Most MSPs we talk to are good at what they were hired to do. The pressure comes from work their clients did not have two years ago.
A client landed an enterprise questionnaire
The questionnaire asks for a current pentest, a documented incident response process, and evidence of continuous monitoring. Answering it well is a program, not a ticket, and the deal is waiting on it.
A client committed to a framework
SOC 2, HIPAA, or HITRUST arrives with a scope, an auditor, and a calendar. Someone has to own control operation and evidence between now and the report, every month, not just at audit time.
Staffing a security and compliance practice to serve two or three clients rarely pays for itself. Handing the account to a competitor costs more.
Which one fits depends on the client, not on which is worth more to us. We will say which we think it is on the first call.
You hold the client. We run the layer underneath.
You keep the agreement, the helpdesk, and the relationship. We operate the security and compliance function beneath it as a named subcontractor: identity hardening, managed detection and response, control operation, and the evidence that proves it. Escalations route through you rather than around you, and your client knows exactly who is doing what, because the split is written down before anything starts.
When the whole function needs one operator.
Sometimes the honest answer is that the client needs IT, security, and compliance run as a single function, and splitting it two ways would add a seam rather than remove one. Refer them to us and we will tell you plainly what we took on. We are not looking for your end-user support work, and if a referred client asks us for it, we will point them back to you.
Where the line sits
This is the default split we start from. The real one is written down per client before any work begins, and it is the first thing we hand your account manager.
Everything the client thinks of as their IT provider stays yours. We are not building a shadow relationship underneath you.
The layer that needs analysts, a framework calendar, and someone awake for it. Staffed once by us, rather than twice by both of us.
Security-relevant changes, Conditional Access among them, sit on the line rather than on one side of it. Those go through an agreed change path, so neither of us assumes the other watched it.
Bringing in a security partner means letting someone else near your client. These are the terms that make that a reasonable risk.
In a co-managed engagement we do not solicit your clients for the work you already do. If one of them asks us to take it on, we tell you before we answer.
Including the work we do not take. We publish our refusals on the operated partnership page, and the same list applies when we are working underneath you.
Credentials, configuration, and documentation live in accounts the client owns. Nothing gets locked inside a system of ours, which means a co-managed engagement can end without a hostage negotiation.
Ours as well as theirs. What a clean exit looks like, in both directions, is written up on the switching page.
Partner commercial terms are agreed per engagement rather than published. This page describes how we work, not the terms of any particular arrangement, which are governed by the agreement you sign.
Not a partner program pitch. Bring the client with the framework deadline or the questionnaire, and we will tell you whether co-managed or referral is the honest answer.
Who owns what, where escalation goes, and what we will not touch. Your account manager gets it in a form they can put in front of the client.
One engagement, operating for a full cycle, before anyone talks about the rest of your base. If the seams hold, we do it again.
Start with the account that has a deadline, or read how we operate before you introduce anyone.
One call about one client, and a straight answer on whether co-managed or referral is the better fit.
How we scope, what we make visible, and the engagements we refuse, laid out section by section.
We use cookies
Essential cookies keep the site running. With your permission, we also use analytics and functional cookies to improve the experience. Read our Cookie Policy.