Add senior vCISO leadership to your MSP or MSSP offering.
Three partnership structures. Referral, co-sell, or white-label. We deliver the senior security advisory layer that your clients keep asking for, without you having to hire a full-time CISO.
Most MSPs and MSSPs lose deals when clients start asking for SOC 2, vendor security questionnaires, board-grade security reporting, or incident response leadership. Tier-1 NOC teams are not built for that work. We are. Plug us in as a named security partner and stop losing those renewals.
- Three partnership structures: referral, co-sell, white-label
- No NOC overlap; we are the program layer above the tools
- Practitioner-led, including pentest in-house
- SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC
Three ways we partner.
Pick the structure that matches how you sell, what you carry on your contract, and how much margin you want to capture.
Referral
You send qualified leads. We engage them directly. You receive a referral fee on the first 12 months of retainer revenue. Easiest to start. No legal complexity beyond a referral agreement.
- Lead qualification by you
- Direct engagement by us
- Referral fee on Year 1 revenue
- Simple agreement, fast to start
Co-sell
We are introduced as your named security partner on engagements. You remain the primary contract holder; we contract with the client directly for the security scope. Clean accountability split. Both firms are visible to the client.
- You hold the master client relationship
- We contract directly for security scope
- Joint discovery calls and account planning
- Both firms visible to client
White-label
We deliver the security work under your brand. You carry the client contract and the client relationship. We are invisible to the client. Highest margin opportunity for partners with brand equity and compliance demand from their existing book.
- Your brand on all deliverables
- You hold the contract and the relationship
- We deliver the work, invisible to client
- Wholesale rates negotiated per partner
What we layer on top of your MSP or MSSP service.
We do not run a NOC. We do not manage endpoints, networks, or backups. We are the strategic and program layer above the tools.
Compliance program ownership
SOC 2 Type I and II, ISO 27001, HIPAA, PCI DSS 4.0, CMMC Level 2, NIST CSF 2.0. We own the audit relationship and sign the management representation letter.
Customer security questionnaires
Vanta AutoShare, SecurityScorecard, Whistic, OneTrust, Drata Trust Center, ScalePad. 48-hour turnaround. We attend the buyer security review call and defend the answers.
Policy authoring and governance
Information security, access management, secure SDLC, IR, vendor management, BCP and DR. Written to match how each client team actually operates.
Board and investor briefings
Quarterly board presentations with metrics tied to material risk, dollar impact, owner, and remediation ETA. Decks reusable for the client\'s next raise or annual review.
Incident response leadership
Pre-written runbooks, semi-annual tabletop exercises, on-call leadership. We pair with your MSP/MSSP NOC for full IR coverage.
Penetration testing in-house
Penetration testing is run in-house and scoped to the client environment and engagement roadmap. Most MSPs do not offer this capability; including it through the partnership closes an obvious gap.
Want to talk through a partnership?
30-minute partnership call. We discuss your client base, the gaps you are seeing, and which of the three structures fits your business model. No pitch deck. No qualification form.
Not ready to talk? Score your SOC 2 readiness.
Twenty questions, a scored PDF in your inbox, a realistic timeline to audit. Free.
Common partner questions.
What kind of partner relationships do you offer?
Three structures. Referral: you send qualified leads, we engage them directly, you receive a referral fee on the first 12 months of retainer. Co-sell: we are introduced as a named security partner on your engagements; you remain the primary contract holder. White-label: we deliver the security work under your brand, you carry the client relationship and the contract. We pick the structure that fits your service model best.
Why would an MSP want a vCISO partner?
Three common drivers. (1) Your clients are getting customer security questionnaires that your tier-1 NOC team is not staffed to answer. (2) Your clients are pursuing SOC 2, ISO 27001, HIPAA, or PCI and asking you for guidance you do not have time to give. (3) You are losing renewals to MSSPs that bundle compliance and vCISO services. Adding a vCISO partner closes those gaps without hiring senior security headcount.
Can you work alongside our existing security stack?
Yes. Most of our retainer clients use Vanta, Drata, or Secureframe for compliance automation, plus an MDR provider (Arctic Wolf, Expel, ReliaQuest, similar) for SOC monitoring. We are the strategic and program layer above the tools. We integrate with whatever stack you already deploy for your clients.
How do referral fees work?
Referral arrangements typically pay a percentage of first-12-month retainer revenue. The exact percentage depends on whether you are sending warm qualified leads (higher rate) or cold introductions (lower rate). Specifics are negotiated in the partner agreement; we do not publish standard rates because each partner relationship has different deal economics.
Do you compete with MSPs and MSSPs for client work?
Not directly. We do not run a NOC, do not provide eyes-on-glass detection and response, and do not manage endpoints, networks, or backups. Those are MSP and MSSP service lines. We provide senior security advisory, compliance program ownership, customer questionnaire response, and incident response leadership. The two service models are complementary, not overlapping.
How fast can a partnership engagement start?
Most co-sell or white-label engagements start within 2 to 4 weeks after the partner agreement and client SOW are signed. Urgent audit timelines are prioritized during scoping.
What does pricing look like for partner-sourced clients?
Direct-client list pricing is $3,000/mo Advisory, $5,000/mo Managed, and Embedded from $10,000/mo. Referral fees or white-label wholesale rates are documented in the partner agreement so both sides can sustain the relationship.
What industries do your MSP partners typically serve?
Mostly mid-market SaaS, regulated SMB (healthcare, fintech, defense contracting), and the long tail of professional services firms with compliance pressure. The match is strongest where your customers are facing audit deadlines, customer questionnaires, or framework-driven procurement gates. Where compliance pressure is absent, the layered vCISO offering tends to be a harder sell into your existing book.