Delivering SASE as a service moves gross margin from 15–25% on hardware resale to 50–65% on recurring revenue, but costs you the day-one cash: roughly sixteen months before the recurring margin matches what the box paid upfront. Ticket volume falls while complexity rises, and NIS2 now makes you an Important Entity in your own right.
Every SASE vendor has a partner page. We checked the first page of results for sase for msp, multi-tenant sase, managed sase and msp sase platform, and across all four queries the ranking pages are vendor partner-recruitment portals, vendor-authored blogs and product datasheets. Independent channel journalism does not appear. Peer benchmark analysis does not appear. The AI Overviews cite the same vendors, and reproduce the same four talking points: central cloud management, no hardware, flexible billing, better hybrid connectivity.
All of which may be true and none of which tells you what happens to your profit and loss. Nobody on page one models the gross margin shift in percentage and in euros. Nobody explains how you replace the €3,000 to €15,000 of hardware and installation margin you book on day one of a client onboarding. Nobody lists which ticket categories go to zero and which new ones arrive. And nobody works through what NIS2 Article 21 flow-down actually obliges you to put in a contract.
That is what this is. Jimber sells through partners, so we have an interest in your conclusion — but the numbers below come from Service Leadership benchmarks, the directive text and channel community reporting, not from our own deal desk. Where no public data exists, we say so rather than substituting ours.
What multi-tenant SASE has to mean before it counts
True multi-tenancy in a managed SASE platform means one logical management plane with cryptographic separation between tenants, delegated role-based access and policy inheritance across the fleet. Several vendors market multi-instance architectures — a separate virtual appliance or console per customer — as multi-tenancy. For a service delivery team that is the same operational drag as managing boxes, in software.
Seven domains separate the two. Take these into the demo as questions, and watch what the engineer does when you ask.
| # | Ask this in the demo | What you need to be true | Red flag |
|---|---|---|---|
| 1 | “Show me where tenant A’s decryption buffer ends and tenant B’s begins. Can I hold my own keys per tenant?” | Logical and cryptographic separation of routing tables, packet buffers and policy engines, with per-tenant keys and a BYOK or HYOK option | Shared TLS interception certificates or pooled keys across accounts. A memory-bleed in the inspection engine then crosses customer boundaries |
| 2 | “Create a read-only auditor role scoped to one tenant, in front of me.” | Hierarchical RBAC: global access for your engineers via your own identity provider, tenant-confined access for the client’s co-managed IT, plus auditor, tier-1 and security-engineer roles | All-or-nothing admin, where a client co-administrator can see hostnames, metadata or configuration belonging to your other clients |
| 3 | “Show me every active alert across all tenants on one screen.” | A single NOC console aggregating connectivity, detections and edge telemetry across the fleet without exposing payload | Engineers log out and back in per customer portal. That is a response-time problem before it is a convenience problem |
| 4 | “Change the global baseline, then show me the two tenants that have local exceptions.” | Global baselines that inherit down, with tenant-level exceptions that do not break the link to the template, and client admins unable to override your global rules | Static policy copying. Updating one baseline rule means editing dozens of tenants by hand — which is the managed-firewall problem you are trying to leave |
| 5 | “Provision a new tenant via the API while I watch, and push the agent through RMM with a silent token.” | Programmatic tenant creation, agent distribution through your RMM or Intune, SCIM directory sync | Interactive tenant wizards, per-user endpoint registration, certificate exports, individual pairing codes |
| 6 | “Stream tenant A’s logs to their SIEM and tenant B’s to mine. What does that cost?” | Cryptographically partitioned log repositories per tenant with dedicated telemetry streams | Blended log output you have to filter with your own scripts, or a premium charge per tenant API stream |
| 7 | “Show me the API docs, and the endpoint that returns active seat count for billing.” | Documented, versioned, bidirectional REST API for billing reconciliation and PSA ticket creation | No public API. Your service manager then reconciles seat counts by hand every month, forever |
Domain 4 is the one that decides whether this scales. In a managed firewall estate, blocking a newly published command-and-control domain across the client base means pushing configuration to dozens or hundreds of appliances. In a genuine multi-tenant platform it is one change that propagates. If the answer to question 4 is vague, the rest of the economics below do not arrive.
