Ongoing development as a model for success with managed security services

In principle, our Managed Services are particularly interesting for customers who do not have the time or the know-how to take care of their IT security themselves. We have different packages with different products behind them. Our partner, which is no secret in this area, is Sophos. If we look at the endpoint, we currently have three building blocks: Endpoint Protection Service Basic, Standard, and Premium. In Basic, the InterceptX Advanced is behind it, so to speak. As some sources say that Extended Detection and Response is now state of the art, this is included in our Standard package, and customers who take the issue of security really seriously and want the best possible protection take the Premium Service, which then includes MDR Complete and ensures that the customer is proactively protected 24/7, because we can't do that as ProComp. Firewall monitoring is a little simpler. There is only one service package here, which varies according to the size of the company. We have a package for small companies with fewer than 30 employees, and it is a little more expensive for companies with more than 30 employees.

In the meantime, all new customers opt for the standard package because we say that this is the state of the art, and if you explain well what added value you have with EDR and XDR, then you can get customers excited about it. However, we also have a few customers from the past who still have the basic package. For them, there are already one or two discussions about why more needs to be done now. And that is one of the challenges of managed services. If you have manufacturers behind you who are constantly adapting their products and incorporating new features, you have to make sure that your service descriptions, contracts and much more are always up to date.

Yes, of course there are such and such customers. There are customers who say, I want to be in charge myself. I can do it, I have the resources for it. Then they buy licenses, now in the traditional way. And then the admin doesn't look at the dashboard for three years, except when he downloads the installer again. But then we always try to explain to our customers that IT security in particular is an ongoing process. I have to find the needle in the haystack in my company as early as possible so that there are no major risks. And the customer's task is ultimately to inform us if there are any new clients or servers in the company so that we can integrate them accordingly. This also frees up the customer to take care of other issues such as digitalization and how to advance my company's IT technology.

Exactly, that's an important point and it's a very difficult undertaking, especially in the area of security, because assuming the customer has a cyberattack or something serious happens, then of course the costs for service providers can become almost limitless. That's why, as a provider, you have to protect yourself a little. Our service is: We react to detections. Let's take XDR as an example. As a rule, this is not yet a hard event where something malicious is prevented, but XDR detects suspicious behavior on some client. We are notified, but with a certain threshold value. Then one of us takes a look at it. This is all included in the monthly flat rate. But if we now determine that something needs to be done, e.g. taken offline or we need to analyze in depth, then this results in a charge based on time and effort. And our customers know that too. From my point of view, there is no other way of mapping this, because if I want to map all eventualities in my MSP model, then it can very quickly become very unattractive for customers in terms of price. We didn't want that either.

So when we got into the subject, we had a three-year contract term. But then the question usually came up, what does it cost if I simply license it for three years? And then he compared left and right and then the response was very often that the price difference was too great when extrapolated over the three years. And now we have monthly flexibility. We've already noticed a positive effect, because interested parties or customers know that if it's no longer suitable after two weeks, I can send ProComp a notice of termination and look for another provider.

Automation is essential. If you're new to the topic, as we were years ago, you can usually still help yourself quite well with the manufacturer's board tools. If something happens, I get an email alert, so I might need to have a bit of a process in my company or a strategy for how to deal with it and who to send it to. We have already implemented a few additional things via the API at SOPHOS. For example, a dashboard where you can see across all customers whether there are any things that are wrong. And there are events where we are not notified by email, but it is important for me to know in order to be able to provide my customers with the best possible support and then a lot is possible with the API, especially with SOPHOS. For example, we have now built a Teams chatbot that can chat to our employees via Teams if something is wrong with a customer. And I think that ProComp will also take the next step in the coming weeks and months. Because we want to keep growing with our customer base.