Why MSSPs Are Hitting a Margin Wall

By ContraForce · Published April 15, 2026

Industry · April 15, 2026 · 6 min read

Revenue scales with customers. Cost scales with customers. Most managed security practices are quietly subsidizing security with their other services, and the board is starting to notice.

Ask any MSSP CFO how managed security delivery is performing relative to the rest of the book and you'll usually get the same answer: gross margin is flat or compressing while revenue grows. The growth looks healthy on the topline. The math underneath isn't.

The reason is simple. Traditional managed security delivery scales by adding analyst hours. Every new customer adds alert volume. Every new customer adds operating procedure variance. Every new customer adds three new tools that need to be reconciled into the ticketing system. The cost per incident climbs even as the unit price per customer is held flat by competitive pressure.

The three forces compressing margin

• Alert volume per customer keeps growing as the threat surface expands. The same alert that took 8 minutes to triage in 2022 takes 12 minutes in 2026 because the context has gotten richer and the false-positive rate has gotten worse.
• Analyst supply is constrained. Senior tier-2 analysts cost more every year and quit faster. Most MSSPs are competing for the same 50,000 people across the entire North American market.
• Operating procedure drift is invisible until it explodes. Two analysts handling the same incident class will quietly diverge over six months. The result is uneven delivery quality, escalation overhead, and eventually a customer who churns because their experience doesn’t match the SLA.

The two paths most MSSPs try

The first path is to outsource the actual delivery to an MDR vendor. The math here looks attractive on a spreadsheet, until you realize you’ve handed your customer’s security relationship to a third party who uses their operating procedures, their analysts, their black box. You lose control, you lose margin to them, and the customer relationship is now mediated by a vendor whose interests are not aligned with yours.

The second path is to build it. Hire analysts, write operating procedures, deploy a SOAR platform, and pray the math works. It usually doesn’t. Hiring is slow. SOAR build-out takes 6–12 months and never quite finishes. The platform never gets the institutional adoption you need because building it well requires engineering capacity most MSSPs don’t have.

The third path: agentic delivery

What changes the equation is automating eligible analyst work under explicit controls, not just automating the handoffs around it. Security Delivery Agents can triage, investigate, enrich, and document supported workflows. Gamebooks make operating procedures executable, and a multi-workspace control plane lets analysts supervise the work across customer environments.

This is the path ContraForce is built for. Providers should test whether cost per eligible incident falls and throughput per analyst rises against their own baseline, while monitoring exceptions and delivery quality. The result depends on incident mix, procedure coverage, integrations, and approval policy.

To model those numbers with your own incident volume and delivery costs, use the security delivery margin calculator.

More posts