Getting started with managed security services – from trust to trial and error to profitable services

It clicked for us when we realized that we could be more than just an IT system house and become a managed service provider. And then we looked at our internal products and thought about which services we could take from them and turn them into a service. Not just say, sell it and we'll talk again in a year or two when the license has expired.

We were already relatively early on in our MSP journey in the security context with the topic of managed firewalls. It used to be done like this: firewall sold, license sold and if the customer needs a change, they just open a ticket. We then set up the Managed Firewall product. It contains a firewall that is suitable for the customer, it contains the licensing, which is also somewhat more modular with many manufacturers. And we also include our service in it, as we had already gained experience of how often the customer calls and says I need a change to the firewall or something like that. And how often do the updates come out per year and then we had a good calculation and stuck a monthly price on it. And then we realized that the same thing also works for the endpoint.

The customer also needs a piece of software, a license, there is maintenance work involved, logs may need to be checked, someone may need to look over it, because... what good is a security solution that is simply installed and nobody looks at the alerts? And... just like with firewalls, they simply stick a price on it and then offer it to customers so that they can go down the MSP route.

If something needs to be done, the technician enters his times into the ticket system as normal and we in the management ensure in the background that a service contract is stored, for example, against which this is automatically booked. The technician sees that task X has to be carried out and then he enters his times for the customer in the ticket system and the technician doesn't have to worry about what happens behind the scenes in the billing.

In regular discussions with employees, we try to find out which area you feel most comfortable in and which area you find most exciting. And just as the employees bring their personal preferences with them, we also place the respective training courses and certifications. In our company, employees who work on certain special topics are also certified up to their lower lip. This is very important to us in terms of security.

We first looked at existing customers. These are customers with whom you perhaps have a somewhat closer relationship. These are customers with whom you have earned their trust as a service provider and with whom you can try things out. You work in familiar environments, you know the customer's network and infrastructure inside out anyway. It's much easier to implement new solutions there.

For us, this is the development from a simple AV to an EDR, to an XDR and finally to an MDR. As a service provider, you have to understand that first. It's not just something that I take off the shelf and sell and then I'm done. Things also need to be configured properly. The exceptions and the exceptions that I have to pack into it should be tailored to the customer and the customer's infrastructure. And the topic of EDR and XDR is also interesting from an insurance perspective. After all, many cyber insurers are now saying, what protection solutions have you established?

If it doesn't include at least XDR functionality, we won't insure it. The final expansion stage of something like this is when you add an MDR, i.e. a managed detection and response service. As a service provider, I can do this myself if I have the expertise in-house, but very few have it and if I don't have it but still want to offer it, then I take the MDR service from the manufacturer with me. For the service provider or MSP, it's a very nice business, because it scales almost infinitely. Because the effort is no longer really mine, it's the manufacturer's if there are security incidents.

We do the major components of our security portfolio with the manufacturer Sophos. Then we said we wanted to grow in this area. And cold calling is an issue, you have to be born for it. I'm not, nor are any of us here. We have good technicians, but we don't have our own sales staff. And that's why we contacted a telemarketing agency recommended by Sophos and said that we would like to have new initial appointments with interested parties who are looking for a new endpoint solution. As a result, I made a lot of appointments via Teams. It's going very well, we'll soon be at the end of the campaign and once we're through, we'll have to start working through the orders generated. And I will probably start the next campaign straight away this year, because it was fun and also achieved a good result.