The economics of managed SASE: what changes shape
Hardware resale runs at 15% to 25% gross margin against 50% to 65% on recurring managed services — but the percentage is the least important change. The revenue becomes continuous instead of lumpy, the cash arrives monthly instead of upfront, and a buyer values the business at 2.0x to 4.0x ARR rather than 0.5x to 1.0x revenue.
| Dimension | Hardware and subscription | Recurring managed SASE | Effect on you |
|---|---|---|---|
| Revenue shape | Lumpy. A large upfront invoice for hardware and the project, then annual licence renewals | Continuous. Flat or consumption-adjusted monthly recurring revenue per seat or site | Removes the quarter-end volatility tied to hardware shipping |
| Gross margin | Hardware 15–25%. Software renewals 10–20%. Project labour 45–60% | 50–65% on bundled recurring service contracts | Structurally expands blended gross margin across the contract base |
| Cash flow | Positive upfront. The client funds the project with a 50–100% deposit before you procure | Neutral to deferred. Minimal upfront cash, billed monthly, often in arrears | You need working capital through the first 6–12 months of transitioning contracts |
| Churn and downward scale | Locked in. Once the box is paid for, the client cannot scale the cost down in a downturn | Elastic. Headcount falls, seats fall, your MRR falls that month | Raises exposure to client contraction. Net revenue retention becomes a metric you actually watch |
| Vendor commitments | Transactional. Buy per deal through distribution, minimal standing obligation | Tiered. Many vendors impose partner minimums, commonly 100–500 seats or an annual spend floor | An unmanaged minimum is a monthly loss during early adoption |
| Labour per site | 8–24 billable hours of staging, racking, cabling and commissioning | 1–2 hours of profile setup plus a silent agent push | Frees senior network engineering hours — which you then have to sell as something else |
| Valuation | Hardware and low-margin resale revenue: roughly 0.5x to 1.0x revenue | Recurring managed security: 2.0x to 4.0x ARR, or 8x to 14x EBITDA | The single largest effect on enterprise value at exit |
The benchmark context, so you can place your own numbers against it.
| Line | Typical gross margin | Source |
|---|---|---|
| Hardware and appliance resale | 15–25% | Service Leadership Index |
| Staging and project installation labour | 45–60% | Service Leadership target range |
| Managed recurring services, median MSP | 50–60% | Service Leadership Index |
| Managed recurring services, best in class | 65–70% | Service Leadership / Taylor Business Group |
| Adjusted EBITDA, median | 8–11% | Service Leadership Index |
| Adjusted EBITDA, best in class | 19%+ | Service Leadership Index |
| Annual client logo churn, top quartile | under 5% | Service Leadership Index |
| Revenue per technician | ≈€138,000–€184,000 ($150,000–$200,000) | Profitwise Accounting / Service Leadership |
Dollar figures converted at approximately €0.92 to the US dollar and rounded; the underlying benchmarks are published in dollars.
The cash flow valley, in one worked example
This is the part that does not appear on any vendor partner page, and it is the reason most MSPs stall halfway.
Take a 50-user branch site under the legacy model. You invoice an illustrative €4,000 of hardware at 20% margin (€800 gross profit), €2,500 of implementation labour at 60% (€1,500), and a one-year security subscription bundle at an illustrative €1,200 with 15% margin (€180). That is €7,700 of top-line revenue and €2,480 of realised gross profit in month one.
Now the same site as a managed SASE service, billed at an illustrative all-in €250 per month — €5 per seat across 50 users. At a strong 60% managed service margin that is €150 of gross profit a month. To accumulate the €2,480 you booked on day one under the old model takes roughly 16.5 months of continuous billing.
Over the full client lifecycle the comparison inverts decisively. Across 60 months the recurring agreement generates an illustrative €9,000 of gross margin with no further capital outlay, against roughly €3,200 for the legacy firewall: the €2,480 booked on day one plus four annual subscription renewals at an illustrative €180 each. And a buyer values the first at 2.0x to 4.0x ARR and the second at 0.5x to 1.0x revenue.
So the model is better. It is better starting in month 17, and it is worse for sixteen months, and those sixteen months are where the transition is actually decided. Plan the working capital before you plan the platform. The pricing mechanics behind the per-seat side of that calculation are in SASE pricing models explained, and the appliance side in managed firewall pricing.
