The Commoditization Map for MSP Security Services

Endpoint protection leads at 68% when service providers name the security services that feel most commoditized in their market, in Cynomi’s State of the vCISO 2026 report, and vCISO services close the list at 7%. The services at the top are the ones a developing practice sells from day one. The three advisory services at the bottom of the list are the ones most practices have never packaged, and they are the three to build next.

The ranking comes from 200 surveyed US service providers, each naming three of nine services. The top four rows are services you buy from a vendor and resell per seat or per endpoint, and the three advisory rows at the bottom are services you deliver with judgment and price on the outcome. Here is the full list, with the share of providers who put each service among their three:

Per-Seat Security Services Commoditize First

A per-seat service has one number on it, and your client’s procurement team can compare that number against three other quotes before lunch. Endpoint protection, scanning, training, and MDR all run on vendor platforms your competitors can also buy, the output looks the same from every provider, and the list prices are published. When the product is identical, the comparison column is price.

The squeeze is tightest in managed security, where the product is a quiet quarter. Your MDR partner’s SOC closed 40 alerts last month and none of them became an incident, and the client sees the same thing they saw the month before, which is nothing. At renewal the per-seat line has nothing to show for itself except its price.

The outcome rows leave something the client can hold: an advisory engagement leaves a roadmap with the client’s name on it and a budget plan their finance lead can read. A compliance readiness engagement leaves a gap list and an evidence set an auditor accepts. A vCISO retainer leaves a person the client’s leadership calls before they sign a contract. None of those has a column in a procurement spreadsheet, and none of them looks the same from two providers, so there is nowhere for the price to be compared down.

The map above puts a number on a condition Omdia describes for the whole channel in 2026. “MSPs are seeing services automated and commoditized,” Jessica Davis, Principal Analyst at Omdia, told Channel Dive in August. Omdia’s MSP Trends and Predictions 2026 report says organic growth will be hard for most partners because of “customer budgets, service commoditization, and price pressures,” and sees positives for the partners doubling down on “technical and advisory skills.”

What Clients Say Their MDR Service Leaves Undone

MDR is the flagship of most security practices, and it sits on the commoditized half of the map at 47%. The report asked 200 US clients using an MDR provider how well the service meets their strategic advisory needs. None said it fully meets them. 61% said it meets some of their needs and they still need additional strategic guidance, and 39% said it mainly covers detection and response and they need significantly more advisory.

Those same clients were asked whether they would buy strategic advisory as a standalone service if their provider offered it. 83% said they would be likely to, and 10% chose the strongest option on the scale. That is a stated likelihood, and nobody has signed anything, but the clients buying MDR say they would buy advisory too.

Their reason for buying security at all points the same way. Asked for their single top cybersecurity goal, 53% of clients said reducing overall business risk. Improving security visibility came second at 13%. Nobody picked maximizing cybersecurity ROI. A client whose goal is lower business risk is buying a judgment about where the risk sits and what to do about it first, and that judgment is the advisory row.

Clients want help prioritizing fixes and clear reports for leadership more than providers think they do. Clients put more weight than providers on help prioritizing fixes (25% against 21%) and on clear reports for leadership (25% against 18%). Providers lean the other way on lower overall security risk: 87% of providers believe clients value it, against 64% of clients who name it as an expectation. The two sides agree on faster threat detection and on compliance readiness, and since the two samples answered differently worded questions, these are patterns rather than point spreads. The places where clients lean harder are the places on the map providers call least commoditized.

Where Margin Is Going in MSP Security Services

Nobody publishes gross margin by security service line, so any number you have seen for the most profitable security service for an MSP is somebody’s estimate. Two measured markets give the direction. Mordor Intelligence puts the cybersecurity consulting market on an 18.91% annual growth rate from 2026 to 2031, and MarketsandMarkets puts the managed security services market on 11.1% a year from 2025 to 2030. Those are two publishers measuring two different things, so do not add them together, but the advisory layer is growing faster than the managed security market around it. A service compared per seat has its margin set by the cheapest competent competitor in your region, and a service priced on the outcome has its margin set by what the outcome is worth to the client and what it costs you to deliver. On the advisory rows at the bottom of the map, your delivery cost is the only one of those two numbers you control, and that is where the margin conversation in your practice is headed.

