MSP Security Stack Guide

Why stacks beat tool collections

Most MSP security offerings grew by accretion: antivirus because the old RMM bundled it, a spam filter because a client demanded it, backup because the last outage scared someone. The result is a drawer of unrelated tools, each with its own console, contract, and renewal date — and none of them talking to each other.

A stack is the opposite discipline: you decide in advance which layers every client gets, which product fills each layer, and what "deployed correctly" means for that product. Technicians learn one playbook. Clients get one price. And when an insurer or auditor asks what protections are in place, you answer from a standard instead of improvising per client.

Standardization is also what makes the economics work, which is why standardized client stacks are treated as a profitability lever, not just a security preference.

The anchor layers: identity, endpoint, and backup

Three layers carry most of the risk, so choose them first and let the rest of the stack orbit around them.

Identity and MFA is where modern breaches start. Your standard should be MFA enforced on every mailbox, every remote access path, and every privileged account — with a coverage report you can show a client or insurer. Conditional access policies (block legacy authentication, require compliant devices for sensitive apps) are usually configuration work on tooling the client already pays for, which makes this the highest-margin layer in the stack.

Endpoint detection is the EDR-versus-MDR decision, and it is really a staffing decision. EDR gives you the telemetry and the response buttons, but someone has to watch it — including nights and weekends. MDR rents you that someone. Our breakdown of EDR versus MDR versus antivirus covers the trade-offs in detail; the short version is that unmonitored EDR is worse than MDR at a similar price.

Backup and disaster recovery is the layer that determines whether a ransomware event is a bad week or a business-ending one. Verify immutability, separation from production credentials, and — above all — that restores get tested. The difference between endpoint and server backup matters for scoping; see endpoint backup versus server backup before you promise an RTO you cannot meet.

The supporting layers: email, DNS, awareness, and SIEM

Email security earns its place because phishing is still the front door for most small-business breaches. Whatever you standardize on, verify the multi-tenant console, per-client reporting, and impersonation protection — and make sure the vendor's definition of "protected" includes internal mailbox-to-mailbox threats, not just inbound filtering.

DNS filtering is the cheapest layer per unit of risk reduced: it blocks known-malicious domains and command-and-control callbacks before endpoints ever see them, and a roaming agent extends that protection to laptops off the network. It is a commodity layer, so buy it for console quality and price rather than feature lists.

Security awareness training pays off only when it runs on autopilot: scheduled phishing simulations, automatic retraining for users who fail, and per-client completion reports. A training platform someone has to remember to log into becomes shelfware within a quarter.

SIEM and SOC options are where smaller MSPs should be honest about capability. Full log aggregation with correlation is expensive and skill-hungry; for most SMB clients, the pragmatic version is MDR telemetry plus Microsoft 365 audit log retention and alerting, with an outsourced SOC reserved for clients whose compliance obligations genuinely require it. Selling SIEM you cannot operate is worse than not selling it.

The management plane underneath it all

Everything above depends on a management layer that can actually reach the fleet: deploying agents, enforcing patch policy, running scripts, and reporting compliance. Whether that is a classic RMM or a newer endpoint management platform, the non-negotiables are the same — reliable patch automation, per-client policy separation, and reporting clean enough to hand to an insurer. If you are weighing the two approaches, RMM versus endpoint management maps where the categories differ.

One practical test: pick a single control — say, "critical patches applied within seven days" — and check whether your management plane can report that number per client without a technician building a spreadsheet. If it cannot, every other layer's reporting will eventually bottleneck on manual work too. A written patch management policy gives the tooling a target to enforce.

Build, buy, or partner — per layer

Almost nobody builds security tooling anymore; the real question is whether you operate each layer yourself or pay a partner to operate it with you. A rough decision frame:

• Operate it yourself when the work is configuration and automation you can script once and reuse everywhere: MFA policy, DNS filtering, patch management, awareness campaigns.
• Partner (white-label or co-managed) when the layer needs humans around the clock: MDR, SOC/SIEM monitoring, and increasingly backup monitoring with managed restore testing.
• Resell with light management for commodity layers where your value is selection, deployment, and billing consolidation rather than operation.

The expensive mistake is the middle ground: buying a tool priced for self-operation and then staffing it halfway. An EDR console glanced at between tickets delivers neither security nor margin.

Per-seat pricing and margin mechanics

Security tooling is licensed per user, per endpoint, or per mailbox — and your costs rarely line up cleanly across all three models. Before you quote a bundle, normalize every vendor cost to a single per-seat-per-month number, add your labor estimate per seat (deployment amortized plus ongoing operation), then apply your target margin. Bundled MSP security offerings commonly land somewhere around $10 to $40 per user per month on top of base management fees, depending on how many layers are included and whether MDR is in the mix.

Two mechanics quietly erode margin if you ignore them. First, licensing model mismatch: a per-endpoint vendor cost against a per-user client price punishes you for clients with multiple devices per person — the per-user versus per-device licensing trade-offs apply to your own cost stack, not just to what you resell. Second, unbilled drift: seats added for a client mid-contract that never make it onto the invoice. Reconcile vendor counts against your PSA or billing system monthly.

Resist discounting the bundle to win a deal. The layers are what make your managed service defensible; a client who strips out backup or MDR to save a few dollars per seat has just transferred unpriced risk back to you.

Standardization versus best-of-breed

The purist position — pick the objectively best product for every layer — collapses under its own operational weight. Each additional vendor means another console, another training curve, another integration seam where alerts die quietly. The pragmatic position most mature MSPs land on: standardize ruthlessly, but allow yourself to choose a best-of-breed product for the two or three layers where risk concentrates, even if a suite offers a bundled alternative.

What you should not do is maintain two products for the same layer "because a legacy client is on it." Every exception doubles the training and halves the automation. Migrate stragglers during renewal cycles, and document the one-stack rule in your service agreement so the conversation happens once, at the contract level, instead of per incident.

Common stack mistakes to avoid

• Buying the suite discount without checking detection quality. A bundled module that underperforms costs more than the discount saves when it misses the incident that matters.
• Letting legacy clients stay on legacy tools. Every duplicate product for the same layer doubles training and halves automation. Migrate stragglers at renewal.
• Pricing the bundle per device while vendors bill you per user (or the reverse). Normalize everything to one per-seat cost before you quote.
• Announcing the stack before the evidence exists. Clients and insurers will both eventually ask for proof — deploy reporting before you deploy marketing.

The pattern across all four: the stack fails at the seams — between vendors, between cost models, between what you sold and what you can show. Design for the seams and the layers take care of themselves.

Rolling the stack out in order

1. 1 Deploy the management plane first. Everything else installs through it, and its asset inventory tells you what you are actually protecting.
2. 2 Lock down identity. Enforce MFA, kill legacy authentication, and baseline conditional access before anything else touches production.
3. 3 Stand up backup and verify a restore. Never announce a security stack to a client before you can prove you can get their data back.
4. 4 Roll out endpoint detection with monitoring attached. EDR plus MDR, or a partner SOC — but never sensors without someone watching.
5. 5 Add email security, DNS filtering, and awareness training. These are fast wins once the foundation layers are stable.
6. 6 Turn on reporting last — and make it automatic. Monthly per-client posture reports are what justify the bundle at renewal time.

Frequently asked questions