Cybersecurity vs. Security Products: What MSPs Need to Know

Over the past five years, I’ve noticed that many MSPs out there have stopped selling actual security and are focused instead on selling security products—products that sometimes do not perform as intended; even worse, they are completely unnecessary.

Evaluating Security Risk over Selling Products

Security versus security products. The distinction between the two sounds small—it isn’t. One is a service built around a client’s actual risk profile; the others are line items on an invoice that grows with each renewal, whether the risk has changed or not. The result? Tool sprawl for clients, and lack of trust in MSPs expert guidance.

Tool Sprawl: Lowers Margins & Higher Client Churn 

Managed Service Providers (MSPs) use an average of 20 tools, yet operating margins are shrinking despite rising tool sprawl and vendor bundling.

Even though most clients say they feel adequately protected by their MSP, many of them still say they plan on switching providers within the next three years. This presents a strange disconnect where there is both high customer satisfaction and high churn rates.

Why? The answer is trust. 

Clients can tell when they are being protected and when they are getting sold, even if they cannot always articulate the difference. 

In walks private equity. 

The Cost of Private Equity Firms  

Private equity helps create the conditions for all of this to happen and was involved in around 69% of disclosed M&A deals in 2025, (thank you ai) and consolidation is accelerating. Cybersecurity has become the preferred mechanism for these platform rollups because recurring security revenue is exactly the kind of predictable, expandable product that looks good as an investment opportunity. 

The money from private equity is not inherently bad. Funding helps research and development, creates better tooling, fuels sensible consolidation, and decreases client complexity. That being said, private equity funding comes with a return on investment timeline that creates a very specific type of pressure—the pressure that says, “we must grow our customer base and revenue per account every quarter, regardless of what the customer needs.” 

Focusing on Growth Targets over Client Risk 

When growth targets are set by funding and not by client outcomes, the easiest thing to do is add more things to sell to maximize purchase opportunities. It is not to create a better security posture for the clients. Many chose to bundle in more stuff, or create an add-on nobody asked for. None of that reduces a client’s risk. 

The Key to Long-term MSP Success 

This perspective is all important for MSPs because they sit at a peculiar intersection: they are not just a vendor, they are trusted advisors. The MSPs that will rise to the top and still be trusted in five years are the ones who make the same security recommendations whether or not there is a financial gain. MSPs need to be leading engagements with honesty and provide a true, reality-based risk assessment before bringing out the product menu. They also need to be willing to tell a client they don’t need the premium offer at this time and help their clients understand that foundational security hygiene and best practices like DMARC are essential cybersecurity offerings and not optional add-ons. 

A cybersecurity offering built on solving real, client-specific problems is a durable business. A cybersecurity offering built solely on maximizing short-term profits is doomed because clients will lose faith in their MSP. 

Fundamentally, building client trust and cultivating long-term partnerships drive sustainable, recurring revenue for years to come.

Want to continue the conversation? Head over to the dmarcian Forum.