The add-ons that eat the margin
Channel reports are consistent on one specific failure. Advertised entry pricing of €5 to €8 per user per month is frequently not the delivered cost. Platforms charge separately, per tenant per month, for dedicated static egress IP addresses — which you need the moment a client has a legacy service that whitelists by IP — for private subnet cloud connectors, and for the extended log retention that compliance audits require. Reported surcharges run to roughly ≈€46 to €92 ($50 to $100) per tenant per month.
Quote a client a fixed monthly price without those, across thirty tenants, and the erosion is structural rather than occasional. Get every add-on priced in writing before you build a price list.
The second commercial trap is vendor minimums: initial commitments of 100 to 500 seats, or annual spend floors reported at €10,000 to €25,000. For an MSP migrating incrementally — which is what you should be doing — a minimum is a loss you pay monthly until volume catches up. Consumption-based billing monthly in arrears against active endpoints is what the channel asks for, and it is a reasonable thing to insist on.
The third is disintermediation. Vendors running a partner programme alongside a direct enterprise sales force create a structural conflict at exactly the moment your account becomes valuable. Channel partners report mid-market accounts that grew past 500 seats being approached directly at renewal. Deal registration with non-circumvention language is not paperwork; it is the thing that determines whether you own the client in year four.
The support load does not fall. It moves.
Hardware RMAs, firmware patching, appliance sizing and physical port configuration go to zero. In their place come TLS inspection breaking certificate-pinned applications, identity synchronisation delays, endpoint agent driver conflicts and headless devices that cannot run an agent. Raw volume falls, average complexity rises, and your tier-1 skill profile changes with it.
| Legacy ticket category | Status | Why |
|---|---|---|
| Hardware RMA and site power events | Eliminated | No fans, power supplies or flash storage at the client site. The replacement logistics disappear with the hardware |
| Firmware upgrades and emergency CVE patching | Eliminated | Control and data planes are patched by the vendor. No more out-of-hours patch windows across a fleet |
| Appliance sizing and throughput saturation | Eliminated | Inspection runs in scalable cloud points of presence rather than on an ageing CPU |
| Legacy SSL-VPN client errors and crashes | Substantially reduced, reported above 80% | Always-on identity-aware tunnels replace user-initiated client sessions that drop and misroute |
| Physical interface and port configuration | Eliminated | Edge interfaces, DMZ partitioning and local trunking become software policy |
| New ticket category | Frequency | Skill your tier-1 now needs |
|---|---|---|
| TLS inspection breaking applications | High in the first 90 days | Reading an SSL handshake and writing precise FQDN bypass rules. Certificate-pinned applications — banking portals, accounting packages, sync engines — break the day you switch on full inspection |
| Identity and conditional access sync latency | Moderate to high | Auditing SCIM synchronisation between Entra ID or Okta and the platform. New starters and role changes fail intermittently until the directory catches up |
| Endpoint agent and driver conflicts | Moderate | OS networking diagnostics. The virtual adapter collides with endpoint protection network drivers, antivirus packet filters and local stacks |
| Geo-IP and static egress mismatches | Moderate | Configuring per-tenant dedicated egress IPs. SaaS platforms read the cloud PoP as a foreign jurisdiction and lock the account |
| Headless and unroutable devices | Low to moderate | Configuring site connectors or transparent layer-3 tunnels for printers, scanners and industrial systems that cannot run an agent |
The honest summary: raw volume declines, average complexity rises. Your tier-1 needs working fundamentals in identity, certificates and HTTP behaviour rather than cable diagnostics and IPsec phase mismatches. That is a training budget and a hiring profile change, and it lands in the same year as the cash flow valley. Benchmark target to hold yourself to is under one reactive ticket per endpoint per month. The consolidation argument — fewer consoles, fewer point products behind those tickets — is covered in how MSPs deliver managed SASE without tool sprawl.
What NIS2 now puts in your contracts
If you meet the medium-enterprise thresholds, NIS2 Annex II makes you an Important Entity in your own right, with fines reaching €7 million or 1.4% of turnover. Below that threshold, Article 21(2)(d) reaches you anyway through your clients — as clauses in their master service agreements. This is commercial, not a compliance lecture.
Under NIS2 Annex II, business-to-business ICT service management is a sector of high criticality. If you meet the medium-enterprise thresholds you are an Important Entity in your own right, not merely a supplier to one. Member states can additionally designate smaller providers as critical where an incident would carry systemic risk. Administrative fines for important entities run to €7 million or 1.4% of turnover; for essential entities, €10 million or 2%.
