If you have any compliance-obligated clients — healthcare practices, defense subcontractors, financial firms, professional services firms under cyber insurance pressure — you are almost certainly delivering security-adjacent work inside your standard managed-services agreement. Monitoring alerts. Reviewing findings. Running occasional scans. Handling the compliance questions that come in around renewal time.
And in a lot of cases, you are doing that work for free. Not intentionally. But it’s buried in a flat rate that made sense when the contract was written, and nobody has updated the scope since.
The fix is not complicated. But it does require a pricing conversation most MSPs have been avoiding.
Why Bundling Security Kills Margin and Visibility
When security work lives inside your managed services agreement, two things happen. First, the work is invisible — to you, to your clients, and to any prospect evaluating your practice. You can’t show a client what their security posture cost to maintain, and you can’t easily justify a rate increase when the scope expands because “security” was always included. Second, the margin on that work compresses silently over time. Security work is not static. Compliance requirements get stricter. Scan findings generate remediation work. Clients ask for audit-ready evidence packages. Each of those requests costs you time, and none of it is separately billable under a bundled agreement.
The other problem is strategic. Bundling security means you have no clean mechanism to offer a better client a better service. You can’t tier your compliance coverage without renegotiating the entire MSA. You can’t upsell a client from basic vulnerability scanning to dark web monitoring to active directory security assessment if all of it is theoretically “included.” The pricing structure prevents the practice from growing.
None of this is about squeezing clients. It is about making the work visible, protecting the margin on work you are already delivering, and creating the room to grow the practice without rebuilding contracts from scratch every time a client’s compliance needs change.
Bundled Security vs. Separate Security Line Item
| Comparison | Bundled Security | Separate Security Line Item |
|---|---|---|
| Client visibility | Invisible — absorbed into flat rate | Clear deliverable with defined scope |
| Your margin | Compresses as scope creeps | Protected by defined tier and pricing |
| Upsell path | Requires MSA renegotiation | Tier upgrade is a straightforward conversation |
| Compliance evidence | Ad hoc, often undocumented | Structured, audit-ready by default |
| Contract renewal leverage | Low — security is “included” | High — client can see what they’re getting |
| Pricing model | Per seat, flat, or time-and-materials hybrid | Per user, predictable, scales cleanly |
| Practice scalability | Limited by bundled rate ceiling | Grows by adding clients and upgrading tiers |
What a Separate Security Pricing Model Actually Looks Like
The mechanics of separating security into its own line item are not complicated. The harder part is deciding what to charge and how to anchor the client conversation.
Here is an illustrative example — not universal advice, since your costs, market, and client mix will vary — using a 60-user client, which is roughly average for MSPs operating in the compliance-focused SMB segment.
If you are building on a white-label platform that costs you $6/user/month at the entry tier, your platform cost for a 60-user client is $360/month. A 100% markup puts your billing rate at $720/month. A 150% markup puts it at $900/month. That is the range on a basic vulnerability scanning and compliance monitoring service for a single mid-market client, billed as a separate security line item.
At the mid-tier — $12/user/month platform cost — your cost for that same 60-user client is $720/month. With a 100% markup, you are billing $1,440. With a 150% markup, $1,800. For a client under active HIPAA or CMMC pressure, that is an entirely defensible number for what amounts to weekly active directory security assessments, multi-source sensitive data discovery, and compliance-mapped findings your client can hand to an auditor.
At the premium tier — $18/user/month platform cost — cost is $1,080/month for 60 users. Markup to $2,160–$2,700. At this level you are delivering daily audit artifact generation, daily AD security assessment, AD password auditing, and daily attack path analysis. For a client carrying Level 2 CMMC requirements or a complex HIPAA environment, that is not an expensive security practice. It is a cost-effective alternative to what a dedicated security firm would charge for the same coverage.
The key point in each scenario is that you are starting from a known, predictable platform cost and applying a consistent markup — not guessing at a time-and-materials number or trying to estimate hours on work that is ongoing and hard to scope precisely. Per-user pricing gives you a clean formula. The billable rate moves with your client’s headcount, not with how many devices they happen to have plugged in at a given moment.
→ The SentinelBaseline Platform page walks through all three end-client service tiers — Baseline, Baseline+, and Supreme — including what’s included at each level and how compliance framework coverage maps across them.
Why Per-User Pricing Is Easier to Defend Than Per-Device in Regulated Environments
Per-device pricing made sense when the asset inventory was stable — a known set of workstations, servers, and printers behind a defined perimeter. That model is increasingly unreliable for MSPs serving regulated clients, and the reasons are practical, not theoretical.
Regulated SMBs are BYOD-heavy. Healthcare practices allow clinical staff to access EHR systems from personal devices. Defense subcontractors have remote employees using home laptops for CUI-adjacent work. Financial advisors are accessing client data from iPads. In any of these environments, a per-device pricing model fluctuates constantly, and the fluctuations generate billing conversations nobody wants to have. More devices means a higher bill with no obvious change in the service being delivered. Fewer devices — because a contract worker left or a laptop was decommissioned — means a lower bill that doesn’t reflect the same underlying compliance exposure.
