Add senior vCISO leadership to your MSP or MSSP offering.
Three partnership structures. Referral, co-sell, or white-label. We deliver the senior security advisory layer that your clients keep asking for, without you having to hire a full-time CISO.
Most MSPs and MSSPs lose deals when clients start asking for SOC 2, vendor security questionnaires, board-grade security reporting, or incident response leadership. Tier-1 NOC teams are not built for that work. We are. Plug us in as a named security partner and stop losing those renewals.
- Three partnership structures: referral, co-sell, white-label
- No NOC overlap; we are the program layer above the tools
- Practitioner-led, including pentest in-house
- SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC
Three ways we partner.
Pick the structure that matches how you sell, what you carry on your contract, and how much margin you want to capture.
Referral
You send qualified leads. We engage them directly. You receive a referral fee on the first 12 months of retainer revenue. Easiest to start. No legal complexity beyond a referral agreement.
- Lead qualification by you
- Direct engagement by us
- Referral fee on Year 1 revenue
- Simple agreement, fast to start
Co-sell
We are introduced as your named security partner on engagements. You remain the primary contract holder; we contract with the client directly for the security scope. Clean accountability split. Both firms are visible to the client.
- You hold the master client relationship
- We contract directly for security scope
- Joint discovery calls and account planning
- Both firms visible to client
White-label
We deliver the security work under your brand. You carry the client contract and the client relationship. We are invisible to the client. Highest margin opportunity for partners with brand equity and compliance demand from their existing book.
- Your brand on all deliverables
- You hold the contract and the relationship
- We deliver the work, invisible to client
- Wholesale rates negotiated per partner
What we layer on top of your MSP or MSSP service.
We do not run a NOC. We do not manage endpoints, networks, or backups. We are the strategic and program layer above the tools.
Compliance program ownership
SOC 2 Type I and II, ISO 27001, HIPAA, PCI DSS 4.0, CMMC Level 2, NIST CSF 2.0. We own the audit relationship and sign the management representation letter.
Customer security questionnaires
Vanta AutoShare, SecurityScorecard, Whistic, OneTrust, Drata Trust Center, ScalePad. 48-hour turnaround. We attend the buyer security review call and defend the answers.
Policy authoring and governance
Information security, access management, secure SDLC, IR, vendor management, BCP and DR. Written to match how each client team actually operates.
Board and investor briefings
Quarterly board presentations with metrics tied to material risk, dollar impact, owner, and remediation ETA. Decks reusable for the client\'s next raise or annual review.
Incident response leadership
Pre-written runbooks, semi-annual tabletop exercises, on-call leadership. We pair with your MSP/MSSP NOC for full IR coverage.
Penetration testing in-house
Light pentest included with every Sprint. Annual full-scope pentest available for retainer clients. Most MSPs do not offer this; bundling it through our partnership covers an obvious gap.
Want to talk through a partnership?
30-minute partnership call. We discuss your client base, the gaps you are seeing, and which of the three structures fits your business model. No pitch deck. No qualification form.
Not ready to talk? Score your SOC 2 readiness.
Twenty questions, a scored PDF in your inbox, a realistic timeline to audit. Free.
Common partner questions.
What kind of partner relationships do you offer?
Three structures. Referral: you send qualified leads, we engage them directly, you receive a referral fee on the first 12 months of retainer. Co-sell: we are introduced as a named security partner on your engagements; you remain the primary contract holder. White-label: we deliver the security work under your brand, you carry the client relationship and the contract. We pick the structure that fits your service model best.
Why would an MSP want a vCISO partner?
Three common drivers. (1) Your clients are getting customer security questionnaires that your tier-1 NOC team is not staffed to answer. (2) Your clients are pursuing SOC 2, ISO 27001, HIPAA, or PCI and asking you for guidance you do not have time to give. (3) You are losing renewals to MSSPs that bundle compliance and vCISO services. Adding a vCISO partner closes those gaps without hiring senior security headcount.
Can you work alongside our existing security stack?
Yes. Most of our retainer clients use Vanta, Drata, or Secureframe for compliance automation, plus an MDR provider (Arctic Wolf, Expel, ReliaQuest, similar) for SOC monitoring. We are the strategic and program layer above the tools. We integrate with whatever stack you already deploy for your clients.
How do referral fees work?
Referral arrangements typically pay a percentage of first-12-month retainer revenue. The exact percentage depends on whether you are sending warm qualified leads (higher rate) or cold introductions (lower rate). Specifics are negotiated in the partner agreement; we do not publish standard rates because each partner relationship has different deal economics.
Do you compete with MSPs and MSSPs for client work?
Not directly. We do not run a NOC, do not provide eyes-on-glass detection and response, and do not manage endpoints, networks, or backups. Those are MSP and MSSP service lines. We provide senior security advisory, compliance program ownership, customer questionnaire response, and incident response leadership. The two service models are complementary, not overlapping.
How fast can a partnership engagement start?
Two weeks for the first co-sell or white-label engagement once the partner agreement is signed. Standard agreement language is typically 2 to 4 weeks of legal review. After that, individual client engagements start within 2 weeks per the standard SOC 2 Sprint cadence.
What does pricing look like for partner-sourced clients?
Same published rates as direct clients ($2,500 Sprint, $24,000 90-Day Foundation, $5,000/mo Strategic vCISO, custom-scoped Embedded vCISO), with referral fees on top for referral partners or wholesale rates for white-label partners. Wholesale margins are negotiated per partner. We do not race to the bottom on margin; both sides need to make money for the relationship to sustain.
What industries do your MSP partners typically serve?
Mostly mid-market SaaS, regulated SMB (healthcare, fintech, defense contracting), and the long tail of professional services firms with compliance pressure. The match is strongest where your customers are facing audit deadlines, customer questionnaires, or framework-driven procurement gates. Where compliance pressure is absent, the layered vCISO offering tends to be a harder sell into your existing book.