Below the size threshold, Article 21(2)(d) reaches you anyway through your clients. Every essential and important entity must account for the vulnerabilities and security practices of its direct suppliers. You are a direct supplier. That obligation arrives as clauses in their master service agreement, and Belgian enterprise clients are now writing CyFun Basic or CyFun Important requirements directly into those agreements.
| CyFun level | Controls | Modelled attack coverage | Assessment route |
|---|---|---|---|
| Small | 7 controls | Basic hygiene baseline | Self-assessment via the Safeonweb tool |
| Basic | 34 controls | 82% of common automated attacks | Independent third-party verification under ISO/IEC 17029 |
| Important | 133 cumulative controls | 94% of common and targeted attacks | Independent third-party verification under ISO/IEC 17029 |
| Essential | 218 cumulative controls | Approximately 100% of advanced targeted threats | Formal certification under ISO/IEC 17021-1 by a BELAC-accredited body |
Verified or certified CyFun compliance carries a formal presumption of conformity under the Belgian transposition law, which is why clients want it from you in writing. To satisfy the governance and protect functions as a network security provider you have to demonstrate three things: that network access policy is managed centrally under a zero-trust baseline, that your subprocessors — including the SASE platform itself — hold equivalent verifiable certifications, and that client telemetry and admin access logs are retained, protected from alteration and available for audit.
The clause most MSPs have not put in their vendor contract yet
Article 23 sets a hard reporting clock: early warning within 24 hours of becoming aware of a significant incident, full notification within 72 hours, intermediate reports on request, and a final report within one month.
Now read that as a supply chain problem. If your upstream SASE vendor suffers a compromise or a control-plane failure and takes 72 hours to tell you, you have already breached your own 24-hour window and there is nothing you can do about it after the fact.
The only defence is contractual: your vendor agreement needs a guaranteed incident escalation to you within 4 to 12 hours of vendor-side detection. Ask for it explicitly during procurement. A vendor that will not commit to a notification SLA is asking you to absorb their disclosure latency as your regulatory liability. The wider obligation set is covered in NIS2 supply chain security obligations.
Sovereignty as a commercial argument, with the evidence and its limits
Data residency is not data sovereignty. Under the US CLOUD Act a provider subject to US jurisdiction can be compelled to disclose customer data regardless of where the servers sit, so an EU datacentre operated by a US-incorporated parent stays in scope. That distinction now appears in Belgian procurement questionnaires — but it is easy to overclaim, so be precise.
What is settled law: under the US CLOUD Act, 18 U.S.C. § 2713, a provider subject to US jurisdiction can be compelled to disclose customer data regardless of where the servers sit. FISA Section 702 permits warrantless surveillance targeting non-US persons through US electronic communication services. Both mean the same thing operationally: data residency is not data sovereignty. A SASE fabric run by a US-incorporated entity or its wholly owned European subsidiary remains within reach of both, whether the datacentre is in Frankfurt or Brussels.
What is not settled: the European Cybersecurity Certification Scheme for Cloud Services. Draft sovereignty requirements at the High and proposed High+ tiers, which would have mandated EU headquarters and legal immunity from foreign extraterritorial law, were contested and modified in March 2024 in favour of transparency and jurisdictional declarations. Do not sell EUCS High+ as a requirement. It is not one, and saying so will cost you credibility with exactly the buyer who checks.
What is demonstrable commercially: Belgian procurement scrutiny is real and documented. Parliamentary and media investigations into Digitaal Vlaanderen’s framework expenditure with foreign hyperscalers, including Microsoft licensing through regional integrators, produced official acknowledgement that data held by US companies remains subject to the CLOUD Act. Public entities in Flanders and Belgium tightened their sovereignty requirements as a result. Across Germany, France and the Benelux, procurement now routinely distinguishes operational sovereignty — telemetry, credentials, access patterns and unencrypted inspection processed exclusively in the EU — from corporate sovereignty, meaning the vendor’s ultimate parent is EU-incorporated and legally immune from foreign disclosure orders.
The commercial read for a Belgian MSP: for clients in healthcare, critical manufacturing, finance and municipal government, being able to offer an EU-sovereign stack is a differentiator you can evidence, in tenders where competitors carrying only a US stack cannot. Frame it as jurisdiction rather than as patriotism. The wider argument is in why European companies are choosing local SASE.
You cannot switch the estate overnight. Three routes.