How a 40-Client MSP Decides Which Security Services to Add Next

Take an MSP with 40 clients, two seniors, and six techs. The security line today is endpoint protection, patching, a quarterly vulnerability scan, security awareness training resold from a platform, and MDR resold through a vendor SOC. Every row the practice sells sits on the commoditized half of the map, which is true of most developing practices.

Endpoint protection, at 68%, stays and stops being defended on its own. It becomes the price floor of the security bundle, and the owner stops taking meetings about the per-endpoint rate as if it were a service. The decision is to hold, and to spend no more building here.

Vulnerability scanning, at 54%, stays, and the output moves. The scan is the commodity; the prioritized list of what to fix first is what a quarter of clients say they expect from their provider. The practice keeps the scan as a line item and routes its results into the advisory row it is about to build, where the prioritization gets done and paid for.

Security awareness training, at 50%, stays as tier content. It costs the practice little to deliver beyond the platform license, it belongs in the bundle, and nobody is paying a premium for it, so it holds where it is.

MDR, at 47%, stays with the vendor SOC, and the call is to hold without deepening. Building a SOC is a capital decision a 40-client MSP does not make, which takes the SOC services row off the table too. The client data says the gap in MDR is guidance, which a bigger detection stack does not supply. The money that might have gone into detection goes down the map instead.

Incident response, at 27%, becomes a retainer through the MDR partner. It is a small line, it is the first thing a client asks about after a peer gets hit, and it pairs naturally with the advisory row. Add it, modestly.

Strategic advisory, at 20%, is the row to build now. Start with the eight or so accounts that already ask the seniors questions between QBRs. Those are the clients who will plan and pay. The service is a quarterly risk review, a roadmap, and a budget plan for the coming year, delivered as a monthly retainer and priced on that outcome. At, say, $1,800 a month across eight accounts, that is $14,400 of MRR the practice did not have, from work the seniors were already half doing for free. The packaging and upsell motion for this row is laid out in four tactics to scale your advisory services.

Compliance readiness, at 10%, is the row to build second, delivered as an outcome of the advisory row. 54% of clients expect compliance readiness from their provider and 52% of providers believe they do, so this is one place both sides already agree. Scope it to the two or three frameworks already in the book and let the assessment do the work. ECI, an MSP serving financial services firms, cut its security assessment time by about half and moved the delivery to less senior staff. That is the shape this row has to take at 40 clients, or it never leaves the seniors’ desks.

vCISO services, at 7%, is the row to build third, for the top five accounts only. A named advisor on retainer, with a seat in the client’s planning cycle, is the least commoditized service on the map because it is the hardest to deliver without a senior in the room. The constraint is the seniors’ hours, so this row waits until the advisory row has a cadence a tech can run. Standing it up without a hiring round is the subject of how to add vCISO services without adding personnel, and the longer sequence is in from MSP to vCISO.

The practice puts no new money into the top half of the map and all of it into the bottom.

Building the Least Commoditized Services Without Adding Senior Headcount

Advisory, compliance readiness, and vCISO sit at the bottom of the map because they are hard to deliver, and the developing practice has two seniors. If every assessment, policy set, roadmap, and executive report is built by hand, each client costs a senior a week a quarter. Forty clients is 40 senior-weeks a quarter, and two seniors have 26 between them, so it does not fit.

The rows become priceable when the deliverables come out of one system in the same shape for every client. A tech runs the assessment, the roadmap generates from the findings, the policies generate from the client’s profile, and the report is the record of what changed, so the senior’s time goes into the recommendation. That is the work a practice hands to Cynomi when it delivers vCISO services across a book. Less senior staff deliver standardized assessments and roadmaps, CISO-level methodology sits in the workflow, and the client reporting comes out of the same system.

Pull your own catalog, place each line on the table above, and look at where your revenue sits. If all of it is in the top four rows, the next build is advisory for the handful of clients already asking, and the rest of the map follows from there.