than the competitor who buys from the same partner and takes 30% margin. Bundle it in a security subscription with a clear scope, and you earn on the contract instead of on the incident. Because that is the second error of thinking many MSP owners make: earning money from putting out fires is not a business model, it is a diminishing series. As soon as the client works out that you earn from their misery, you have lost that client.
Layer four deserves its own paragraph, because this is where most MSPs are deliberately looking away. NIS2 is not an ISO process you tick off in a quarter, it is an ongoing duty of care at board level. That means: quarterly reports, incident registration within 24 hours, demonstrable risk analysis per chain. If you are the MSP and the client falls under NIS2, then your service is in scope of their audit. Full stop. You can facilitate that perfectly well with light compliance tooling and a fixed one-hour quarterly conversation, provided you have the discipline to actually hold that conversation. The MSPs standardising this now sign three-year contracts with six-month notice periods. The rest stay stuck in the annual price negotiation.
“Security is not a premium, you cannot economise on security”
The client gets the MSP they deserve. That sounds harsh, and it is. But it works both ways: the MSP also gets the clients that match its level of maturity. Anyone still running on break-fix and billing by the hour is going to find their jacket uncomfortably tight over the next three years. Anyone who dares to say “this we do ourselves, this we do with partners, and below this we do not onboard” builds the proposition the end client knocks on in three years instead of going to that second-opinion specialist. Start this week with one thing: put your four layers on one page and test them with your three largest clients.