The Margin Your Tool Stack Quietly Eats
Run the same managed contract you sold 3 years ago through today's cost stack and the margin is thinner, sometimes by 10 points, even though you never touched the price. Nothing broke. Your vendors raised their rates while you held yours, and the difference came straight out of your profit.
This is the arithmetic of running an MSP as it scales. Revenue per seat holds flat because that's what the contract says. The cost to deliver that seat climbs every renewal cycle, and unless you go back and re-price, you absorb the whole increase without ever making a decision to.
The increases are not hypothetical. Microsoft raised commercial licensing 5 to 7 percent through 2025, with an 8.3 percent bump on E3 landing in 2026. EDR, backup, identity, and email security vendors lifted list prices across 2024 and 2025. Analysts who watch MSP economics estimate that a serious modern security posture, EDR plus a SOC service, vulnerability management, identity governance, and DNS-layer protection, now stacks up to $25 to $50 per seat. Every dollar of that lands on your cost of delivery whether or not it lands on the invoice.
The stack grows faster than the invoice
When you signed the client, the stack was an RMM tool, antivirus, and a backup product. Then the threat model changed and you added EDR because antivirus stopped being enough. Then MFA and identity governance, because the insurers started asking. Then a SOC service, because you can't watch alerts at three in the morning. Each addition was correct. Each one added per-seat cost. The client never saw a line item change, because you folded it into a price that was set before half those tools existed.
That's how tool sprawl quietly kills a margin. One study of MSP cost structures found that combined vendor and tooling costs can consume 20 to 25 percent of gross margin, and that plenty of owners have never audited the stack line by line to see what they're actually paying for and what's still running that nobody uses. The per-endpoint pricing model makes it worse as you grow. Every new seat you add multiplies the tool cost in lockstep, so scale doesn't dilute the burden the way owners expect. It compounds it.
Security and compliance turned a cost into an obligation
The security stack used to be an upsell. It's now the price of staying in business, and the liability sits with you.
Cyber insurance underwriters, for your clients and for your own firm, will no longer renew a policy without EDR, MFA across every user, tested backup and disaster recovery, security awareness training, and a documented incident response plan. Those aren't recommendations, they're conditions of coverage. Clients working anywhere near defense contracts now carry CMMC obligations that flow down to you as the provider handling their data. So the $25 to $50 a seat isn't optional spend you can trim in a tight quarter. It's the floor, and if you get it wrong the exposure is yours. MSPs increasingly carry both errors-and-omissions and third-party cyber liability coverage precisely because a breach at a client can become a lawsuit against the provider who was supposed to prevent it.
The obligation rises with every client you add and every new requirement the insurers and regulators publish. The price you charge does not rise on its own to match.
Price the seat you actually deliver
Start with an audit. Pull every tool, every license, every per-seat and per-technician fee, and put it against the revenue for each contract. If tooling is eating a fifth of your gross margin and you've never done this line by line, you'll find money leaking somewhere you didn't expect, either in shelfware you're still paying for or in seats you're delivering below cost.
Then fix the contract, not just the spend. Every managed agreement needs a price-increase clause tied to your input costs, so a vendor's hike doesn't automatically become your loss. Pass the security stack through as its own line, named and priced, so the client understands they're buying protection and not absorbing a mystery. Look hard at per-technician tooling instead of per-endpoint where the math favors it, because a cost that scales with your team is more predictable than one that scales with every device you touch. The margin you protect this way is the same margin a buyer capitalizes at 8 or 10 times. Left alone, it erodes a point or two a year until the business is busy, profitable on paper, and quietly worth less every renewal.