Three transition routes exist, and they differ mainly in what they do to year-one revenue. Greenfield-only adds new clients to the platform and leaves the installed base alone. Renewal-triggered migrates each client at its hardware refresh or subscription expiry. Estate-wide forces everybody across in six to twelve months.
| Route | Pace | Risk | Year-one revenue effect |
|---|---|---|---|
| Greenfield only — new clients go straight onto the platform | Organic accretion over 2–4 years | Low. Existing contracts untouched | Neutral. Legacy hardware margin intact, recurring revenue grows slowly |
| Renewal-triggered — migrate at each client’s refresh or subscription expiry | Disciplined, across a 36–48 month refresh cycle | Moderate. Client-by-client, aligned to conversations you were having anyway | Controlled. Predictable decline in upfront resale, offset by growing recurring margin |
| Estate-wide — forced cutover of everybody | 6–12 months | High. Service desk saturation, configuration errors, user resistance | Severe contraction. Project revenue to zero, write-offs on unamortised HaaS hardware, temporary double licensing |
Greenfield is the low-risk choice and it has one real cost: fleet bifurcation. Your engineers run two security operating models at once, which dilutes the labour efficiency that was half the point.
Renewal-triggered is where most established providers should land, phased over 24 to 36 months. The mechanism is already in your calendar: when an appliance approaches end of sale or end of support, you present an architecture instead of a refresh quote. That removes the client’s capital hurdle and moves the account into recurring billing in the same conversation. If your fleet is SonicWall or WatchGuard, the dates that drive those conversations are already published — see the SonicWall TZ and NSA end-of-life table and the Firebox model dates.
You do not have to rip out a firewall the client has already paid for. Deploy the agent first to secure remote and mobile users, leave the amortised box routing, and take the site over when its support contract expires. For sites with servers, NAS, printers or industrial devices that cannot run an agent, a transparent layer-3 connection into the fabric handles it — that architecture is covered in managed SD-WAN for service partners.
Steelman: the case for not doing this at all
An owner with a profitable managed-firewall practice has three arguments, and they are better than the vendor material admits.
“The box is a high-margin, fully controlled cash generator.” A decade of engineered deployment workflow. Volume discounts through distribution. An immediate margin on the hardware, a non-negotiable €2,500 to €5,000 installation fee, and 20% on annual subscriptions for three years without touching the appliance. You hold the root keys, the configuration is local, and cash is positive from day one. Replacing that with reselling somebody else’s multi-tenant platform — where the vendor takes the majority of the software margin, charges you per seat monthly, and hands you an 18-month cash recovery curve — is an unforced business-model risk. Why become an underpaid billing conduit for a cloud vendor?
“SASE does not solve the server and IoT reality.” The marketing assumes every client is a startup living in Microsoft 365, Salesforce and AWS. In the European mid-market that is not the case. Your clients run manufacturing plants, distribution warehouses, local SQL servers, NAS arrays, PLCs and on-premises ERP. You cannot install an agent on a barcode scanner, an IP camera, a CNC lathe or a badge reader.
A next-generation firewall on site gives real microsegmentation, local VLAN inspection, layer-2 isolation and multi-gigabit line-speed routing between local endpoints without sending internal file transfers anywhere near the internet. SASE solves the remote laptop. It leaves the physical office either exposed or dependent on connector workarounds.
“It concentrates liability you cannot control.” Today a site outage has an isolated failure domain: the appliance failed and you swap in the cold spare within four hours, or the local ISP is down. Route the whole client base through one cloud fabric and you introduce cascading third-party risk. A control-plane outage, a routing flap, a bad certificate rollout or a large DDoS takes every managed client offline at once.
Your service desk floods, and your senior engineers have no access to the hypervisors or routing instances — they are watching a status page and absorbing the anger. Under NIS2 that outage also starts your own 24-hour reporting clock, making you legally answerable for downtime caused entirely upstream.
Where each argument actually lands. The first is a timing objection, not a model objection, and it is answered by working capital planning and by renewal-triggered phasing rather than by staying put. The second is correct and permanent for a subset of sites, which is why a serious platform has transparent layer-3 site connectors and why an honest evaluation checks that before anything else — but it describes a subset, not the estate.
The third is the strongest, and it does not go away: you are trading many small failure domains for one large one. What you can do is price the risk properly, put the 4-to-12-hour escalation SLA in the vendor contract, verify PoP presence in the Benelux rather than assuming European coverage means nearby, and insist on a dedicated partner escalation path into tier-2 and tier-3 engineers instead of a public ticket queue. That is an answer. It is not a dismissal.
