White label SOC: how can an MSP resell one?

An MSP resells a white label SOC by building it into its own service offer: the MSP signs with the client, invoices and delivers reports under its own logo, while the partner SOC takes care of 24/7 monitoring, alert triage and incident response. The MSP keeps the relationship; the SOC supplies the team and platform that would be slow and costly to build in-house.

This article is part of our series How do you implement a managed SOC?. For how an MSP-delivered SOC works in general, see SOC for MSP: what it is and how it works.

What “white label” actually means

The term covers quite different arrangements depending on the provider. It helps to separate the elements:

Element	MSP brand	SOC brand
Contract with the end client	Yes	No
Billing	Yes	No
Day-to-day contact	Yes	No
Monthly reports sent to the client	Yes, white-labelled	No
Monitoring platform	Depends on provider	Often
SOC named in the offer	SOC named as partner	Yes

Cyna’s model works as follows: Cyna works through its partner MSPs, who own the relationship with their clients (contract, billing, reports), and monthly activity and vulnerability reports export to CSV or PDF in white label. Cyna is named in the offer as the MSP’s SOC.

Why a “fully anonymous” SOC is a bad idea

A SOC processes logs containing personal data: usernames, IP addresses, email subject lines. The GDPR governs the chain of providers that process this kind of data: its Article 28 states, among other things, that a processor shall not engage another processor without the prior specific or general written authorisation of the controller. How each party’s role (end client, MSP, SOC) is classified legally depends on the situation and is a matter for the parties’ legal counsel.

In practical terms, a client who knows a SOC is involved understands the reports it receives better and reacts faster when called during an incident. White label applies to the commercial relationship and the deliverables, not to concealing the provider. See How to include a SOC in your MSP contracts.

What you need to resell a white label SOC well

1. A platform built for many clients

An MSP manages dozens of clients. It needs one console, strict separation between clients and granular permissions per technician. Cyna’s platform works this way, with a vulnerability dashboard for each client. See Why MSPs need a multi-tenant SOC.

2. Reports the MSP can make its own

When nothing goes wrong, the monthly report is often the only deliverable the client sees. It must be readable by a business owner, carry the MSP’s branding and contain enough detail for the MSP to discuss in account reviews.

3. A written split of responsibilities

Who isolates an endpoint at night? Who calls the client? Who applies the patch? Settle this before signing the first client, in an escalation procedure. See Managed SOC and MSP: who does what? and How to build a SOC escalation procedure.

4. A partner that never goes around you

This is the core of trust. If the SOC can approach its partners’ clients directly, white label loses its point. Look at how the partnership agreement deals with this.

5. Sales support

Selling security takes practice. The Cyna Ignite partner programme has several support tiers, which can include platform onboarding, sales training, technical sessions, marketing kits and a Cyna expert joining client meetings. What each tier covers depends on the tier and the partnership agreement.

What the MSP gains

• Another recurring service, built on systems it already runs (endpoints, Microsoft 365, firewall).
• An answer to client expectations, especially from organisations in scope of NIS2 that want security evidence from their suppliers. Cyna’s certifications and security documents are available on its Trust Center. Managed service providers are themselves listed in Annex I of the directive. See Does NIS2 affect me if my client is in scope?.
• A stronger relationship: the monthly report creates a regular conversation with each client.

To build the wider offer, see MSP cybersecurity: how to offer security services to your clients. To present it, see How do MSPs pitch a SOC offer to their clients?.

Talk to an expert

Are you an MSP thinking about offering a SOC under your own brand? If you already work with Cyna, your partner contact is your first port of call. Otherwise, get in touch to find out about the partner programme.

Frequently asked questions

Can the end client find out which SOC sits behind the offer?

Yes, and it should. Cyna is named in the offer as the MSP's SOC, while the relationship, contract and reports stay under the MSP's brand. The GDPR (Article 28) also governs the use of sub-processors; how it applies to each contract is a matter for the parties' legal counsel.

Do you need security skills to resell a white label SOC?

You need to be able to present the offer, read a report and apply recommendations on the systems you manage. Analysis, investigation and response to serious incidents remain with the SOC and its CERT. See How to train your team to work with a managed SOC.

How should an MSP set its resale price?

The MSP sets its own price. The factors that matter are the number of endpoints and users, the sources connected, the level of service promised and how much remediation its own contract includes.

What happens if the MSP switches SOC provider?

Contracts between an MSP and a SOC generally address exit: data return, log retention periods and handover of connectors. The end client keeps the same point of contact throughout.