Cyber Risk: The Board Room Edition
The MSSP renewal notice arrives, and the instinct is usually one of two things: accept it because switching is painful, or push back on price because the number went up. Both responses assume the same kind of relationship. They aren’t always negotiating the same kind of relationship — and the move set for one is close to the opposite of the move set for the other.
The Lead
There are two kinds of managed security providers, and they call for two different negotiations.
A vendor delivers a service that is largely interchangeable. Defined SLAs, commoditized monitoring, a function another provider could pick up. The relationship is transactional, and it should be negotiated that way. Leverage comes from switching cost and a credible alternative. The move is to go get quotes, build a real competitive comparison, and anchor on price and SLA terms. With a vendor, leverage peaks at renewal — that is the moment a buyer can actually leave, and the negotiation should use it.
A partner is embedded in operations. They hold institutional knowledge, they know the environment, they have tuned detections to the specific noise of a specific network over years. They cannot be ripped out without real disruption. The threat to leave isn’t credible, which means price-anchoring and a bake-off fall flat — and worse, they can damage a relationship that carries genuine value. A partner is negotiated on performance and metrics, not on price quotes: mean-time-to-detect trends, the incidents they caught, the tickets they closed, the ones they missed. The conversation is about value delivered, and it is strongest when it draws on a year of documented evidence rather than a renewal-week comparison.
The two negotiations pull in opposite directions, which is what makes naming the relationship the first move. A commodity vendor handled like a partner gets overpaid out of loyalty. A true partner handled like a vendor — dropped into a price bake-off — can walk away holding two years of context that is expensive to rebuild. The tactics only work once the relationship type is clear.
Quick tip: The diagnosis is simple to run. Ask one question — if this provider disappeared Monday morning, could another firm pick up the work in a few weeks, or would it take months to rebuild what they know about us? If the answer is weeks, you have a vendor; negotiate on price and bring quotes. If it’s months, you have a partner; negotiate on performance and bring the metrics. The honest answer to that one question sets the entire strategy before a single number gets discussed.
There’s a timing dimension that follows from this. With a vendor, leverage is concentrated at the renewal date — that is when the alternative is live. With a partner, leverage is continuous and built across the year. Each QBR, each documented win, each tracked metric becomes part of the case. By the time the renewal lands, a partner negotiation isn’t really a negotiation — it’s the presentation of a case that’s already been built. A partner relationship that goes untouched until the renewal notice arrives has skipped the part of the process where the leverage gets made.
So the renewal conversation actually starts two quarters early, and it starts with a question that has nothing to do with price: which one is this? The diagnosis sets the strategy. The strategy sets the tactics. Reaching for tactics first — quotes, anchors, walk-away threats — before the relationship is named is how a buyer ends up running the wrong play against the right provider.
The Close
One question to bring to the next MSSP renewal, well before the notice lands:
Is this provider a vendor or a partner — and is the renewal being negotiated the way that answer demands?
If the provider is a vendor, the leverage is the alternative, and it’s strongest at renewal. If the provider is a partner, the leverage is the performance record, and it has to be built across the year. The fastest way to lose the negotiation is to bring vendor tactics to a partner relationship, or partner loyalty to a vendor transaction.