What to do next
Three things, in this order. Take the seven demo questions above into your next vendor call and score the answers rather than the slides. Model the cash flow valley with your own client count, your own average site, and your own working capital position before you commit to a transition route. And ask any vendor you shortlist, in writing, for their incident notification SLA, their add-on price list and their deal registration terms — those three documents tell you more about what the partnership will be like in year three than any partner-programme page.
Jimber is an EU-headquartered SASE platform sold through partners, which makes both the sovereignty argument and the channel terms things you can check rather than take on trust. Partner tiering, protected margin and onboarding criteria are set out at jimber.io/become-a-partner. If you would rather see the multi-tenant console against the seven questions first, book a demo or talk to us, and the service-provider view is at jimber.io/use-cases/managed-service-provider.
Frequently asked questions
How does SASE change an MSP’s gross margin compared with firewalls?
Physical firewall resale runs at 15% to 25% gross margin and software renewals at 10% to 20%, against 50% to 65% on bundled recurring managed services. The upfront hardware markup disappears, so margin percentage rises while month-one margin in euros falls. Recurring margin overtakes the one-off transaction at roughly month 17 of the contract.
What is the difference between multi-instance and true multi-tenant SASE?
Multi-instance runs a separate virtual machine or console per client, which reproduces per-box management in software and adds infrastructure overhead. True multi-tenancy uses one logical management plane with cryptographic data-plane isolation between tenants, delegated role-based access, and global policy that inherits down to every tenant with local exceptions.
Are MSPs directly in scope for NIS2 in Belgium?
Yes, if you meet the medium-enterprise thresholds. NIS2 Annex II designates business-to-business ICT service management as a sector of high criticality, making MSPs and MSSPs Important Entities in their own right. Below the threshold you are still reached indirectly, through the Article 21(2)(d) supply chain obligations your clients must impose on you.
Does SASE reduce help desk ticket volume?
Raw volume falls but complexity rises. Hardware RMAs, firmware patching, appliance sizing and physical port configuration go to zero. New categories appear: TLS inspection breaking certificate-pinned applications, SCIM identity synchronisation delays, endpoint agent driver conflicts, geo-IP egress mismatches and headless devices that cannot run an agent.
What is the CyFun framework and why are clients asking for it?
CyberFundamentals is the Centre for Cybersecurity Belgium’s operational framework for NIS2, with four cumulative levels: Small, Basic at 34 controls covering 82% of common attacks, Important at 133 controls covering 94%, and Essential at 218 controls. Verified or certified compliance carries a presumption of conformity under Belgian law, so clients write it into master service agreements.
Why does the US CLOUD Act matter when choosing a SASE vendor?
It compels any provider subject to US jurisdiction to disclose customer data on a US warrant regardless of where the servers are. A European datacentre satisfies data residency but not sovereignty, because a US-incorporated parent or its European subsidiary remains in scope. For regulated and public-sector clients, that distinction now appears in procurement questionnaires.
Can an MSP eliminate on-premises firewalls completely?
For cloud-native clients with no local servers, yes. For hybrid sites with servers, NAS, printers or OT devices, you keep an inexpensive layer-3 connection paired with a software site connector, or a micro-appliance bridging local traffic into the fabric. Local LAN traffic between devices on the same subnet continues to switch locally at line speed.
How do channel-friendly SASE vendors bill?
Monthly in arrears on active consumed seats or registered devices, with a documented API so your PSA reconciles invoicing automatically. Less channel-aligned vendors impose annual commitments, seat minimums of 100 or more, or separate line items for dedicated egress IPs, cloud connectors and log retention. Get every add-on priced before you set a client price.
What should a deal registration programme guarantee?
Non-circumvention in writing, transparent protected margin on partner-originated opportunities, and a stated position on direct sales. Vendors running a direct enterprise sales force alongside a partner programme have been reported approaching accounts directly at renewal once those accounts passed 500 seats. This determines who owns the client in year four.
Which transition route should an established MSP choose?
Renewal-triggered, phased over 24 to 36 months, for most providers. It uses the hardware refresh conversation you already have, removes the client’s capital hurdle, and avoids both the fleet bifurcation of a greenfield-only approach and the cash contraction and HaaS write-offs of an estate-wide cutover.
