Control stack
License, minimum, tenant, and integration costs by package.
MSP service economics
Price managed security around delivery responsibility, not a tool bundle
Managed-security price must reflect who investigates, responds, reports, remediates, and carries after-hours responsibility. Separate licenses from human delivery, minimum commitments, onboarding, compliance evidence, and incident workload before setting per-user or per-device pricing.
What the decision depends on
FactorWhat to check
Human response
Triage, investigation, remediation, reporting, and after-hours responsibility.
Risk and scope
Customer environment, exclusions, escalation, insurance, and contractual promises.
Packaging
Baseline controls, managed response, and optional compliance work.
A package the buyer can understand
Who takes the alert at 2 a.m., what action is included, and when does incident work become a separate engagement?
How to package it
Build a protected-user baseline with named controls and business-hours triage. Add a managed-response tier with investigation hours and an after-hours retainer. Keep remediation projects outside the recurring unit and price them from an agreed response schedule.
Margin stress case
Recalculate the month when noisy alerts triple investigation time and two customers require after-hours escalation. The package must fund the people on call, not merely preserve the license markup.
Worked example
Illustration: a $4,800 monthly managed-response package carries $3,000 of normal license and delivery cost, leaving 37.5% gross margin. If investigation and after-hours work raise cost to $3,900, margin falls below 19%. That stress case points to an included-hours band and a separate incident-work trigger.
Questions owners ask
Should managed security be priced per user or per device?
Use the unit that tracks the protected environment, then add tenant minimums and human-response capacity that a simple unit count misses.
How should after-hours response appear in the package?
State the coverage window, included triage and escalation, available investigation hours, and the rate or project trigger for deeper incident work.
What proof supports a managed-security price increase?
Show license changes, alert and investigation volume, response coverage, documented control work, and the gap between promised and consumed labor.
Get a second opinion on this decision
Send your website and the decision you are weighing. We will confirm the price, then send the payment link and a short intake.