Partner With Us

The thing you're actually worried about

Let's deal with it first, because every other consideration is secondary.

You have spent years building a relationship. You introduce a security firm, they find serious problems, they present findings directly to your client, and six months later they are managing that client's IT. It happens, and it is the single reason most MSPs avoid introducing a security partner at all.

So it goes in the contract:

• We will not approach your clients. Not during the engagement, not after it, not in twelve months when a mailshot goes out.
• We do not provide managed IT. We are not your competitor and have no ambition to be. We test, we certify, we monitor, we respond to incidents.
• You control communication. If you want everything routed through you, that is how it works. If you would rather we speak to the client directly, that is fine too — your call, not ours.
• Findings go to you first. You are never surprised in front of your client by a report you have not read.

That last point matters more than people expect. A report landing on a client's desk saying their IT provider left RDP open to the internet is a bad afternoon for you. We would rather give you the finding, let you fix it, and report it closed.

Two ways to work together

Referral

You introduce us, we contract directly with the client, you take a referral fee. Simplest arrangement, no delivery risk on your side, no invoicing overhead. Suits providers who want the client served properly without owning the engagement.

White-label

We deliver under your brand. The report carries your logo, we appear as your security team, and the client relationship stays entirely yours. You set the margin. Suits providers positioning security as part of their own offering.

One honest caveat on white-label: where a client needs the report for an insurer, a tender or an audit, they will often be asked who actually holds the CREST accreditation. Most partners handle this by naming us as the accredited delivery partner, which satisfies the requirement and costs you nothing in credibility. We will flag it when it matters.

What we deliver for partners

• Penetration testing — web application, API, infrastructure, cloud, AI/LLM. CREST accredited at company level.
• Cyber Essentials — certified assessor, including the gap review that stops clients failing. We prepare clients for Cyber Essentials Plus; the Plus audit itself is carried out by a licensed Plus certification body.
• IASME Cyber Assurance — for clients needing more than the baseline.
• MDR / security monitoring — managed detection and response where you want the capability without building it.
• Incident response — retained or ad hoc, including out of hours.
• Vulnerability management — continuous scanning with prioritisation your team can act on.

Why partner rather than build it

CREST company accreditation requires audited methodology, reporting standards, data handling and demonstrable staff competence. It is a serious undertaking and it does not amortise across the four or five tests a typical MSP needs each year. Cyber Essentials assessor status is more achievable but still carries ongoing obligation.

The alternative most providers fall into is running a vulnerability scanner and calling the output a penetration test. Clients are getting better at spotting the difference, and insurers and auditors already know it.

Practicalities

Lead time is typically two to three weeks from agreed scope. If you are against a client deadline, tell us early and we will be honest about whether it is achievable rather than agreeing and letting you down in front of your customer.

Scoping is free, including calls with your client where that helps. We will also tell you when a client does not need what they are asking for — that conversation makes you look good, not us.

Findings we raise about your work get raised with you privately and without drama. Every estate has issues. We are not interested in making an MSP look bad, and an engagement where we do is one nobody repeats.

Who this suits

Providers with roughly five to fifty staff, serving SMEs, schools, charities and professional practices across the Midlands and beyond. Big enough that clients are asking security questions, small enough that building an accredited testing capability makes no commercial sense.

Common questions