MSP cybersecurity: how to offer security services to your clients

For MSP cybersecurity, start from what you already manage (endpoints, email, backups, firewalls) and build an offer in three layers: baseline hygiene, endpoint and identity protection, then 24/7 detection and response. That last layer usually relies on a partner SOC, while the MSP remains the client’s single point of contact.

This article is part of our series How do you implement a managed SOC?. A security offer is more than a SOC: the SOC sits on top of foundations the MSP largely controls already.

Why clients look to their MSP for security

For a small business, the MSP is often the only trusted technical partner. When a director worries about a risk, the MSP gets the call. Two trends reinforce this:

• NIS2: Article 21 of the directive provides for cyber risk management measures for in-scope entities, including supply chain security. Regulated clients are therefore asking their providers for more evidence. See Does NIS2 affect me if my client is in scope?.
• MSPs’ own status: managed service providers are listed in NIS2 Annex I. See Are my suppliers subject to NIS2?.

The three layers of a security offer

Layer	Content	Who runs it
1. Baseline hygiene	Patching, tested backups, separate admin accounts, multi-factor authentication, asset inventory	The MSP
2. Protection	EDR on endpoints and servers, Microsoft 365 or Google Workspace hardening, filtering, firewall	The MSP, with its vendors
3. Detection and response	24/7 monitoring, alert triage, containment, CERT for serious incidents	The partner SOC, with the MSP

Layer 1: hygiene is the core of the job

ANSSI’s IT hygiene guide lists the basic measures every organisation should apply. Most are already part of an MSP’s daily work: updates, account management, backups. Writing them into the contract and reporting on them to the client is already cybersecurity.

Layer 2: protect endpoints and identities

Traditional antivirus no longer keeps up with today’s attacks. An EDR watches endpoint behaviour and can isolate a machine remotely. See Antivirus vs EDR: what is the difference?. In the cloud, email and identities are a frequent way in, and their configuration deserves a review.

Layer 3: detect and respond around the clock

An EDR that raises an alert at 2am with nobody to read it only does half the job. This is where a managed SOC comes in: analysts monitor continuously, triage alerts and take first containment steps. See 3 weak signals an EDR can’t see without a SOC.

Building your own 24/7 SOC requires a rotating team few MSPs can fund. See Managed SOC vs in-house SOC for MSPs.

Relying on a partner SOC without losing control

The right partner keeps the MSP at the centre. Cyna works through its partner MSPs:

• the MSP owns the contract, billing and reports;
• one console covers all its clients, with strict separation and per-technician permissions;
• native integration with SentinelOne and Microsoft Defender, plus connectors for Microsoft 365, Google Workspace, Stormshield and Fortinet;
• Cyna’s CERT, a member of InterCERT France, can be mobilised quickly when an incident occurs, and the incident response on-call team is available 24/7 from the Report an incident page.

The terms (scope, licences) are set out in the contract between the MSP and Cyna, and then between the MSP and its client. Cyna’s certifications and security documents are available on its Trust Center, which can help the MSP answer questions from regulated clients.

Reports can go out under the MSP’s brand: see White label SOC: how can an MSP resell one?.

Where to start

1. Review your own practices: the MSP is itself a target, because its access opens the door to its clients.
2. Formalise layer 1 in existing contracts.
3. Pick a pilot client, exposed or regulated, to launch layer 3.
4. Write the escalation procedure with the SOC before the first connection. See How to build a SOC escalation procedure.
5. Prepare the pitch: talk about business continuity and directors’ accountability, not technology. See How do MSPs pitch a SOC offer to their clients?.

Talk to an expert

Are you an MSP looking to structure your security offer? If you already work with Cyna, your partner contact is your first port of call. Otherwise, get in touch.

Frequently asked questions

Can a small MSP offer cybersecurity services?

Yes. Baseline hygiene is already part of the job, and 24/7 detection can be handed to a partner SOC. What matters is drawing a clear line between what the MSP does itself and what the partner does.

Are there certifications that help an MSP sell security?

National schemes exist. In France, for example, Cybermalveillance.gouv.fr awards the ExpertCyber label to IT providers after an audit. Whatever the scheme, clients mostly want evidence: documented processes and regular reporting.

Should security be mandatory for every client?

Baseline hygiene should be part of every managed services contract. Higher layers are offered according to each client's exposure, regulatory duties and continuity needs.

How do you stop the SOC from taking over the client?

Clarify each party's role from the start, in the partnership agreement. Cyna works through its partner MSPs, who own the relationship with their clients.