Services and Channel Operator Economics

The channel and services businesses, viewed from the operator's seat — VAR/SI, MSP, and MSSP P&Ls, their levers, and the consolidation each is undergoing. Complements Service Providers, Channel, and GTM. (Book: enriches Part II, Ch. 8–9.)

VAR / Solution Provider / SI (the Optiv-type operator)

• How they make money: product resale margin (thin) + services and managed offerings layered on top (the real margin) + vendor incentives (MDF, rebates, deal registration) + marketplace co-sell.
• The P&L lever: services attach rate and recurring/managed mix. A reseller that is purely transactional is low-margin and low-multiple; one with high services attach and recurring managed revenue is a far more valuable, stickier business.
• Vendor-partner dynamics: certifications held, partner-tier status, and channel-conflict management with vendor direct sales. Concentration on a few vendors is a risk.
• Consolidation: security-focused solution providers with managed/professional services are prime roll-up targets (recurring services + vendor relationships) — e.g., Optiv (KKR), GuidePoint, Trace3. PE is actively assembling these.
• Portfolio shape is also moving the other way: in June 2026 Optiv, the largest US pure-play security VAR/integrator, divested its project-based Advisory, Consulting & Transformation (ACT) unit (~500 consultants, 800+ enterprise clients) to Vobis Ventures, retaining the recurring/managed core and keeping Vobis as an exclusive services partner for a year. The operator-economics read: project-based consulting revenue carries the lowest margin and multiple on the VAR P&L, and shedding it concentrates the retained business in the services-attach and managed mix that drives valuation — a single carve-out, but consistent with the re-rating pressure described in 04h (deal detail: Deals).

MSP (managed service provider — SMB/mid-market IT + security)

• Economics: recurring per-seat/per-device contracts; the operating stack is RMM + PSA (remote monitoring/management + professional services automation). Margins depend on technician utilization and tool efficiency.
• The security attach: cybersecurity is the highest-margin add-on an MSP can sell, and the path up-market. The SMB security market (~$109B by 2026) is served almost entirely through MSPs.
• MSP → MSSP transformation: the central strategic move — adding security capability (MDR, vCISO, compliance) to raise margins and move up-market. Often done by acquiring a security capability (a classic buy-side thesis).
• Consolidation: one of the most actively rolled-up spaces in all of tech; dedicated PE platforms (Evergreen Services Group, Thrive, Ntiva, Integris). Cyber is the value-accretive attach.

MSSP (managed security service provider)

• Economics: recurring MDR/monitoring contracts; people + platform. The margin ceiling is set by labor cost — the chronic talent shortage caps gross margins at ~40–60% (see Talent).
• The "Silo Tax": manual, human-led "triage and ticket" SOCs carry overhead that erodes margin; adversaries move faster than human reaction (~72-min exfiltration).
• The agentic-SOC transition (the defining lever): automating triage/investigation/response converts scarce labor into software margin. Providers that adopt it first re-rate the multiple (toward software); those that do not are automated or consolidated. ~39% have begun adopting agentic SecOps (see 04, 20, 31).
• Build vs. buy the platform: build (Arctic Wolf Aurora, Expel) vs. ride a vendor platform (Taegis, Cortex, Falcon). A core strategic and diligence question.
• Consolidation: extreme fragmentation (40k–45k US MSSPs) + recurring revenue + multiple arbitrage = the richest roll-up ground in cyber (see 04).

The multiple arbitrage

The autonomous SOC and software attach widen this arbitrage by letting services businesses behave more like software — the single biggest reason the services/channel layer is consolidating now.

→ Cross-references: 04, 05, 19, PE, 27.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.