Per-user pricing ties your billing to the actual driver of compliance risk: the people in the organization with access to regulated data. The user count is stable, auditable, and easy for a client to verify. When a client under CMMC asks their assessor why their security bill changed, “we added three users” is a cleaner answer than “we added two laptops and lost one desktop and the BYOD count shifted.” The pricing logic also maps naturally to how compliance frameworks think about scope — CMMC Level 2 controls, HIPAA access controls, and PCI DSS requirements are all fundamentally about who has access to what, not about how many endpoints exist at a given moment.
When to Position Baseline, Baseline+, and Supreme
The three end-client service tiers are not a good-better-best upsell ladder in the traditional sense. They map to different compliance exposures and different risk profiles. Positioning them correctly means matching the tier to where the client actually sits — not selling the highest tier to everyone.
Baseline at $6/user/month
The right starting point for a client who has a compliance obligation — cyber insurance, HIPAA, PCI DSS — but has never had a structured security assessment before. The deliverable is Nessus-powered vulnerability scanning, compliance framework mapping across one framework, cloud and identity review, and sensitive data discovery from one cloud source. For a client who currently has nothing, this is a significant step up. It gives you a structured deliverable to bill for, and it gives the client something they can show an auditor.
Baseline+ at $12/user/month
For clients with active, recurring compliance requirements — CMMC Level 1 contractors with near-term SPRS obligations, HIPAA-covered entities running quarterly reviews, or any client whose insurance carrier is asking harder questions at renewal. The additions at this tier — weekly active directory security assessment, two-source sensitive data discovery, compliance mapping across three frameworks — are the features that generate the audit-ready deliverables a serious compliance review actually requires. This is where most growth-focused partners will land their primary client base.
Supreme at $18/user/month
For clients who cannot afford a security event — defense contractors handling CUI, healthcare organizations with large patient data footprints, financial firms under active regulatory scrutiny. Daily audit artifact generation, daily AD security assessment, AD password auditing, daily multi-step attack path analysis, and three-source sensitive data discovery. This tier positions your MSP as the client’s de facto security operations function, not just a scanning vendor. It is not for every client. But for the right client, it is the most defensible annual contract you will sign.
The practical implication for pricing conversations is that tier selection should start with a compliance question, not a budget question. Ask the client what their compliance obligations are, what their assessor or insurance carrier is asking for, and what evidence they currently have to answer those questions. The tier positions itself from the answer.
→ The Partner Program page covers how partners can layer penetration testing on top of any end-client tier as a separate buying motion — a natural next step once the recurring scanning practice is in place.
If you want to see what the pricing math looks like for your specific book of business — your actual client count, your target markup, your compliance mix — book a 30-minute demo. We will model the revenue for you during the call, show you the platform, and answer questions on onboarding and partner economics. No pressure. Just the numbers.
Frequently Asked Questions
How do I have the pricing conversation with a client who currently has security bundled in their agreement?
Start with what changed, not with pricing. If a client’s compliance requirements have tightened — CMMC Phase 1 is in effect, their insurer updated their questionnaire, PCI DSS 4.0 is now enforceable — that is the opening. “Your compliance exposure has changed, and what we were doing informally is no longer sufficient to meet the standard. Here is what a structured security practice looks like and what it costs.” The conversation is easier when it is anchored to a specific external requirement than when it is framed as you raising your rates.
What markup should I use on security platform costs?
That depends on your market, your cost structure, and what your clients will support — so this is not something to answer universally. The 100–150% range is a common starting point for MSPs entering the security practice space, because it leaves room to cover your operational overhead (onboarding time, client reporting, remediation oversight) while keeping the client-facing price defensible. As you add clients and streamline delivery, your effective margin improves without changing the billing rate.
Does per-user pricing work if my clients have high contractor or seasonal workforce turnover?
Generally yes, because the billing follows the current authorized user count rather than a fixed device inventory. If a client’s headcount fluctuates seasonally, you can set billing to reflect the current active user count. The bigger advantage is transparency — the client can verify their own user count easily, which makes the bill easy to explain and hard to dispute.
Can I offer different tiers to different clients under the same partner agreement?
Yes. Partners have access to all three end-client service tiers (Baseline, Baseline+, and Supreme). You are not locked into offering a single tier to your entire book. A client with a basic cyber insurance requirement might stay at Baseline while a defense contractor client moves to Supreme. Managing that mix is exactly what the platform’s multi-client structure is designed to support.
How do I handle compliance framework selection with clients who don’t know what they need?
That is a discovery conversation worth having deliberately rather than defaulting to whatever the client mentions first. Start with the question: “Who is asking you to prove security compliance?” The answer usually tells you the framework. Insurance carrier points to NIST CSF or CIS. A DoD prime contractor points to CMMC. Healthcare covered entity points to HIPAA. Payment processor or card brand points to PCI DSS. If a client has multiple overlapping obligations — a defense contractor who also takes payments — that is the argument for Baseline+ or Supreme, which map to multiple frameworks simultaneously.
What happens to security pricing when a client’s compliance requirements escalate mid-contract?
This is where a tiered per-user model is cleaner than a bundled agreement. When a client moves from Level 1 to Level 2 CMMC readiness requirements, or when their insurer asks for annual penetration testing in addition to scanning, the pricing conversation is a tier upgrade or an add-on — not a full contract renegotiation. The structure makes the upgrade conversation straightforward because both parties already understand what the current tier includes and what the next tier adds. See how Sentinel’s pricing model compares to typical competitor platforms.