Why we will not sell you security as a tier on your support contract

Every managed IT provider now has a security tier. It is usually the same engineers with a different line on the invoice, and the pitch for it is genuinely reasonable: we already hold every administrative credential in your building, we already see every endpoint, and adding a second vendor means paying somebody to learn what we already know. Efficiency is a real argument and that one is not a bad version of it.

We still will not sell it that way, and the reasons are worth writing down rather than asserting, because a firm declining revenue should have to show its working. None of the three is a claim about competence, the same people who patch an estate well are frequently excellent at attacking one. All three are about the position they are standing in when they do it.

One: the assessor is the assessed¶

The team that segmented your network decided where the boundaries go. Asked six months later to test whether the segmentation holds, they test the boundaries they drew. They are not being lazy; they are being human. Every assumption made while building a thing is invisible from inside it, which is precisely why it survived the build.

This firm applies the same rule to itself in the other direction and publishes it: our hardware engineers write device firmware, and our security practice tests it, because a team should not be the independent assessor of its own build. It would be strange to hold that line internally and then offer a managed IT client the arrangement we refuse for ourselves.

The practical version of the blind spot is duller than the principle and more common. An assessment produced by the incumbent tends to find the things the incumbent already has a fix for, because those are the things they are looking at. It rarely finds the ancient rule in the firewall that has been there since before they took over, the service account with a password set in 2019, or the third-party integration nobody has owned since the person who requested it left. Those are the findings that come from somebody with no history in the estate reading it cold.

Two: the pricing decides what gets delivered¶

Bundled security is nearly always priced per seat per month, alongside the helpdesk. That structure is right for support, where the work is roughly proportional to headcount and the distribution is stable: a hundred people generate about the same number of tickets this month as last.

Security work does not have that shape. Most months it is nearly nothing. Then one month it is an alert that looks wrong, and answering it properly means three engineers, a day and a half, two dead ends and a conversation with a vendor. Unbounded work against a fixed monthly fee has exactly one equilibrium, and everyone in the industry knows what it is: deliver the part that scales, and hope the other part does not arrive.

Read that last column and you have the reason bundled security so often disappoints without anyone breaking a promise. Everything in the left column was delivered. It is just that the left column was never the thing worth buying.

Three: somebody has to be able to say stop¶

The moment that decides what a security arrangement was worth is short and it is verbal. Something is wrong, the picture is incomplete, and the responsible advice is to take a production system off the network now and work out what happened afterwards. NIST SP 800-61r3 (opens in a new tab) frames response as a set of defined roles with stated authority, agreed before an incident rather than during one, and containment as a decision somebody is empowered to make. The word empowered is doing real work there: the plan has to name who can call it.

Now put that decision inside a bundled contract. The advice is expensive, disruptive, might be wrong, and it is about an estate the same firm configured, so it is close to saying we think we may have got something wrong and it is going to cost you a day of production to find out. That sentence is hard for anyone. It is hardest for the party whose agreement renews in March.

We are not suggesting providers consciously trade a client’s safety against a renewal. Almost nobody does. The point is subtler and worse: under that pressure the honest reading of an ambiguous signal drifts, slowly and invisibly, towards the interpretation that requires no disruption. A separate practice with separate people has no such gradient, and that is the entire value of the separation. It costs nothing on the good days and it is the whole product on the bad one.

Where the line actually sits¶

None of this means an IT provider should have no security responsibilities. Most of what keeps an ordinary business safe is operational hygiene performed by whoever runs the estate, and handing it to a specialist would make it worse, not better, because the specialist does not hold the keys or watch the queue.

What the separation costs you, honestly¶

Two vendors is two relationships, two invoices and a coordination problem that is genuinely ours to solve rather than yours. The failure mode is the one everybody has seen: a finding is delivered to you, you forward it, and it lands in a queue with no owner, no date and no way of telling six months later whether anything happened. Two parties both loosely responsible for a fix is worse than one party clearly responsible for it.

• Findings arrive as tickets in the queue that already runs your estate, with a named owner and a date, not as a PDF you are expected to route.
• The quarterly review has both practices in the room and the risk register on the screen, so what was found and what was fixed are read against each other rather than in two documents.
• Anything we disagree about, you hear both sides of. A finding we think is wrong gets argued in front of you rather than quietly downgraded, which is a thing that can only happen when the two parties are not the same party.
• Access is separate and stays separate. The security practice does not inherit our administrative credentials because we have them; it gets scoped access for scoped work, which is also the arrangement that makes its findings defensible to a third party.

When one vendor is the right answer¶

The argument against bundling security has a floor, and pretending otherwise would be the same overreach it is objecting to. A thirty-person company with no regulated customers, no compliance obligation and no contractual security requirements does not need two providers. It needs patching, MFA, backups that restore and somebody competent answering the phone, and paying a second firm to formally assess an estate that simple is spending assurance money before there is anything to assure.

The threshold is not headcount. It is the first time somebody outside your company asks you to prove something: a customer sends a security questionnaire with contractual weight behind it, an insurer asks what your controls actually are, a prime contractor flows down a requirement, or you have an incident and discover that what you need is not a fix but a defensible account of what happened. At that point the grade has to come from somebody who did not do the work, and the arrangement that was correct at thirty people is quietly the wrong shape.

Three questions for a provider offering both¶

If you are being sold a bundled security tier, by us or by anyone, these are the questions that separate a practice from a SKU. They are answerable on a first call by anyone who has one.

1. 1.Are the people doing the security work the same people who administer our estate? If yes, what stops an assessment from testing only the parts they built?
2. 2.Show me a finding you raised about your own configuration. Not a vulnerability in a vendor’s product, something you had got wrong and reported anyway.
3. 3.In an incident, who decides to take a production system offline, and is that authority written down anywhere before the incident?

The second one is the tell. Every provider has a story about a serious finding; almost none has one where the finding was about their own work, and the ones that do tell it immediately, because it is the best thing they have to say about themselves.